Most recent entries from all

BREW-mikutter-CVE-2018-8048 — Cross-site Scripting in loofah

Affected: Homebrew: mikutter

Loofah allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments.

Users are affected if running Loofah < 2.2.1, but only:

* when running on MRI or RBX, * in combination with libxml2 >= 2.9.2.

JRuby users are not affected.

cnvd-2018-07649

EUVD-2026-63549

fkie_cve-2018-8048

In the Loofah gem through 2.2.0 for Ruby, non-whitelisted HTML attributes may occur in sanitized output by republishing a crafted HTML fragment.

GHSA-x7rv-cr6v-4vm4 — Cross-site Scripting in loofah

Affected: RubyGems: loofah, RubyGems: nokogiri

Loofah allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments.

Users are affected if running Loofah < 2.2.1, but only:

* when running on MRI or RBX, * in combination with libxml2 >= 2.9.2.

JRuby users are not affected.

gsd-2018-8048

openSUSE-SU-2024:11337-1 — ruby2.7-rubygem-loofah-2.12.0-1.2 on GA media

ruby2.7-rubygem-loofah-2.12.0-1.2 on GA media

RHSA-2019:0212 — Red Hat Security Advisory: CloudForms 4.7 security, bug fix and enhancement update

rubygem-nokogiri: XML eXternal Entity (XXE) flaw rubygem-rails-html-sanitizer: non-whitelisted attributes are present in sanitized output when input with specially-crafted HTML fragments leading to XSS vulnerability rubygem-loofah: XSS vulnerability due to unescaped comments within attributes by libxml2 rubygem-sinatra: XSS in the 400 Bad Request page

SUSE-SU-2019:0394-1 — Security update for rubygem-loofah

Security update for rubygem-loofah