CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 1CVE-2022-23518 – Improper neutralization of data URIs allows XSS in rails-html-sanitizer
https://notcve.org/view.php?id=CVE-2022-23518
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Versions >= 1.0.3, < 1.4.4 are vulnerable to cross-site scripting via data URIs when used in combination with Loofah >= 2.1.0. This issue is patched in version 1.4.4. rails-html-sanitizer es responsable de sanitizar fragmentos HTML en aplicaciones Rails. Las versiones >= 1.0.3, < 1.4.4 son vulnerables a Cross-Site Scripting (XSS) a través de URI de datos cuando se usan en combinación con Loofah >= 2.1.0. Este problema está parcheado en la versión 1.4.4. • https://github.com/rails/rails-html-sanitizer/issues/135 https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-mcvf-2q2m-x72m https://hackerone.com/reports/1694173 https://lists.debian.org/debian-lts-announce/2023/09/msg00012.html https://access.redhat.com/security/cve/CVE-2022-23518 https://bugzilla.redhat.com/show_bug.cgi?id=2153701 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-23516 – Uncontrolled Recursion in Loofah
https://notcve.org/view.php?id=CVE-2022-23516
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.2.0, < 2.19.1 uses recursion for sanitizing CDATA sections, making it susceptible to stack exhaustion and raising a SystemStackError exception. This may lead to a denial of service through CPU resource consumption. This issue is patched in version 2.19.1. Users who are unable to upgrade may be able to mitigate this vulnerability by limiting the length of the strings that are sanitized. • https://github.com/flavorjones/loofah/security/advisories/GHSA-3x8r-x6xp-q4vm https://lists.debian.org/debian-lts-announce/2023/09/msg00011.html https://access.redhat.com/security/cve/CVE-2022-23516 https://bugzilla.redhat.com/show_bug.cgi?id=2153241 • CWE-674: Uncontrolled Recursion •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2022-23515 – Improper neutralization of data URIs may allow XSS in Loofah
https://notcve.org/view.php?id=CVE-2022-23515
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.1.0, < 2.19.1 is vulnerable to cross-site scripting via the image/svg+xml media type in data URIs. This issue is patched in version 2.19.1. Loofah es una librería general para manipular y transformar documentos y fragmentos HTML / XML, construida sobre Nokogiri. Loofah >= 2.1.0, < 2.19.1 es vulnerable a Cross-Site Scripting (XSS) a través del tipo de medio image/svg+xml en las URI de datos. • https://github.com/flavorjones/loofah/issues/101 https://github.com/flavorjones/loofah/security/advisories/GHSA-228g-948r-83gx https://hackerone.com/reports/1694173 https://lists.debian.org/debian-lts-announce/2023/09/msg00011.html https://access.redhat.com/security/cve/CVE-2022-23515 https://bugzilla.redhat.com/show_bug.cgi?id=2153262 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-23514 – Inefficient Regular Expression Complexity in Loofah
https://notcve.org/view.php?id=CVE-2022-23514
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah < 2.19.1 contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a denial of service through CPU resource consumption. This issue is patched in version 2.19.1. Loofah es una librería general para manipular y transformar documentos y fragmentos HTML / XML, construida sobre Nokogiri. • https://github.com/flavorjones/loofah/security/advisories/GHSA-486f-hjj9-9vhh https://hackerone.com/reports/1684163 https://lists.debian.org/debian-lts-announce/2023/09/msg00011.html https://access.redhat.com/security/cve/CVE-2022-23514 https://bugzilla.redhat.com/show_bug.cgi?id=2153234 • CWE-1333: Inefficient Regular Expression Complexity •
CVSS: 5.4EPSS: 0%CPEs: 6EXPL: 0CVE-2019-15587
https://notcve.org/view.php?id=CVE-2019-15587
In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished. En la gema Loofah para Ruby versiones hasta v2.3.0, un JavaScript no saneado puede aparecer en la salida saneada cuando se vuelve a publicar un elemento SVG diseñado. • https://github.com/flavorjones/loofah/issues/171 https://hackerone.com/reports/709009 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4WK2UG7ORKRQOJ6E4XJ2NVIHYJES6BYZ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XMCWPLYPNIWYAY443IZZJ4IHBBLIHBP5 https://security.netapp.com/advisory/ntap-20191122-0003 https://usn.ubuntu.com/4498-1 https://www.debian.org/security/2019/dsa-4554 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •