Cross-site Scripting (XSS)

rails-html-sanitizer is vulnerable to cross site scripting. The vulnerability exists in the loofahusinghtml5? and removesafelisttagcombinations functions in sanitizer.rb because it enables an attacker to inject content when the application developer has overridden the sanitizer's allowed tags to...

CVE-2013-1857

CVE-2013-1857 affects Ruby on Rails: the sanitize helper in Action Pack (lib/action_controller/vendor/html-scanner/html/sanitizer.rb) fails to properly handle encoded colon characters in URLs, enabling remote attackers to perform cross-site scripting (XSS) via a crafted scheme name (for example i...