3159 matches found
CVE-2022-23520
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, there is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer due to an incomplete fix of CVE-2022-32209. Rails::Html::Sanitizer may allow an attacker to...
Cross-site Scripting (XSS)
rails-html-sanitizer is vulnerable to cross site scripting. The vulnerability exists in the loofahusinghtml5? and removesafelisttagcombinations functions in sanitizer.rb because it enables an attacker to inject content when the application developer has overridden the sanitizer's allowed tags to...
CVE-2022-23520: Improper Neutralization of Input During Web Page Generation
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, there is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer due to an incomplete fix of CVE-2022-32209. Rails::Html::Sanitizer may allow an attacker to...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper user-input sanitization which may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags to allow both select and style elements. This is due...
Possible XSS vulnerability with certain configurations of rails-html-sanitizer
Summary There is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer. This is due to an incomplete fix of CVE-2022-32209. - Versions affected: ALL - Not affected: NONE - Fixed versions: 1.4.4 Impact A possible XSS vulnerability with certain configurations of...
CVE-2022-0698
Microweber version 1.3.1 allows an unauthenticated user to perform an account takeover via an XSS on the 'select-file' parameter...
CVE-2022-0698
Microweber version 1.3.1 allows an unauthenticated user to perform an account takeover via an XSS on the 'select-file' parameter...
CVE-2022-0698: Improper Neutralization of Input During Web Page Generation
Microweber version 1.3.1 allows an unauthenticated user to perform an account takeover via an XSS on the 'select-file' parameter...
Microweber 跨站脚本漏洞
Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A security vulnerability exists in Microweber version 1.3.1, which allows an...
CVE-2022-0698
Microweber version 1.3.1 allows an unauthenticated user to perform an account takeover via an XSS on the 'select-file' parameter...
PT-2022-13369 · Unknown · Microweber
Name of the Vulnerable Software and Affected Versions: Microweber version 1.3.1 Description: The issue allows an unauthenticated user to perform an account takeover via a Cross-Site Scripting XSS attack on the select-file parameter. There is a patch available in the development branch, but it has...
PT-2022-36771
Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a stack-buffer-overflow read crash. The crash involves several functions, including sc path print, sc select file, and sc pkcs15ini...
owasp-java-html-sanitizer: improper policies enforcement may lead to remote code execution
The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements...
owasp-java-html-sanitizer: improper policies enforcement may lead to remote code execution
The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements...
owasp-java-html-sanitizer: improper policies enforcement may lead to remote code execution
The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements...
owasp-java-html-sanitizer: improper policies enforcement may lead to remote code execution
The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements...
Updated php packages fix security vulnerability
GD - Fixed bug 81739: OOB read due to insufficient input validation in imageloadfont. Hash - Fixed bug 81738: buffer overflow in hashupdate on long parameter. Session - Fixed bug GH-9583 sessioncreateid fails with user defined save handler that doesn't have a validateId method. Streams - Fixed bu...
The vulnerability of the Rails Html Sanitizer configuration tool for Rails applications allows attackers to perform cross-site scripting attacks.
The vulnerability of the Rails Html Sanitizer configuration tool for applications relates to the improper use of the select and style elements when defining allowed tags. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...
