Haml Cross-Site Scripting Vulnerability

haml is an open source HTML abstract markup language from the Haml HAML team. A cross-site scripting vulnerability exists in haml-coffee, which supports overriding a range of HTML helper functions through its configuration options. Control of the escapeHtml parameter through template configuratio...

GHSA-M7MF-VM62-7X3Q Insecure template handling in haml-coffee

haml-coffee is a JavaScript templating solution. haml-coffee mixes pure template data with engine configuration options through the Express render API. More specifically, haml-coffee supports overriding a series of HTML helper functions through its configuration options. A vulnerable application...

@27works/posto (2.0.2), @lluis/codo (>=2.1.2, <=2.1.3) +70 more potentially affected by CVE-2021-32818 via haml-coffee (>=1.4.1, <=1.14.1)

haml-coffee NPM version =1.4.1, =2.1.2, =0.0.2, =2.1.3, =0.0.1, =0.0.1, =0.2.0, =0.2.0, =0.0.1, =0.0.1, =0.0.1, =0.1.0, =0.1.1 and more Source cves: CVE-2021-32818 Source advisory: OSV:GHSA-M7MF-VM62-7X3Q...

Insecure template handling in haml-coffee

haml-coffee is a JavaScript templating solution. haml-coffee mixes pure template data with engine configuration options through the Express render API. More specifically, haml-coffee supports overriding a series of HTML helper functions through its configuration options. A vulnerable application...

Remote Code Execution

haml-coffee is vulnerable to remote code execution. A remote attacker is able to execute arbitrary code in downstream applications via the customHtmlEscape parameter. Additionally, control over the escapeHtml parameter allows an attacker to perform cross-site scripting attacks...

CVE-2021-32818

haml-coffee is a JavaScript templating solution. haml-coffee mixes pure template data with engine configuration options through the Express render API. More specifically, haml-coffee supports overriding a series of HTML helper functions through its configuration options. A vulnerable application...

CVE-2021-32818

haml-coffee is a JavaScript templating solution. haml-coffee mixes pure template data with engine configuration options through the Express render API. More specifically, haml-coffee supports overriding a series of HTML helper functions through its configuration options. A vulnerable application...

Cross site scripting

haml-coffee is a JavaScript templating solution. haml-coffee mixes pure template data with engine configuration options through the Express render API. More specifically, haml-coffee supports overriding a series of HTML helper functions through its configuration options. A vulnerable application...

CVE-2021-32818

Affected software: haml-coffee (JavaScript templating solution). Vulnerability summary: A vulnerable application that passes user-controlled request objects to the haml-coffee template engine may suffer remote code execution. Additionally, config pollution can expose the escapeHtml control, preve...

CVE-2021-32818 Remote code execution and Reflected cross site scripting in haml-coffee

haml-coffee is a JavaScript templating solution. haml-coffee mixes pure template data with engine configuration options through the Express render API. More specifically, haml-coffee supports overriding a series of HTML helper functions through its configuration options. A vulnerable application...

haml 跨站脚本漏洞

haml is an open source HTML abstract markup language from the Haml HAML team. A cross-site scripting vulnerability exists in haml-coffee, which supports overriding a range of HTML helper functions through its configuration options. Control of the escapeHtml parameter through template configuratio...

Haml: Arbitrary code execution

Background Haml is a templating engine for HTML. Description It was discovered that Haml was not correctly filtering out special characters which may be used for attributes. Impact A remote attacker could possibly execute arbitrary code with the privileges of the process or cause a Denial of...

GLSA-202007-27 : Haml: Arbitrary code execution

The remote host is affected by the vulnerability described in GLSA-202007-27 Haml: Arbitrary code execution It was discovered that Haml was not correctly filtering out special characters which may be used for attributes. Impact : A remote attacker could possibly execute arbitrary code with the...

Debian DLA-1986-1 : ruby-haml security update

In haml, when using user input to perform tasks on the server, characters like ' ' must be escaped properly. In this case, the ' character was missed. An attacker can manipulate the input to introduce additional attributes, potentially executing code. For Debian 8 'Jessie', this problem has been...

Debian: Security Advisory (DLA-1986-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 1986-1] ruby-haml security update

Package : ruby-haml Version : 4.0.5-2+deb8u1 CVE ID : CVE-2017-1002201 In haml, when using user input to perform tasks on the server, characters like " must be escaped properly. In this case, the character was missed. An attacker can manipulate the input to introduce additional attributes,...

DLA-1986-1 ruby-haml - security update

Bulletin has no description...

SUSE-SU-2019:2932-1 Security update for rubygem-haml

This update for rubygem-haml fixes the following issue: - CVE-2017-1002201: Fixed an insufficient character escape that could have led to arbitrary code execution bsc1155089...

Haml vulnerable to cross-site scripting

In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like " ' must be escaped properly. In this case, the ' character was missed. An attacker can manipulate the input to introduce additional attributes, potentially executing code...

GHSA-R53W-G4XM-3GC6 Haml vulnerable to cross-site scripting

In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like " ' must be escaped properly. In this case, the ' character was missed. An attacker can manipulate the input to introduce additional attributes, potentially executing code...