Поиск уязвимостей
Количество 10
Количество 10
BDU:2024-06512
Уязвимость реализации конфигурации инструмента очистки HTML для приложений Rails Rails Html Sanitizer, связанная с неправильной нейтрализацией входных данных во время генерации веб-страницы, позволяющая нарушителю проводить межсайтовые сценарные атаки
ROS-20240815-13
Множественные уязвимости rubygem-rails-html-sanitizer
ALT-PU-2023-1337
ALT-PU-2023-1337: package `gem-rails-html-sanitizer` update to version 1.5.0-alt1
CVE-2022-23519
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags in either of the following ways: allow both "math" and "style" elements, or allow both "svg" and "style" elements. Code is only impacted if allowed tags are being overridden. . This issue is fixed in version 1.4.4. All users overriding the allowed tags to include "math" or "svg" and "style" should either upgrade or use the following workaround immediately: Remove "style" from the overridden allowed tags, or remove "math" and "svg" from the overridden allowed tags.
CVE-2022-23519
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags in either of the following ways: allow both "math" and "style" elements, or allow both "svg" and "style" elements. Code is only impacted if allowed tags are being overridden. . This issue is fixed in version 1.4.4. All users overriding the allowed tags to include "math" or "svg" and "style" should either upgrade or use the following workaround immediately: Remove "style" from the overridden allowed tags, or remove "math" and "svg" from the overridden allowed tags.
CVE-2022-23519
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags in either of the following ways: allow both "math" and "style" elements, or allow both "svg" and "style" elements. Code is only impacted if allowed tags are being overridden. . This issue is fixed in version 1.4.4. All users overriding the allowed tags to include "math" or "svg" and "style" should either upgrade or use the following workaround immediately: Remove "style" from the overridden allowed tags, or remove "math" and "svg" from the overridden allowed tags.
CVE-2022-23519
rails-html-sanitizer is responsible for sanitizing HTML fragments in R ...
GHSA-9h9g-93gc-623h
Possible XSS vulnerability with certain configurations of rails-html-sanitizer
SUSE-SU-2023:3714-1
Security update for rubygem-rails-html-sanitizer
ALT-PU-2023-4269
ALT-PU-2023-4269: package `gem-rails-html-sanitizer` update to version 1.5.0-alt1
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | BDU:2024-06512 Уязвимость реализации конфигурации инструмента очистки HTML для приложений Rails Rails Html Sanitizer, связанная с неправильной нейтрализацией входных данных во время генерации веб-страницы, позволяющая нарушителю проводить межсайтовые сценарные атаки | CVSS3: 6.1 | 1% Низкий | почти 4 года назад |
 | ROS-20240815-13 Множественные уязвимости rubygem-rails-html-sanitizer | CVSS3: 7.5 | около 2 лет назад | |
| ALT-PU-2023-1337 ALT-PU-2023-1337: package `gem-rails-html-sanitizer` update to version 1.5.0-alt1 | CVSS3: 7.5 | больше 3 лет назад | |
 | CVE-2022-23519 rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags in either of the following ways: allow both "math" and "style" elements, or allow both "svg" and "style" elements. Code is only impacted if allowed tags are being overridden. . This issue is fixed in version 1.4.4. All users overriding the allowed tags to include "math" or "svg" and "style" should either upgrade or use the following workaround immediately: Remove "style" from the overridden allowed tags, or remove "math" and "svg" from the overridden allowed tags. | CVSS3: 6.1 | 1% Низкий | почти 4 года назад |
 | CVE-2022-23519 rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags in either of the following ways: allow both "math" and "style" elements, or allow both "svg" and "style" elements. Code is only impacted if allowed tags are being overridden. . This issue is fixed in version 1.4.4. All users overriding the allowed tags to include "math" or "svg" and "style" should either upgrade or use the following workaround immediately: Remove "style" from the overridden allowed tags, or remove "math" and "svg" from the overridden allowed tags. | CVSS3: 7.2 | 1% Низкий | почти 4 года назад |
 | CVE-2022-23519 rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags in either of the following ways: allow both "math" and "style" elements, or allow both "svg" and "style" elements. Code is only impacted if allowed tags are being overridden. . This issue is fixed in version 1.4.4. All users overriding the allowed tags to include "math" or "svg" and "style" should either upgrade or use the following workaround immediately: Remove "style" from the overridden allowed tags, or remove "math" and "svg" from the overridden allowed tags. | CVSS3: 6.1 | 1% Низкий | почти 4 года назад |
| CVE-2022-23519 rails-html-sanitizer is responsible for sanitizing HTML fragments in R ... | CVSS3: 6.1 | 1% Низкий | почти 4 года назад |
| GHSA-9h9g-93gc-623h Possible XSS vulnerability with certain configurations of rails-html-sanitizer | CVSS3: 6.1 | 1% Низкий | почти 4 года назад |
 | SUSE-SU-2023:3714-1 Security update for rubygem-rails-html-sanitizer | около 3 лет назад | ||
| ALT-PU-2023-4269 ALT-PU-2023-4269: package `gem-rails-html-sanitizer` update to version 1.5.0-alt1 | CVSS3: 7.5 | около 3 лет назад |
Уязвимостей на страницу