Debian dla-3856 : python3-html-sanitizer - security update

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-3856 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3856-1 [email protected] https://www.debian.org/lts/security/...

ROS-20240815-13

A vulnerability in the configuration implementation of the HTML cleanup tool for Rails Rails Html Sanitizer applications is related to content injection if the application developer overrides the allowed tags "math" and "style" or "svg" and "style". Exploitation of the vulnerability could allow a...

OPENSUSE-SU-2024:14175-1 ruby3.3-rubygem-rails-html-sanitizer-1.6.0-1.5 on GA media

These are all security issues fixed in the ruby3.3-rubygem-rails-html-sanitizer-1.6.0-1.5 package on the GA media of openSUSE Tumbleweed...

CVE-2023-39517 Cross site scripting (XSS) when clicking on an untrusted `<map>` link in Joplin

Joplin is a free, open source note taking and to-do application. A Cross site scripting XSS vulnerability in affected versions allows clicking on an untrusted image link to execute arbitrary shell commands. The HTML sanitizer packages/renderer/htmlUtils.ts::sanitizeHtml preserves links. However,...

CVE-2023-39517 Cross site scripting (XSS) when clicking on an untrusted `<map>` link in Joplin

Joplin is a free, open source note taking and to-do application. A Cross site scripting XSS vulnerability in affected versions allows clicking on an untrusted image link to execute arbitrary shell commands. The HTML sanitizer packages/renderer/htmlUtils.ts::sanitizeHtml preserves links. However,...

CVE-2023-39517 Cross site scripting (XSS) when clicking on an untrusted `<map>` link in Joplin

Joplin is a free, open source note taking and to-do application. A Cross site scripting XSS vulnerability in affected versions allows clicking on an untrusted image link to execute arbitrary shell commands. The HTML sanitizer packages/renderer/htmlUtils.ts::sanitizeHtml preserves links. However,...

OPENSUSE-SU-2024:12769-1 ruby3.1-rubygem-rails-html-sanitizer-1.5.0-1.1 on GA media

These are all security issues fixed in the ruby3.1-rubygem-rails-html-sanitizer-1.5.0-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:12145-1 ruby3.1-rubygem-rails-html-sanitizer-1.4.3-1.1 on GA media

These are all security issues fixed in the ruby3.1-rubygem-rails-html-sanitizer-1.4.3-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:13137-1 ruby3.2-rubygem-rails-html-sanitizer-1.5.0-2.1 on GA media

These are all security issues fixed in the ruby3.2-rubygem-rails-html-sanitizer-1.5.0-2.1 package on the GA media of openSUSE Tumbleweed...

HTML Injection

html-sanitizer is vulnerable to HTML injection. The vulnerability is due to improper handling of unicode normalization, which results in certain unicode characters normalizing to chevrons enabling specially crafted HTML to evade sanitization...

CVE-2024-34078

html-sanitizer is an allowlist-based HTML cleaner. If using keeptypographicwhitespace=False which is the default, the sanitizer normalizes unicode to the NFKC form at the end. Some unicode characters normalize to chevrons; this allows specially crafted HTML to escape sanitization. The problem has...

CVE-2024-34078 html-sanitizer allows arbitrary HTML present after sanitization because of unicode normalization

html-sanitizer is an allowlist-based HTML cleaner. If using keeptypographicwhitespace=False which is the default, the sanitizer normalizes unicode to the NFKC form at the end. Some unicode characters normalize to chevrons; this allows specially crafted HTML to escape sanitization. The problem has...

CVE-2024-34078 html-sanitizer allows arbitrary HTML present after sanitization because of unicode normalization

html-sanitizer is an allowlist-based HTML cleaner. If using keeptypographicwhitespace=False which is the default, the sanitizer normalizes unicode to the NFKC form at the end. Some unicode characters normalize to chevrons; this allows specially crafted HTML to escape sanitization. The problem has...

CVE-2024-34078

Removed by vendor...

CVE-2024-34078

CVE-2024-34078 affects the html-sanitizer library. When keep_typographic_whitespace is false (default), Unicode is normalized to NFKC at the end, and some characters can normalize to chevrons, allowing specially crafted HTML to bypass sanitization. Exploitation could enable HTML injection within ...

CVE-2024-34078 html-sanitizer allows arbitrary HTML present after sanitization because of unicode normalization

html-sanitizer is an allowlist-based HTML cleaner. If using keeptypographicwhitespace=False which is the default, the sanitizer normalizes unicode to the NFKC form at the end. Some unicode characters normalize to chevrons; this allows specially crafted HTML to escape sanitization. The problem has...

PT-2024-25688

Name of the Vulnerable Software and Affected Versions html-sanitizer versions prior to 2.4.2 Description The issue concerns an allowlist-based HTML cleaner. If using keep typographic whitespace=False which is the default, the sanitizer normalizes unicode to the NFKC form at the end. Some unicode...

USN-6748-1: Sanitize vulnerabilities

It was discovered that Sanitize incorrectly handled noscript elements under certain circumstances. An attacker could possibly use this issue to execute a cross-site scripting XSS attack. This issue only affected Ubuntu 22.04 LTS. CVE-2023-23627 It was discovered that Sanitize incorrectly handled...

Debian dsa-5616 : ruby-sanitize - security update

The remote Debian 11 / 12 host has a package installed that is affected by a vulnerability as referenced in the dsa-5616 advisory. - Sanitize is an allowlist-based HTML and CSS sanitizer. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML and CSS through Sanitize...

UBUNTU-CVE-2024-23635

AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Prior to 1.7.5, there is a potential for a mutation XSS mXSS vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerability the...