DEBIAN-CVE-2017-1002201

In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like " ' must be escaped properly. In this case, the ' character was missed. An attacker can manipulate the input to introduce additional attributes, potentially executing code...

CVE-2017-1002201

In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like " ' must be escaped properly. In this case, the ' character was missed. An attacker can manipulate the input to introduce additional attributes, potentially executing code...

Code injection

In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like " ' must be escaped properly. In this case, the ' character was missed. An attacker can manipulate the input to introduce additional attributes, potentially executing code...

UBUNTU-CVE-2017-1002201

In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like " ' must be escaped properly. In this case, the ' character was missed. An attacker can manipulate the input to introduce additional attributes, potentially executing code...

CVE-2017-1002201

In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like " ' must be escaped properly. In this case, the ' character was missed. An attacker can manipulate the input to introduce additional attributes, potentially executing code...

CVE-2017-1002201

In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like " ' must be escaped properly. In this case, the ' character was missed. An attacker can manipulate the input to introduce additional attributes, potentially executing code...

CVE-2017-1002201

CVE-2017-1002201 describes a cross-site scripting/code execution risk in Haml prior to 5.0.0.beta.2 when user input is used on the server and the single quote character was not escaped, allowing input manipulation that could introduce attributes and potentially execute code. Public details confir...

CVE-2017-1002201

In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like " ' must be escaped properly. In this case, the ' character was missed. An attacker can manipulate the input to introduce additional attributes, potentially executing code...

Cross-site Scripting (XSS)

haml is vulnerable to cross-site scripting XSS attacks. The library does not escape characters like \ " ' properly, meaning that a malicious user can prepend these characters to inject and execute arbitrary code...

haml failure to escape single quotes

In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like " ' must be escaped properly. In this case, the ' character was missed. An attacker can manipulate the input to introduce additional attributes, potentially executing code...

Cross-site Scripting (XSS)

Overview haml is a layer on top of HTML or XML that's designed to express the structure of documents in an easy way by using indentation rather than closing tags and allowing Ruby to be embedded with ease. Affected versions of this package are vulnerable to Cross-site Scripting XSS. When using us...

Cross-site Scripting (XSS)

haml is vulnerable to cross-site scripting XSS attacks. The attack is possible because the parameter hash is not properly encoded when a specific key is not used...

Man In The Middle (mitm)

haml-rails is vulnerable to man-in-the-middle MitM attacks. The gemcutter source is deprecated because HTTP requests are insecure. A malicious user can potentially compromise the source to conduct MitM attacks...