Lucene search
Veracode Vulnerability DatabaseVERACODE:4219HistoryMay 09, 2017 - 8:51 a.m.
Cross-site Scripting (XSS)
2017-05-0908:51:31
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
4
0.002 Low
EPSS
Percentile
61.9%
haml is vulnerable to cross-site scripting (XSS) attacks. The library does not escape characters like \< > \" \' properly, meaning that a malicious user can prepend these characters to inject and execute arbitrary code.
| CPE | Name | Operator | Version |
|---|---|---|---|
| haml | le | 4.1.0.beta.1 | |
| haml | le | 4.1.0.beta.1 |
References
github.com/haml/haml/commit/18576ae6e9bdcb4303fdbe6b3199869d289d67c2
github.com/haml/haml/commit/d0086ec86df3b26012a7b38b532b56b7eb60cbfc
github.com/haml/haml/commit/e1dbf817e7bd03f825ad4da943c3b7d80053c63d
github.com/haml/haml/issues/901
github.com/haml/haml/pull/902
lists.debian.org/debian-lts-announce/2019/11/msg00007.html
lists.debian.org/debian-lts-announce/2021/12/msg00028.html
security.gentoo.org/glsa/202007-27
Related
gentoo
gentoo
Haml: Arbitrary code execution
2020-07-27 00:00:00
nvd
nvd
CVE-2017-1002201
2019-10-15 18:15:10
debian
debian
[SECURITY] [DLA 1986-1] ruby-haml security update
2019-11-10 17:24:47
[SECURITY] [DLA 2864-1] ruby-haml security update
2021-12-29 12:59:16
osv
osv
Haml vulnerable to cross-site scripting
2019-10-21 21:59:13
ruby-haml - security update
2021-12-29 00:00:00
CVE-2017-1002201
2019-10-15 18:15:10
cve
cve
CVE-2017-1002201
2019-10-15 18:15:10
openvas
openvas
Debian: Security Advisory (DLA-1986-1)
2019-11-11 00:00:00
Debian: Security Advisory (DLA-2864-1)
2021-12-30 00:00:00
nessus
nessus
Debian DLA-1986-1 : ruby-haml security update
2019-11-12 00:00:00
GLSA-202007-27 : Haml: Arbitrary code execution
2020-07-27 00:00:00
Debian DLA-2864-1 : ruby-haml - LTS security update
2021-12-29 00:00:00
github
github
Haml vulnerable to cross-site scripting
2019-10-21 21:59:13
ubuntucve
ubuntucve
CVE-2017-1002201
2019-10-15 00:00:00
cvelist
cvelist
CVE-2017-1002201
2019-10-15 17:35:57
prion
prion
Code injection
2019-10-15 18:15:00
debiancve
debiancve
CVE-2017-1002201
2019-10-15 18:15:10
rosalinux
rosalinux
Advisory ROSA-SA-2021-1966
2021-07-02 18:06:34