CVE-2018-8048

In the Loofah gem through 2.2.0 for Ruby, non-whitelisted HTML attributes may occur in sanitized output by republishing a crafted HTML fragment...

DEBIAN-CVE-2018-8048

In the Loofah gem through 2.2.0 for Ruby, non-whitelisted HTML attributes may occur in sanitized output by republishing a crafted HTML fragment...

CVE-2018-8048

In the Loofah gem through 2.2.0 for Ruby, non-whitelisted HTML attributes may occur in sanitized output by republishing a crafted HTML fragment...

CVE-2018-8048

CVE-2018-8048 affects the Loofah Ruby gem (through version 2.2.0). The vulnerability allows non-whitelisted HTML attributes to appear in sanitized output when a crafted HTML fragment is republished, enabling potential cross-site scripting (XSS). Public details come from the CVE entry and corrobor...

CVE-2018-8048

In the Loofah gem through 2.2.0 for Ruby, non-whitelisted HTML attributes may occur in sanitized output by republishing a crafted HTML fragment...

MISP has an unspecified vulnerability

MISP is a suite of open source software solutions for collecting, storing, distributing and sharing cybersecurity metrics and threats cybersecurity event analysis and malware analysis. A security vulnerability exists in the app/Model/Attribute.php file in MISP. An attacker could exploit the...

MISP cross-site scripting vulnerability (CNVD-2018-06388)

MISP is a suite of open source software solutions for collecting, storing, distributing and sharing cybersecurity metrics and threats cybersecurity event analysis and malware analysis. A cross-site scripting vulnerability exists in the app/View/Events/resolvedattributes.ctp file in MISP. A remote...

Ruby Loofah gem cross-site scripting vulnerability

The Ruby Loofah gem is a general-purpose library for manipulating and transforming HTML/XML documents. A cross-site scripting vulnerability exists in Ruby Loofah gem version 2.2.0 and earlier. A remote attacker can exploit this vulnerability by redistributing specially crafted HTML snippets to...

CVE-2018-8949

An issue was discovered in app/Model/Attribute.php in MISP before 2.4.89. There is a critical API integrity bug, potentially allowing users to delete attributes of other events. A crafted edit for an event without attribute UUIDs but attribute IDs set could overwrite an existing attribute...

CVE-2018-8948

In MISP before 2.4.89, app/View/Events/resolvedattributes.ctp has multiple XSS issues via a malicious MISP module...

Cross-site Scripting (XSS)

rails-html-sanitizer is vulnerable to cross-site scripting XSS attacks. Attackers can use non-whiltelisted attributes within sanitized output to inject and execute arbitrary webscript...

XSS vulnerability in rails-html-sanitizer

There is a possible XSS vulnerability in rails-html-sanitizer. The gem allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments, and these attributes can lead to an XSS attack on target applications. This issue is similar to CVE-2018-804...

rails-html-sanitizer -- possible XSS vulnerability

OSS-Security list: There is a possible XSS vulnerability in rails-html-sanitizer. The gem allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments, and these attributes can lead to an XSS attack on target applications. This issue is...

Cross-site Scripting in loofah

Loofah allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments. Users are affected if running Loofah = 2.9.2. JRuby users are not affected...

FreeBSD : Loofah -- XSS vulnerability (ba6d0c9b-f5f6-4b9b-a6de-3cce93c83220)

GitHub issue : This issue has been created for public disclosure of an XSS / code injection vulnerability that was responsibly reported by the Shopify Application Security Team. Loofah allows non-whitelisted attributes to be present in sanitized output when input with specially crafted HTML...

PT-2018-18405

Name of the Vulnerable Software and Affected Versions: Loofah versions prior to 2.2.1 Description: The issue allows non-whitelisted HTML attributes to be present in sanitized output when input with specially-crafted HTML fragments. Users are affected when running on MRI or RBX, in combination wit...

Sanitize -- XSS vulnerability

Sanitize release: Fixed an HTML injection vulnerability that could allow XSS. When Sanitize = 2.9.2, a specially crafted HTML fragment can cause libxml2 to generate improperly escaped output, allowing non-whitelisted attributes to be used on whitelisted elements. Sanitize now performs additional...

Loofah XSS Vulnerability

Loofah allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments...

Description of the security update for SharePoint Server 2010 Office Web Apps: March 13, 2018

Description of the security update for SharePoint Server 2010 Office Web Apps: March 13, 2018 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities...

End of support for Office 2007

End of support for Office 2007 Support for Office 2007 ended on October 10, 2017. All of your Office 2007 apps will continue to function. However, you could expose yourself to serious and potentially harmful security risks. Upgrade to a newer version of Office so you can stay up to date with all...