275 matches found
The vulnerability of the Rails Html Sanitizer configuration tool for Rails applications stems from improper handling of input data during web page generation. This allows attackers to perform cross-site scripting attacks.
The vulnerability of the Rails Html Sanitizer configuration tool for Rails applications is related to the use of Rails in conjunction with Loofah. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...
ROS-20240815-13
A vulnerability in the configuration implementation of the HTML cleanup tool for Rails Rails Html Sanitizer applications is related to content injection if the application developer overrides the allowed tags "math" and "style" or "svg" and "style". Exploitation of the vulnerability could allow a...
OPENSUSE-SU-2024:14171-1 ruby3.3-rubygem-loofah-2.22.0-1.5 on GA media
These are all security issues fixed in the ruby3.3-rubygem-loofah-2.22.0-1.5 package on the GA media of openSUSE Tumbleweed...
OPENSUSE-SU-2024:13162-1 ruby3.2-rubygem-loofah-2.19.1-1.2 on GA media
These are all security issues fixed in the ruby3.2-rubygem-loofah-2.19.1-1.2 package on the GA media of openSUSE Tumbleweed...
OPENSUSE-SU-2024:12768-1 ruby3.1-rubygem-loofah-2.19.1-1.1 on GA media
These are all security issues fixed in the ruby3.1-rubygem-loofah-2.19.1-1.1 package on the GA media of openSUSE Tumbleweed...
OPENSUSE-SU-2024:11900-1 ruby3.1-rubygem-loofah-2.14.0-1.1 on GA media
These are all security issues fixed in the ruby3.1-rubygem-loofah-2.14.0-1.1 package on the GA media of openSUSE Tumbleweed...
Fedora 40 : rubygem-loofah (2023-1bbea3700b)
The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-1bbea3700b advisory. Automatic update for rubygem-loofah-2.22.0-1.fc40. Changelog Thu Nov 23 2023 Vt Ondruch - 2.22.0-1 - Update to Loofah 2.22.0. Resolves: rhbz2126896...
Debian dla-3565 : ruby-loofah - security update
The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3565 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3565-1 [email protected]...
Debian: Security Advisory (DLA-3565-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] [DLA 3565-1] ruby-loofah security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-3565-1 [email protected] https://www.debian.org/lts/security/ Sylvain Beucler September 13, 2023 https://wiki.debian.org/LTS -...
DLA-3565-1 ruby-loofah - security update
Bulletin has no description...
Rocky Linux 8 : Satellite 6.13 Release (Important) (RLSA-2023:2097)
The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:2097 advisory. - SnakeYaml's Constructor class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an...
rubygem-loofah: inefficient regular expression leading to denial of service
An inefficient regular expression vulnerability was found in rubygem loofah. While sanitizing certain SVG attributes, loofah is susceptible to excessive backtracking, which can result in a denial of service through CPU resource consumption...
rubygem-loofah: Uncontrolled Recursion leading to denial of service
An uncontrolled recursion vulnerability was found in rubygem loofah. While sanitizing certain sections, loofah is susceptible to stack exhaustion, which can result in a denial of service through CPU resource consumption...
rubygem-rails-html-sanitizer: Improper neutralization of data URIs leading to Cross site scripting
A Cross-site scripting vulnerability was found in rails-html-sanitizer. When used in combination with Loofah since version 2.1.0, improper neutralization of data URIs may allow Cross-site scripting...
rubygem-loofah: Improper neutralization of data URIs leading to Cross Site Scripting
A Cross-site scripting vulnerability was found in rubygem loofah. While neutralizing certain data URIs, loofah is susceptible to Cross-site scripting attacks...
SUSE SLES15 / openSUSE 15 Security Update : rubygem-loofah (SUSE-SU-2023:1657-1)
The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1657-1 advisory. - Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofa...
SUSE-SU-2023:1657-1 Security update for rubygem-loofah
This update for rubygem-loofah fixes the following issues: - CVE-2022-23514: Fixed inefficient regular expression leading to denial of service bsc1206415. - CVE-2022-23515: Fixed improper neutralization of data URIs leading to Cross Site Scripting bsc1206417. - CVE-2022-23516: Fixed uncontrolled...
