Loofah Project

Loofah

7 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.1

CVE-2022-23518

Exploit
  • EPSS 0.23%
  • Published 14.12.2022 17:15:10
  • Last modified 21.11.2024 06:48:43

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Versions >= 1.0.3, < 1.4.4 are vulnerable to cross-site scripting via data URIs when used in combination with Loofah >= 2.1.0. This issue is patched in version 1...

7.5

CVE-2022-23514

  • EPSS 0.27%
  • Published 14.12.2022 14:15:10
  • Last modified 21.11.2024 06:48:43

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah < 2.19.1 contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to sani...

6.1

CVE-2022-23515

  • EPSS 0.24%
  • Published 14.12.2022 14:15:10
  • Last modified 21.11.2024 06:48:43

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.1.0, < 2.19.1 is vulnerable to cross-site scripting via the image/svg+xml media type in data URIs. This issue is pat...

7.5

CVE-2022-23516

  • EPSS 0.03%
  • Published 14.12.2022 14:15:10
  • Last modified 21.11.2024 06:48:43

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.2.0, < 2.19.1 uses recursion for sanitizing CDATA sections, making it susceptible to stack exhaustion and raising a ...

5.4

CVE-2019-15587

  • EPSS 2.21%
  • Published 22.10.2019 21:15:10
  • Last modified 21.11.2024 04:29:04

In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.

5.4

CVE-2018-16468

  • EPSS 0.31%
  • Published 30.10.2018 21:29:00
  • Last modified 21.11.2024 03:52:48

In the Loofah gem for Ruby, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.

6.1

CVE-2018-8048

  • EPSS 0.4%
  • Published 27.03.2018 17:29:00
  • Last modified 21.11.2024 04:13:11

In the Loofah gem through 2.2.0 for Ruby, non-whitelisted HTML attributes may occur in sanitized output by republishing a crafted HTML fragment.