Loofah Project Loofah
7 CVEs affecting Loofah Project Loofah. Latest disclosed: 2022-12-14. Critical: 0, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-23516 | High | 7.5 | 2022-12-14 | Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.2.0, < 2.19.1 uses recurs… |
CVE-2022-23514 | High | 7.5 | 2022-12-14 | Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah < 2.19.1 contains an inefficie… |
CVE-2022-23518 | Medium | 6.1 | 2022-12-14 | rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Versions >= 1.0.3, < 1.4.4 are vulnerable to cross-site scripting via… |
CVE-2022-23515 | Medium | 6.1 | 2022-12-14 | Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.1.0, < 2.19.1 is vulnerab… |
CVE-2018-8048 | Medium | 6.1 | 2018-03-27 | In the Loofah gem through 2.2.0 for Ruby, non-whitelisted HTML attributes may occur in sanitized output by republishing a crafted HTML fragment. |
CVE-2019-15587 | Medium | 5.4 | 2019-10-22 | In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished. |
CVE-2018-16468 | Medium | 5.4 | 2018-10-30 | In the Loofah gem for Ruby, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished. |