RSS   Podatności dla 'Sanitize-html'   RSS

2021-02-08
 
CVE-2021-26540

NVD-CWE-noinfo
 

 
Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts with "/\\example.com".

 
 
CVE-2021-26539

NVD-CWE-noinfo
 

 
Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by the "allowedIframeHostnames" option.

 
2020-01-23
 
CVE-2016-1000237

CWE-79
 

 
sanitize-html before 1.4.3 has XSS.

 

 >>> Vendor: Apostrophecms 2 Produkty
Sanitize-html
Apostrophecms


Copyright 2024, cxsecurity.com

 

Back to Top