CVE-2021-26539

Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name IDN which could allow an attacker to bypass hostname whitelist validation set by the "allowedIframeHostnames" option...

CVE-2021-26539

Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name IDN which could allow an attacker to bypass hostname whitelist validation set by the "allowedIframeHostnames" option...

CVE-2021-26539

Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name IDN which could allow an attacker to bypass hostname whitelist validation set by the "allowedIframeHostnames" option...

CVE-2021-26539

CVE-2021-26539 affects Apostrophe Technologies sanitize-html prior to version 2.3.1. The vulnerability arises from improper handling of internationalized domain names (IDN), which can allow an attacker to bypass the hostname whitelist validated by the allowedIframeHostnames option. Impact is bypa...

PT-2021-17026

Name of the Vulnerable Software and Affected Versions sanitize-html versions prior to 2.3.1 Description The issue arises from improper handling of internationalized domain names IDN, which could allow an attacker to bypass hostname whitelist validation set by the allowedIframeHostnames option. Th...

Abea Apostrophe Technologies sanitize-html input validation error vulnerability

Abea Apostrophe Technologies sanitize-html is a formatting removal tool organized by Abea USA. It provides simple HTML tag removal with a clear API. An input validation error vulnerability exists in Apostrophe Technologies sanitize-html that stems from failure to properly validate hostnames set b...

Abea Apostrophe Technologies sanitize-html security vulnerability

Abea Apostrophe Technologies sanitize-html is a formatting removal tool organized by Abea USA. It provides simple HTML tag removal with a clear API. A security vulnerability exists in Apostrophe Technologies sanitize-html versions prior to 2.3.1, which stems from the inability to properly handle...

CVE-2021-26539: Undefined Security Weakness

Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name IDN which could allow an attacker to bypass hostname whitelist validation set by the "allowedIframeHostnames" option...

PT-2021-17027

Name of the Vulnerable Software and Affected Versions sanitize-html versions prior to 2.3.2 Description The issue arises from improper validation of hostnames set by the allowedIframeHostnames option when allowIframeRelativeUrls is set to true. This allows attackers to bypass the hostname whiteli...

CVE-2021-26540: Undefined Security Weakness

Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts...

apostrophe-tumblr (>=0.5.1, <=0.5.13), http-teapot-comment (0.1.0) +1 more potentially affected by CVE-2016-1000237 via sanitize-html (>=1.1.4, <=1.4.2)

sanitize-html NPM version =1.1.4, =0.5.1, =0.5.13 - http-teapot-comment 0.1.0 - piedpiper-middle-out 5.8.1 Source cves: CVE-2016-1000237 Source advisory: GHSA-3J7M-HMH3-9JMP...

Cross-Site Scripting in sanitize-html

Affected versions of sanitize-html do not sanitize input recursively, which may allow an attacker to execute arbitrary Javascript. Recommendation Update to version 1.4.3 or later...

apostrophe-tumblr (>=0.5.1, <=0.5.13), http-teapot-comment (0.1.0) +1 more potentially affected by CVE-2016-1000237 via sanitize-html (>=1.1.4, <=1.4.2)

sanitize-html NPM version =1.1.4, =0.5.1, =0.5.13 - http-teapot-comment 0.1.0 - piedpiper-middle-out 5.8.1 Source cves: CVE-2016-1000237 Source advisory: OSV:GHSA-3J7M-HMH3-9JMP...

GHSA-3J7M-HMH3-9JMP Cross-Site Scripting in sanitize-html

Affected versions of sanitize-html do not sanitize input recursively, which may allow an attacker to execute arbitrary Javascript. Recommendation Update to version 1.4.3 or later...

CVE-2016-1000237

sanitize-html before 1.4.3 has XSS...

CVE-2016-1000237

sanitize-html before 1.4.3 has XSS...

Cross site scripting

sanitize-html before 1.4.3 has XSS...

apostrophe (>=0.4.113, <=0.4.144), apostrophe-tumblr (>=0.5.1, <=0.5.13) +3 more potentially affected by CVE-2016-1000237 via sanitize-html (>=0.1.4, <=1.4.2)

sanitize-html NPM version =0.1.4, =0.4.113, =0.5.1, =0.0.1, =0.2.3 - piedpiper-middle-out 5.8.1 Source cves: CVE-2016-1000237 Source advisory: MEND:CVE-2016-1000237...

CVE-2016-1000237

sanitize-html before 1.4.3 has XSS...

CVE-2016-1000237

CVE-2016-1000237 affects sanitize-html prior to 1.4.3, where input is not sanitized recursively which may allow XSS. Documented in multiple sources (Node.js advisory GHSA-3J7M-HMH3-9JMP, Red Hat, Debian, NVD/NVD list). Impact is cross-site scripting via vulnerable sanitize-html versions; exploita...