Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
GHSA-5qhf-9phg-95m2
  • RubyGems/loofah
 Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons 21 Jul
  • Fix available
  • Severity - 2.3 (Low)
GHSA-9wjq-cp2p-hrgf
  • RubyGems/loofah
 Loofah: SVG `href` attribute bypasses local-reference restriction 21 Jul
  • Fix available
  • Severity - 4.7 (Medium)
GHSA-8whx-365g-h9vv
  • RubyGems/loofah
 Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references 21 Jul
  • Fix available
  • Severity - 2.3 (Low)
GHSA-2j22-pr5w-6gq8
  • RubyGems/loofah
 Loofah has improper detection of disallowed URIs via `allowed_uri?` 26 Mar
  • Fix available
  • Severity - 2.3 (Low)
GHSA-46fp-8f5p-pf2m
  • RubyGems/loofah
 Improper detection of disallowed URIs by Loofah `allowed_uri?` 18 Mar
  • Fix available
  • Severity - 2.7 (Low)
GHSA-3x8r-x6xp-q4vm
  • RubyGems/loofah
 Uncontrolled Recursion in Loofah 13 Dec 2022
  • Fix available
  • Severity - 7.5 (High)
GHSA-228g-948r-83gx
  • RubyGems/loofah
 Improper neutralization of data URIs may allow XSS in Loofah 13 Dec 2022
  • Fix available
  • Severity - 6.1 (Medium)
GHSA-486f-hjj9-9vhh
  • RubyGems/loofah
 Inefficient Regular Expression Complexity in Loofah 13 Dec 2022
  • Fix available
  • Severity - 7.5 (High)
GHSA-c3gv-9cxf-6f57
  • RubyGems/loofah
 Loofah Allows Cross-site Scripting 05 Nov 2019
  • Fix available
  • Severity - 5.4 (Medium)
GHSA-g4xq-jx4w-4cjv
  • RubyGems/loofah
 Loofah Cross-site Scripting vulnerability 01 Nov 2018
  • Fix available
  • Severity - 5.4 (Medium)
GHSA-x7rv-cr6v-4vm4
  • RubyGems/loofah
  • RubyGems/nokogiri
 Cross-site Scripting in loofah 21 Mar 2018
  • Fix available
  • Severity - 6.1 (Medium)