sanitize project sanitize vulnerabilities and exploits

(subscribe to this query)

NA

Sanitize is an allowlist-based HTML and CSS sanitizer. Versions 5.0.0 and later, before 6.0.1, are vulnerable to Cross-site Scripting. When Sanitize is configured with a custom allowlist that allows `noscript` elements, attackers are able to include arbitrary HTML, resulting in X...

Sanitize Project Sanitize

6.8

CVSSv2

In Sanitize (RubyGem sanitize) greater than or equal to 3.0.0 and less than 5.2.1, there is a cross-site scripting vulnerability. When HTML is sanitized using Sanitize's "relaxed" config, or a custom config that allows certain elements, some content in a math or sv...

Sanitize Project Sanitize

5

CVSSv2

A specially crafted HTML fragment can cause Sanitize gem for Ruby to allow non-whitelisted attributes to be used on a whitelisted HTML element.

Sanitize Project Sanitize

NA

The `sanitize-svg` package, a small SVG sanitizer to prevent cross-site scripting attacks, uses a deny-list-pattern to sanitize SVGs to prevent XSS. In doing so, literal `<script>`-tags and on-event handlers were detected in versions before 0.4.0. As a result, downstream so...

Sanitize-svg Project Sanitize-svg

NA

Sanitize is an allowlist-based HTML and CSS sanitizer. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML and CSS through Sanitize starting with version 3.0.0 and prior to version 6.0.2 when Sanitize is configured to use the built-in "relaxed"...

Sanitize Project Sanitize Debian Debian Linux 10.0

7.5

CVSSv2

Growl adds growl notification support to nodejs. Growl prior to 1.10.2 does not properly sanitize input before passing it to exec, allowing for arbitrary command execution.

Growl Project Growl

1 Github repository

NA

Versions of the package sanitize-html prior to 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability t...

5

CVSSv2

Audit prior to 2.4.4 in Linux does not sanitize escape characters in filenames.

Linux Audit Project Linux Audit

NA

The Borg theme prior to 1.1.19 for Backdrop CMS does not sufficiently sanitize path arguments that are passed in via a URL. The function borg_preprocess_page in the file template.php does not properly sanitize incoming path arguments before using them.

Borg Project Borg

4.3

CVSSv2

The iframe plugin prior to 4.5 for WordPress does not sanitize a URL.

Iframe Project Iframe

3 Github repositories

Get Started

1 2 3 4 5 6 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook