Lucene search
Veracode Vulnerability DatabaseVERACODE:36266HistoryJul 06, 2022 - 6:09 a.m.
Cross-site Scripting (XSS)
2022-07-0606:09:21
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
66
cross-site scripting
rails
html sanitizer
javascript
style override
EPSS
0.001
Percentile
47.4%
rails-html-sanitizer is vulnerable to cross-site scripting attacks. An attacker is able to inject and execute malicious javascript through the sanitize_css function when the library is configured to override the style tags to allow both select and style elements.
References
github.com/advisories/GHSA-pg8v-g4xq-hww9
github.com/rails/rails-html-sanitizer/commit/9b79253eb888a74e425c7da073c46014b8290d58
github.com/rails/rails-html-sanitizer/pull/137
hackerone.com/reports/1530898
lists.debian.org/debian-lts-announce/2022/12/msg00012.html
lists.fedoraproject.org/archives/list/[email protected]/message/AGRLWBEB3S5AU3D4TTROIS7O6QPHDTRH/
lists.fedoraproject.org/archives/list/[email protected]/message/NHDACMCLWE32BZZTSNWQPIFUAD5I6Q47/
Related
openvas
openvas
cve
cve
CVE-2022-32209
2022-06-24 15:15:11
CVE-2022-23520
2022-12-14 18:15:17
github
github
Rails::Html::Sanitizer vulnerable to Cross-site Scripting
2022-06-25 00:00:54
nvd
nvd
CVE-2022-32209
2022-06-24 15:15:11
CVE-2022-23520
2022-12-14 18:15:17
osv
osv
CVE-2022-32209
2022-06-24 15:15:11
ruby-rails-html-sanitizer - security update
2022-12-07 00:00:00
Rails::Html::Sanitizer vulnerable to Cross-site Scripting
2022-06-25 00:00:54
prion
prion
Design/Logic Flaw
2022-06-24 15:15:00
Design/Logic Flaw
2022-12-14 18:15:00
ubuntucve
ubuntucve
CVE-2022-32209
2022-06-24 00:00:00
CVE-2022-23520
2022-12-14 00:00:00
fedora
fedora
[SECURITY] Fedora 35 Update: rubygem-rails-html-sanitizer-1.4.3-1.fc35
2022-08-14 03:02:09
[SECURITY] Fedora 36 Update: rubygem-rails-html-sanitizer-1.4.3-1.fc36
2022-08-14 02:38:21
nessus
nessus
Debian DLA-3227-1 : ruby-rails-html-sanitizer - LTS security update
2022-12-07 00:00:00
Fedora 40 : rubygem-rails-html-sanitizer (2023-91e69ea326)
2024-04-29 00:00:00
cnvd
cnvd
Rails Cross-Site Scripting Vulnerability (CNVD-2022-58235)
2022-06-28 00:00:00
hackerone
hackerone
debian
debian
[SECURITY] [DLA 3227-1] ruby-rails-html-sanitizer security update
2022-12-06 19:02:47
[SECURITY] [DLA 3566-1] ruby-rails-html-sanitizer security update
2023-09-13 15:09:12
redhatcve
redhatcve
CVE-2022-32209
2022-06-28 16:06:33
suse
suse
Security update for rubygem-rails-html-sanitizer (moderate)
2022-08-23 00:00:00
cvelist
cvelist
CVE-2022-32209
2022-06-24 00:00:00
rubygems
rubygems
debiancve
debiancve
CVE-2022-32209
2022-06-24 15:15:11
CVE-2022-23520
2022-12-14 18:15:17
rocky
rocky
Satellite 6.12 Release
2022-11-16 13:21:30
redhat
redhat
(RHSA-2022:8506) Important: Satellite 6.12 Release
2022-11-16 13:21:30