CVE-2018-8048

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

In the Loofah gem through 2.2.0 for Ruby, non-whitelisted HTML attributes may occur in sanitized output by republishing a crafted HTML fragment.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2018/03/19/5Mailing List, Third Party Advisory
https://github.com/flavorjones/loofah/issues/144Third Party Advisory
https://security.netapp.com/advisory/ntap-20191122-0003/
https://www.debian.org/security/2018/dsa-4171Third Party Advisory
http://www.openwall.com/lists/oss-security/2018/03/19/5Mailing List, Third Party Advisory
https://github.com/flavorjones/loofah/issues/144Third Party Advisory
https://security.netapp.com/advisory/ntap-20191122-0003/
https://www.debian.org/security/2018/dsa-4171Third Party Advisory

Timeline

Published: Mar 27, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-80497.5The Stealth endpoint in Unisys Stealth SVG 2.8.x, 3.0.x before 3.0.1999, 3.1.x, 3.2.x before 3.2.030, and 3.3.x before 3.3.016, when running CVE-2018-80506.5The af_get_page() function in lib/afflib_pages.cpp in AFFLIB (aka AFFLIBv3) through 3.7.16 allows remote attackers to cause a denial of serv CVE-2018-80567.5Physical path Leakage exists in Western Bridge Cobub Razor 0.8.0 via an invalid channel_name parameter to /index.php?/manage/channel/addchan CVE-2018-80579.8A SQL Injection vulnerability exists in Western Bridge Cobub Razor 0.8.0 via the channel_name or platform parameter in a /index.php?/manage/CVE-2018-80584.8CMS Made Simple (CMSMS) 2.2.6 has XSS in admin/moduleinterface.php via the pagedata parameter.CVE-2018-80598.8The Djelibeybi configuration examples for use of NGINX in SUSE Portus 2.3, when applied to certain configurations involving Docker Compose, CVE-2018-80605.5HWiNFO AMD64 Kernel driver version 8.98 and lower allows an unprivileged user to send an IOCTL to the device driver. If input and/or output CVE-2018-80617.1HWiNFO AMD64 Kernel driver version 8.98 and lower allows an unprivileged user to send IOCTL 0x85FE2608 to the device driver with the HWiNFO3 CVE-2018-80625.4A cross-site scripting (XSS) vulnerability on Comtrend AR-5387un devices with A731-410JAZ-C04_R02.A2pD035g.d23i firmware allows remote attac CVE-2018-80657.5An issue was discovered in the web server in Flexense SyncBreeze Enterprise 10.6.24. There is a user mode write access violation on the sync CVE-2018-80695.4QCMS version 3.0 has XSS via the webname parameter to the /backend/system.html URI.CVE-2018-80705.4QCMS version 3.0 has XSS via the title parameter to the /guest/index.html URI.