PatchTheCVEsafehtml vulnerabilities and fixes
Recent CVEs affecting safehtml, with upgrade or downgrade steps. 4 tracked.
safehtml has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 1. Most recent: 2005-08-17. Highest priority: CVE-2005-0649 (score 33/100).
- CVE-2005-2608 MEDIUM 4.3 DOWNGRADE SafeHTML before 1.3.5 does not properly filter script in UTF-7 and CSS comments, which allows remote attackers
- CVE-2005-1638 MEDIUM 4.3 DOWNGRADE The _writeAttrs function in SafeHTML before 1.3.2 does not properly handle quotes in attribute values, which c
- CVE-2005-0649 MEDIUM 4.3 UPGRADE Pixel-Apes SafeHTML before 1.2.1 allows remote attackers to bypass cross-site scripting (XSS) protection via "
- CVE-2005-0648 MEDIUM 4.3 DOWNGRADE Multiple vulnerabilities in Pixel-Apes SafeHTML before 1.3.0 allow remote attackers to bypass cross-site scrip
FAQ
How do I fix safehtml vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is safehtml being exploited right now?
None of the tracked safehtml CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which safehtml CVE should I patch first?
CVE-2005-0649 currently ranks highest (33/100): Pixel-Apes SafeHTML before 1.2.1 allows remote attackers to bypass cross-site scripting (XSS) protection via ".