459 matches found
Cross-site Scripting (XSS)
cakephp is vulnerable to Cross-Site Scripting. The vulnerability is due to a lack of sanitization of HTML elements in the development only missing route and duplicate named route error pages, which can lead to JavaScript injection...
Cross-site Scripting (XSS)
microweber/microwebe is vulnerable to cross-site scripting. The vulnerability exists due to lack of sanitization in the html elements which allows an attacker to inject and execute malicious javascript...
Internet Bug Bounty: Rails ActionView sanitize helper bypass leading to XSS using SVG tag.
Loofah versions between 2.1.0 and 2.19.1 were vulnerable to a cross-site scripting XSS attack via the image/svg+xml media type in data URIs. This allowed an attacker to bypass HTML sanitization and execute malicious code. The vulnerability was mitigated by upgrading to Loofah version 2.19.1 or...
Design/Logic Flaw
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, there is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer due to an incomplete fix of CVE-2022-32209. Rails::Html::Sanitizer may allow an attacker to...
CVE-2022-23520 rails-html-sanitizer contains an incomplete fix for an XSS vulnerability
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, there is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer due to an incomplete fix of CVE-2022-32209. Rails::Html::Sanitizer may allow an attacker to...
CVE-2022-23517
CVE-2022-23517 affects rails-html-sanitizer: older configurations (versions
DEBIAN-CVE-2022-23516
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah = 2.2.0, 2.19.1 uses recursion for sanitizing CDATA sections, making it susceptible to stack exhaustion and raising a SystemStackError exception. This may lead to a...
PT-2022-7454
Name of the Vulnerable Software and Affected Versions rails-html-sanitizer versions 1.0.3 through 1.4.3 Description The issue is related to the sanitization of HTML fragments in Rails applications when used in combination with Loofah. It allows a remote attacker to conduct cross-site scripting...
Cross-site scripting vulnerability in TinyMCE alerts
Impact A cross-site scripting XSS vulnerability was discovered in the alert and confirm dialogs when these dialogs were provided with malicious HTML content. This can occur in plugins that use the alert or confirm dialogs, such as in the image plugin, which presents these dialogs when certain...
GHSA-GG8R-XJWQ-4W92 Cross-site scripting vulnerability in TinyMCE alerts
Impact A cross-site scripting XSS vulnerability was discovered in the alert and confirm dialogs when these dialogs were provided with malicious HTML content. This can occur in plugins that use the alert or confirm dialogs, such as in the image plugin, which presents these dialogs when certain...
CVE-2022-23494
tinymce is an open source rich text editor. A cross-site scripting XSS vulnerability was discovered in the alert and confirm dialogs when these dialogs were provided with malicious HTML content. This can occur in plugins that use the alert or confirm dialogs, such as in the image plugin, which...
CVE-2022-23494
Removed by vendor...
CVE-2022-23494 Cross-site scripting vulnerability in TinyMCE alerts
tinymce is an open source rich text editor. A cross-site scripting XSS vulnerability was discovered in the alert and confirm dialogs when these dialogs were provided with malicious HTML content. This can occur in plugins that use the alert or confirm dialogs, such as in the image plugin, which...
CVE-2022-23494 Cross-site scripting vulnerability in TinyMCE alerts
tinymce is an open source rich text editor. A cross-site scripting XSS vulnerability was discovered in the alert and confirm dialogs when these dialogs were provided with malicious HTML content. This can occur in plugins that use the alert or confirm dialogs, such as in the image plugin, which...
Ruby on Rails: ActionView sanitize helper bypass leading to XSS using SVG tag.
An HTML sanitization bypass vulnerability was discovered in the ActionView sanitize helper. This allowed an attacker to bypass sanitization and execute cross-site scripting XSS attacks by using the use tag of the SVG element. By embedding a base64 encoded SVG with malicious code, an attacker coul...
jsoup may not sanitize code injection XSS attempts if SafeList.preserveRelativeLinks is enabled
jsoup may incorrectly sanitize HTML including javascript: URL expressions, which could allow cross-site scripting XSS attacks when a reader subsequently clicks that link. If the non-default SafeList.preserveRelativeLinks option is enabled, HTML including javascript: URLs that have been crafted wi...
Ruby on Rails: ReDoS (Rails::Html::PermitScrubber.scrub_attribute)
I have confirmed that ReDoS occurs on Rails::Html::PermitScrubber.scrubattribute. https://github.com/rails/rails-html-sanitizer/blob/v1.4.3/lib/rails/html/scrubbers.rbL134 ruby def scrubattributenode, attrnode attrname = if attrnode.namespace "attrnode.namespace.prefix:attrnode.nodename" else...
Fedora: Security Advisory for rubygem-rails-html-sanitizer (FEDORA-2022-974fffb418)
The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Fedora: Security Advisory for rubygem-rails-html-sanitizer (FEDORA-2022-ce4719993c)
The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
