Uncontrolled Recursion in Loofah

Summary Loofah = 2.2.0, = 2.19.1. Users who are unable to upgrade may be able to mitigate this vulnerability by limiting the length of the strings that are sanitized...

Improper neutralization of data URIs may allow XSS in Loofah

Summary Loofah = 2.1.0, = 2.19.1...

Inefficient Regular Expression Complexity in Loofah

Summary Loofah = 2.19.1...

PT-2022-16045

Name of the Vulnerable Software and Affected Versions Loofah versions 2.1.0 through 2.19.0 Description The issue concerns a cross-site scripting vulnerability via the image/svg+xml media type in data URIs. This vulnerability affects Loofah, a library for manipulating and transforming HTML/XML...

PT-2022-16046

Name of the Vulnerable Software and Affected Versions Loofah versions 2.2.0 through 2.19.0 Description Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. It uses recursion for sanitizing CDATA sections, making it susceptible t...

PT-2022-16044

Name of the Vulnerable Software and Affected Versions Loofah versions prior to 2.19.1 Description Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. It contains an inefficient regular expression that is susceptible to excessiv...

Improper neutralization of data URIs may allow XSS in rails-html-sanitizer

Summary rails-html-sanitizer = 1.0.3, = 2.1.0. Mitigation Upgrade to rails-html-sanitizer = 1.4.4...

SUSE-SU-2022:4075-1 Security update for rubygem-loofah

This update for rubygem-loofah fixes the following issues: - CVE-2019-15587: Fixed issue in sanitization of crafted SVG elements bsc1154751...

SUSE SLES15: ruby2.5-rubygem-loofah / ruby2.5-rubygem-loofah-doc / etc (SUSE-SU-2022:3868-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:3868-1 advisory. - CVE-2019-15587: Fixed issue in sanitization of crafted SVG elements bsc1154751. Tenable has extracted the preceding description block...

SUSE-SU-2022:3868-1 Security update for rubygem-loofah

This update for rubygem-loofah fixes the following issues: - CVE-2019-15587: Fixed issue in sanitization of crafted SVG elements bsc1154751...

Ruby on Rails: ReDoS (Rails::Html::PermitScrubber.scrub_attribute)

I have confirmed that ReDoS occurs on Rails::Html::PermitScrubber.scrubattribute. https://github.com/rails/rails-html-sanitizer/blob/v1.4.3/lib/rails/html/scrubbers.rbL134 ruby def scrubattributenode, attrnode attrname = if attrnode.namespace "attrnode.namespace.prefix:attrnode.nodename" else...

Malicious code in @loofah/fetlife-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 19c3edd933c704fce6bd863986ef7828f434e267f63cf64d73ed5667f150724e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-400 Malicious code in @loofah/fetlife-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 19c3edd933c704fce6bd863986ef7828f434e267f63cf64d73ed5667f150724e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SQL Injection Vulnerability in Loofah Video App

Loofah Video App is a video app. Loofah Video APP suffers from a SQL injection vulnerability. An attacker can exploit the vulnerability to obtain sensitive database information...

Ubuntu: Security Advisory (USN-4498-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-4498-1: Loofah vulnerability

It was discovered that Loofah does not properly sanitize JavaScript in sanitized output. An attacker could possibly use this issue to perform XSS attacks. CVE-2019-15587...

USN-4498-1 ruby-loofah vulnerability

It was discovered that Loofah does not properly sanitize JavaScript in sanitized output. An attacker could possibly use this issue to perform XSS attacks. CVE-2019-15587...

Ubuntu 16.04 LTS : Loofah vulnerability (USN-4498-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4498-1 advisory. It was discovered that Loofah does not properly sanitize JavaScript in sanitized output. An attacker could possibly use this issue to perform XSS attacks...

Vulnerability in the library for processing and transforming HTML/XML code fragments: The Ruby loofah library has a vulnerability related to the lack of protection for website structure. This allows attackers to compromise data integrity.

The vulnerability in the library for processing and transforming HTML/XML code fragments in Ruby Loofah is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to compromise the integrity of data...

Fedora 31 : rubygem-loofah (2020-03c0964b6a)

Fix XXS when a crafted SVG element is republished. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues....