CVE-2015-7578: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via crafted tag attributes...

CVE-2015-7579: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the rails-html-sanitizer gem 1.0.2 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via an HTML entity that is mishandled by the Rails::Html::FullSanitizer class...

SUSE-SU-2016:0391-1 Security update for rubygem-rails-html-sanitizer

This update for rubygem-rails-html-sanitizer fixes the following issues: - CVE-2015-7579: XSS vulnerability in rails-html-sanitizer bsc963327 - CVE-2015-7578: XSS vulnerability via attributes bsc963326 - CVE-2015-7580: XSS via whitelist sanitizer bsc963328...

Ruby on Rails rails-html-sanitizer cross-site scripting vulnerability (CNVD-2016-00966)

Ruby on Rails is Rails core team to develop and maintain a set of open source Ruby-based Web application framework . rails-html-sanitizer is one of the HTML code cleanup package . Ruby on Rails rails-html-sanitizer has a cross-site scripting vulnerability that can be exploited by remote attackers...

Ruby on Rails rails-html-sanitizer cross-site scripting vulnerability

Ruby on Rails is Rails core team to develop and maintain a set of open source Ruby-based Web application framework . rails-html-sanitizer is one of the HTML code cleanup package . Ruby on Rails rails-html-sanitizer has a cross-site scripting vulnerability that can be exploited by remote attackers...

Ruby on Rails rails-html-sanitizer cross-site scripting vulnerability (CNVD-2016-00964)

Ruby on Rails is Rails core team to develop and maintain a set of open source Ruby-based Web application framework . rails-html-sanitizer is one of the HTML code cleanup package . Ruby on Rails rails-html-sanitizer has a cross-site scripting vulnerability that can be exploited by remote attackers...

openSUSE Security Update : rubygem-rails-html-sanitizer (openSUSE-2016-148)

This update for rubygem-rails-html-sanitizer fixes the following issues : - CVE-2015-7579: XSS vulnerability in rails-html-sanitizer bsc963327 - CVE-2015-7578: XSS vulnerability via attributes bsc963326 - CVE-2015-7580: XSS via whitelist sanitizer bsc963328 %NASLMINLEVEL 70300 C Tenable Network...

openSUSE: Security Advisory for rubygem-rails-html-sanitizer (openSUSE-SU-2016:0356-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security update for rubygem-rails-html-sanitizer (important)

This update for rubygem-rails-html-sanitizer fixes the following issues: - CVE-2015-7579: XSS vulnerability in rails-html-sanitizer bsc963327 - CVE-2015-7578: XSS vulnerability via attributes bsc963326 - CVE-2015-7580: XSS via whitelist sanitizer bsc963328...

PT-2016-3817

Name of the Vulnerable Software and Affected Versions rails-html-sanitizer gem versions prior to 1.0.3 Ruby on Rails versions 4.2.x and 5.x Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node. This is due to a...

PT-2016-3815

Name of the Vulnerable Software and Affected Versions rails-html-sanitizer gem versions prior to 1.0.3 Ruby on Rails versions 4.2.x and 5.x Description The issue allows remote attackers to inject arbitrary web script or HTML via crafted tag attributes, which can lead to cross-site scripting XSS...

PT-2016-3816

Name of the Vulnerable Software and Affected Versions rails-html-sanitizer gem version 1.0.2 Ruby on Rails versions 4.2.x through 5.x Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via an HTML entity that is mishandled by the...

openSUSE: Security Advisory for roundcubemail (openSUSE-SU-2016:0214-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Possible XSS vulnerability in rails-html-sanitizer

There is a possible XSS vulnerability in rails-html-sanitizer. This vulnerability has been assigned the CVE identifier CVE-2015-7578. Versions Affected: All. Not affected: None. Fixed Versions: 1.0.3 Impact ------ There is a possible XSS vulnerability in rails-html-sanitizer. Certain attributes a...

Possible XSS vulnerability in rails-html-sanitizer

There is a possible XSS vulnerability in the white list sanitizer in the rails-html-sanitizer gem. This vulnerability has been assigned the CVE identifier CVE-2015-7580. Versions Affected: All. Not affected: None. Fixed Versions: v1.0.3 Impact ------ Carefully crafted strings can cause user input...

Regular Expression Denial of Service

Overview All versions of the bleach package are vulnerable to a regular expression denial of service attack when certain types of input are passed into the sanitize function. Recommendation The bleach package is not currently maintained, and has not seen an update since 2014. To mitigate this...

Ruby on Rails: Potential XSS on sanitize/Rails::Html::WhiteListSanitizer

Possible XSS vulnerability in rails-html-sanitizer There is a possible XSS vulnerability in the white list sanitizer in the rails-html-sanitizer gem. This vulnerability has been assigned the CVE identifier CVE-2015-7580. Versions Affected: All. Not affected: None. Fixed Versions: v1.0.3 Impact...

Ruby on Rails: Data-Tags and the New HTML Sanitizer Subverts CSRF protection

Possible XSS vulnerability in rails-html-sanitizer There is a possible XSS vulnerability in rails-html-sanitizer. This vulnerability has been assigned the CVE identifier CVE-2015-7578. Versions Affected: All. Not affected: None. Fixed Versions: 1.0.3 Impact ------ There is a possible XSS...

Information Exposure

OWASP Java HTML Sanitizer is vulnerable to Information Exposure. The vulnerability is due to improper handling of crafted FORM elements within a NOSCRIPT tag when JavaScript is disabled, which allows an attacker to obtain sensitive information through user-assisted interaction...

CVE-2013-1855

The sanitizecss method in lib/actioncontroller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle \n newline characters, which makes it easier for remote attackers to...