GHSA-CGFM-XWP7-2CVR Sanitize-html Vulnerable To REDoS Attacks

The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service ReDoS due to insecure global regular expression replacement logic of HTML comment removal...

Sanitize-html Vulnerable To REDoS Attacks

The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service ReDoS due to insecure global regular expression replacement logic of HTML comment removal...

7ghost (>=4.11.0, <=4.11.46), @21epub/text-block (>=0.0.1, <=1.2.1) +260 more potentially affected by CVE-2022-25887 via sanitize-html (>=2.1.0, <=2.7.0)

sanitize-html NPM version =2.1.0, =4.11.0, =0.0.1, =1.3.0, =2.0.0-alpha.2, =1.2.152, =1.0.85, =1.0.140, =1.1.81, =1.0.36, =1.0.104, =1.0.43, =1.0.5, =1.1.3-u1, =1.1.3-u1, =1.1.3-u2 and more Source cves: CVE-2022-25887 Source advisory: OSV:GHSA-CGFM-XWP7-2CVR...

DEBIAN-CVE-2022-25887

The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service ReDoS due to insecure global regular expression replacement logic of HTML comment removal...

CVE-2022-25887

The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service ReDoS due to insecure global regular expression replacement logic of HTML comment removal...

UBUNTU-CVE-2022-25887

The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service ReDoS due to insecure global regular expression replacement logic of HTML comment removal...

Design/Logic Flaw

The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service ReDoS due to insecure global regular expression replacement logic of HTML comment removal...

CVE-2022-25887 Regular Expression Denial of Service (ReDoS)

The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service ReDoS due to insecure global regular expression replacement logic of HTML comment removal...

CVE-2022-25887

CVE-2022-25887 affects the Node.js package Sanitize-html up to version 2.7.1, vulnerable to a Regular Expression Denial of Service (ReDoS) caused by insecure global regex replacement during HTML comment removal. The NVD entry reports a CVSS v3.1 base score of 7.5 (high impact) with network attack...

CVE-2022-25887

The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service ReDoS due to insecure global regular expression replacement logic of HTML comment removal...

CVE-2022-25887 Regular Expression Denial of Service (ReDoS)

The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service ReDoS due to insecure global regular expression replacement logic of HTML comment removal...

CVE-2022-25887

The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service ReDoS due to insecure global regular expression replacement logic of HTML comment removal...

sanitize-html 安全漏洞

sanitize-html is an open source library from Apostrophe Technologies. It cleans up user-submitted HTML, keeping whitelisted elements and whitelisted attributes on a per-element basis. A security vulnerability exists in sanitize-html versions prior to 2.7.1, which stems from an insecure global...

7ghost (>=4.11.0, <=4.11.46), @21epub/text-block (>=0.0.1, <=1.2.1) +260 more potentially affected by CVE-2022-25887 via sanitize-html (>=2.1.0, <=2.7.0)

sanitize-html NPM version =2.1.0, =4.11.0, =0.0.1, =1.3.0, =2.0.0-alpha.2, =1.2.152, =1.0.85, =1.0.140, =1.1.81, =1.0.36, =1.0.104, =1.0.43, =1.0.5, =1.1.3-u1, =1.1.3-u1, =1.1.3-u2 and more Source cves: CVE-2022-25887 Source advisory: SNYK:JS-SANITIZEHTML-2957526...

Regular Expression Denial of Service (ReDoS)

Overview sanitize-html is a library that allows you to clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS due to insecure global regular...

Security Bulletin: Denial of Service vulnerability in sanitize-html affects IBM Business Automation Workflow (CVE-2021-23382)

Summary A denial of service vulnerability in sanitize-html affects IBM Business Automation Workflow Workflow Center. Vulnerability Details CVEID: CVE-2021-23382 DESCRIPTION: Node.js postcss module is vulnerable to a denial of service, caused by a regular expression denial of Service ReDoS flaw in...

Debian: Security Advisory (DLA-2878-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cross-site Scripting (XSS)

github.com/knadh/listmonk is vulnerable to cross-site scripting XSS. The library does not sanitize HTML strings before passing to toasts function, allowing a malicious user to inject and execute malicious javascript...

Smartstore SmartStoreNET 安全漏洞

Smartstore SmartStoreNET is an open source e-commerce Web platform of Germany Smartstore company . The platform includes CRM, CMS, sales, marketing, payment, order processing and other functions. A security vulnerability exists in SmartstoreNET version 4.1.1. The vulnerability stems from the...

Improper Input Validation

Overview sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts with...