Most recent entries from all

EUVD-2026-258331

fkie_cve-2022-23515

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.1.0, < 2.19.1 is vulnerable to cross-site scripting via the image/svg+xml media type in data URIs. This issue is patched in version 2.19.1.

GHSA-228g-948r-83gx — Improper neutralization of data URIs may allow XSS in Loofah

Affected: RubyGems: loofah

## Summary

Loofah `>= 2.1.0, < 2.19.1` is vulnerable to cross-site scripting via the `image/svg+xml` media type in data URIs.

## Mitigation

Upgrade to Loofah `>= 2.19.1`.

## Severity

The Loofah maintainers have evaluated this as [Medium Severity 6.1](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

## References

- [CWE - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (4.9)](https://cwe.mitre.org/data/definitions/79.html) - [SVG MIME Type (image/svg+xml) is misleading to developers · Issue #266 · w3c/svgwg](https://github.com/w3c/svgwg/issues/266) - https://hackerone.com/reports/1694173 - https://github.com/flavorjones/loofah/issues/101

## Credit

This vulnerability was responsibly reported by Maciej Piechota (@haqpl).

gsd-2022-23515

openSUSE-SU-2024:12768-1 — ruby3.1-rubygem-loofah-2.19.1-1.1 on GA media

ruby3.1-rubygem-loofah-2.19.1-1.1 on GA media

RHSA-2023:2097 — Red Hat Security Advisory: Satellite 6.13 Release

jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode SnakeYaml: Constructor Deserialization Remote Code Execution rubygem-actionpack: Possible cross-site scripting vulnerability in Action Pack rubygem-loofah: inefficient regular expression leading to denial of service rubygem-loofah: Improper neutralization of data URIs leading to Cross Site Scripting rubygem-loofah: Uncontrolled Recursion leading to denial of service rubygem-rails-html-sanitizer: Inefficient Regular Expression leading to denial of service rubygem-rails-html-sanitizer: Improper neutralization of data URIs leading to Cross site scripting rubygem-rails-html-sanitizer: Cross site scripting vulnerability with certain configurations rubygem-rails-html-sanitizer: Cross site scripting vulnerability with certain configurations snakeyaml: Denial of Service due to missing nested depth limitation for collections tfm-rubygem-actionview: Possible cross-site scripting vulnerability in Action View tag helpers rubygem-tzinfo: arbitrary code execution activerecord: Possible RCE escalation bug with Serialized Columns in Active Record apache-commons-configuration: Apache Commons Configuration insecure interpolation defaults snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match snakeyaml: Uncaug…

SUSE-SU-2023:1657-1 — Security update for rubygem-loofah

Security update for rubygem-loofah

UBUNTU-CVE-2022-23515

Affected: Ubuntu:16.04:LTS: ruby-loofah, Ubuntu:18.04:LTS: ruby-loofah, Ubuntu:20.04:LTS: ruby-loofah, Ubuntu:22.04:LTS: ruby-loofah

WID-SEC-W-2023-0266 — genua genucenter: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Ein Angreifer kann mehrere Schwachstellen in genua genucenter ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.