openSUSE: Security Advisory for rubygem-rails-html-sanitizer (openSUSE-SU-2016:0356-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security update for rubygem-rails-html-sanitizer (important)

This update for rubygem-rails-html-sanitizer fixes the following issues: - CVE-2015-7579: XSS vulnerability in rails-html-sanitizer bsc963327 - CVE-2015-7578: XSS vulnerability via attributes bsc963326 - CVE-2015-7580: XSS via whitelist sanitizer bsc963328...

PT-2016-3816

Name of the Vulnerable Software and Affected Versions rails-html-sanitizer gem version 1.0.2 Ruby on Rails versions 4.2.x through 5.x Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via an HTML entity that is mishandled by the...

PT-2016-3817

Name of the Vulnerable Software and Affected Versions rails-html-sanitizer gem versions prior to 1.0.3 Ruby on Rails versions 4.2.x and 5.x Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node. This is due to a...

PT-2016-3815

Name of the Vulnerable Software and Affected Versions rails-html-sanitizer gem versions prior to 1.0.3 Ruby on Rails versions 4.2.x and 5.x Description The issue allows remote attackers to inject arbitrary web script or HTML via crafted tag attributes, which can lead to cross-site scripting XSS...

openSUSE: Security Advisory for roundcubemail (openSUSE-SU-2016:0214-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Possible XSS vulnerability in rails-html-sanitizer

There is a possible XSS vulnerability in rails-html-sanitizer. This vulnerability has been assigned the CVE identifier CVE-2015-7578. Versions Affected: All. Not affected: None. Fixed Versions: 1.0.3 Impact ------ There is a possible XSS vulnerability in rails-html-sanitizer. Certain attributes a...

Possible XSS vulnerability in rails-html-sanitizer

There is a possible XSS vulnerability in the white list sanitizer in the rails-html-sanitizer gem. This vulnerability has been assigned the CVE identifier CVE-2015-7580. Versions Affected: All. Not affected: None. Fixed Versions: v1.0.3 Impact ------ Carefully crafted strings can cause user input...

Regular Expression Denial of Service

Overview All versions of the bleach package are vulnerable to a regular expression denial of service attack when certain types of input are passed into the sanitize function. Recommendation The bleach package is not currently maintained, and has not seen an update since 2014. To mitigate this...

Ruby on Rails: Potential XSS on sanitize/Rails::Html::WhiteListSanitizer

Possible XSS vulnerability in rails-html-sanitizer There is a possible XSS vulnerability in the white list sanitizer in the rails-html-sanitizer gem. This vulnerability has been assigned the CVE identifier CVE-2015-7580. Versions Affected: All. Not affected: None. Fixed Versions: v1.0.3 Impact...

Ruby on Rails: Data-Tags and the New HTML Sanitizer Subverts CSRF protection

Possible XSS vulnerability in rails-html-sanitizer There is a possible XSS vulnerability in rails-html-sanitizer. This vulnerability has been assigned the CVE identifier CVE-2015-7578. Versions Affected: All. Not affected: None. Fixed Versions: 1.0.3 Impact ------ There is a possible XSS...

Information Exposure

OWASP Java HTML Sanitizer is vulnerable to Information Exposure. The vulnerability is due to improper handling of crafted FORM elements within a NOSCRIPT tag when JavaScript is disabled, which allows an attacker to obtain sensitive information through user-assisted interaction...

CVE-2013-1855

The sanitizecss method in lib/actioncontroller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle \n newline characters, which makes it easier for remote attackers to...

DEBIAN-CVE-2013-1857

The sanitize helper in lib/actioncontroller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded : colon characters in URLs, which makes it easier for remote...

CVE-2013-1855

The sanitizecss method in lib/actioncontroller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle \n newline characters, which makes it easier for remote attackers to...

DSA-2537-1 typo3-src - several

Bulletin has no description...

OWASP Java HTML Sanitizer信息泄露漏洞

Bugtraq ID: 50748 CVE ID：CVE-2011-4457 Owasp-java-html-sanitizer是一款基于java的过滤HTML的应用，用于保护XSS。 当过滤内容与用户交互并且JavaScipt禁用时OWASP HTML Sanitizer存在漏洞，允许重定向或POST到任意URL。导致敏感信息泄露。 OWASP Java HTML Sanitizer 厂商解决方案 OWASP Java HTML Sanitizer r88已经修复此漏洞，建议用户下载使用： http://code.google.com/p/owasp-java-html-sanitiz...

Design/Logic Flaw

OWASP HTML Sanitizer aka owasp-java-html-sanitizer before 88, when JavaScript is disabled, allows user-assisted remote attackers to obtain potentially sensitive information via a crafted FORM element within a NOSCRIPT element...

CVE-2011-4457

OWASP HTML Sanitizer aka owasp-java-html-sanitizer before 88, when JavaScript is disabled, allows user-assisted remote attackers to obtain potentially sensitive information via a crafted FORM element within a NOSCRIPT element...

CVE-2011-4457

OWASP Java HTML Sanitizer (owasp-java-html-sanitizer) before version 88 is affected: when JavaScript is disabled, a crafted FORM element within a NOSCRIPT element can lead to information exposure by user-assisted remote interaction. The issue is fixed in r88; users should upgrade to that release....