CVE-2023-44390 HtmlSanitizer vulnerable to Cross-site Scripting in Foreign Content

HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. The vulnerability occurs in configurations where foreign content is allowed, i.e. either svg or math are in the list of allowed elements. In the case an application sanitizes us...

Mganss HtmlSanitizer Cross-Site Scripting Vulnerability

Mganss HtmlSanitizer is a C, AngleSharp based software from Mganss Individual Developers for use in clearing HTML code and documents from source code that could lead to XSS attacks. Mganss HtmlSanitizer suffers from a cross-site scripting vulnerability that stems from the presence of a cross-site...

HtmlSanitizer vulnerable to Cross-site Scripting in Foreign Content

Impact The vulnerability occurs in configurations where foreign content is allowed, i.e. either svg or math are in the list of allowed elements. Specifically, the requirements for the vulnerability are: 1. Allowing one foreign element: svg, or math 2. Comments or one raw text element: iframe,...

GHSA-43CP-6P3Q-2PC4 HtmlSanitizer vulnerable to Cross-site Scripting in Foreign Content

Impact The vulnerability occurs in configurations where foreign content is allowed, i.e. either svg or math are in the list of allowed elements. Specifically, the requirements for the vulnerability are: 1. Allowing one foreign element: svg, or math 2. Comments or one raw text element: iframe,...

GHSA-M6J2-V3GQ-45R5 Cross-site Scripting in aurelia-framework

The HTMLSanitizer class in html-sanitizer.ts in all released versions of the Aurelia framework 1.x repository is vulnerable to XSS. The sanitizer only attempts to filter SCRIPT elements, which makes it feasible for remote attackers to conduct XSS attacks via for example JavaScript code in an...

Cross-site Scripting in aurelia-framework

The HTMLSanitizer class in html-sanitizer.ts in all released versions of the Aurelia framework 1.x repository is vulnerable to XSS. The sanitizer only attempts to filter SCRIPT elements, which makes it feasible for remote attackers to conduct XSS attacks via for example JavaScript code in an...

CVE-2019-10062

The HTMLSanitizer class in html-sanitizer.ts in all released versions of the Aurelia framework 1.x repository is vulnerable to XSS. The sanitizer only attempts to filter SCRIPT elements, which makes it feasible for remote attackers to conduct XSS attacks via for example JavaScript code in an...

CVE-2019-10062

The HTMLSanitizer class in html-sanitizer.ts in all released versions of the Aurelia framework 1.x repository is vulnerable to XSS. The sanitizer only attempts to filter SCRIPT elements, which makes it feasible for remote attackers to conduct XSS attacks via for example JavaScript code in an...

Design/Logic Flaw

The HTMLSanitizer class in html-sanitizer.ts in all released versions of the Aurelia framework 1.x repository is vulnerable to XSS. The sanitizer only attempts to filter SCRIPT elements, which makes it feasible for remote attackers to conduct XSS attacks via for example JavaScript code in an...

CVE-2019-10062

The HTMLSanitizer class in html-sanitizer.ts in all released versions of the Aurelia framework 1.x repository is vulnerable to XSS. The sanitizer only attempts to filter SCRIPT elements, which makes it feasible for remote attackers to conduct XSS attacks via for example JavaScript code in an...

CVE-2019-10062

CVE-2019-10062 affects the Aurelia framework 1.x, specifically the HTMLSanitizer in html-sanitizer.ts. The root cause is a sanitizer that only filters SCRIPT elements, enabling potential XSS via JavaScript in attributes of other elements and possible nesting/splitting bugs in SCRIPT handling. The...

Cross-site Scripting (XSS)

HtmlSanitizer is vulnerable to cross-site scripting XSS. The vulnerability exists through the lack of handling of...

CVE-2020-26293

HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. In HtmlSanitizer before version 5.0.372, there is a possible XSS bypass if style tag is allowed. If you have explicitly allowed the tag, an attacker could craft HTML that includ...

CVE-2020-26293

HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. In HtmlSanitizer before version 5.0.372, there is a possible XSS bypass if style tag is allowed. If you have explicitly allowed the tag, an attacker could craft HTML that includ...

Design/Logic Flaw

HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. In HtmlSanitizer before version 5.0.372, there is a possible XSS bypass if style tag is allowed. If you have explicitly allowed the tag, an attacker could craft HTML that includ...

GHSA-8J9V-H2VP-2HHV XSS in HtmlSanitizer

Impact If you have explicitly allowed the tag, an attacker could craft HTML that includes script after passing through the sanitizer. The default settings disallow the tag so there is no risk if you have not explicitly allowed the tag. Patches The problem has been fixed in version 5.0.372...

XSS in HtmlSanitizer

Impact If you have explicitly allowed the tag, an attacker could craft HTML that includes script after passing through the sanitizer. The default settings disallow the tag so there is no risk if you have not explicitly allowed the tag. Patches The problem has been fixed in version 5.0.372...

CVE-2020-26293

The provided connected documents confirm a concrete vulnerability in HtmlSanitizer (a .NET library) where an XSS bypass is possible in versions before 5.0.372 if the tag is explicitly allowed. The default policy disallows , so risk exists only when that tag is whitelisted. The issue has been fix...

CVE-2020-26293 Possible XSS bypass if style tag is allowed

HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. In HtmlSanitizer before version 5.0.372, there is a possible XSS bypass if style tag is allowed. If you have explicitly allowed the tag, an attacker could craft HTML that includ...

Mganss HtmlSanitizer Cross-Site Scripting Vulnerability

Mganss HtmlSanitizer is a C, AngleSharp based software from Mganss Individual Developers for use in clearing HTML code and documents from source code that could lead to XSS attacks. HtmlSanitizer suffers from a cross-site scripting vulnerability, which can be exploited by an attacker to create...