jbuilder-2.11.5.gem: 18 vulnerabilities (highest severity is: 9.8)

<details><summary><img src='https://whitesource-resources.whitesourcesoftware.com/vulnerability_details.png' width=19 height=20> Vulnerable Library - jbuilder-2.11.5.gem</summary>


Path to dependency file: /Gemfile.lock
Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rails-html-sanitizer-1.4.3.gem



Found in HEAD commit: <a href="https://github.com/Nexmo/ruby-2fa/commit/ab21a9f862ff3da3db0787ca394d129f490c3cfe">ab21a9f862ff3da3db0787ca394d129f490c3cfe</a></details>

## Vulnerabilities

| CVE | Severity | <img src='https://whitesource-resources.whitesourcesoftware.com/cvss3.png' width=19 height=20> CVSS | Exploit Maturity | EPSS | Dependency | Type | Fixed in (jbuilder version) | Remediation Possible** | Reachability |
| ------------- | ------------- | ----- | ----- | ----- | ----- | ----- | ------------- | --- | --- |
| [CVE-2020-8165](https://www.mend.io/vulnerability-database/CVE-2020-8165) | <img src='https://whitesource-resources.whitesourcesoftware.com/critical_vul.png?' width=19 height=20> Critical | 9.8 | Not Defined | 35.8% | activesupport-5.0.7.2.gem | Transitive | N/A* | &#10060;| |
| [CVE-2023-22796](https://www.mend.io/vulnerability-database/CVE-2023-22796) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.5 | Not Defined | 0.2% | activesupport-5.0.7.2.gem | Transitive | N/A* | &#10060;| |
| [CVE-2022-23517](https://www.mend.io/vulnerability-database/CVE-2022-23517) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.5 | Not Defined | 0.1% | rails-html-sanitizer-1.4.3.gem | Transitive | N/A* | &#10060;| |
| [CVE-2022-23516](https://www.mend.io/vulnerability-database/CVE-2022-23516) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.5 | Not Defined | 0.1% | loofah-2.19.0.gem | Transitive | N/A* | &#10060;| |
| [CVE-2022-23514](https://www.mend.io/vulnerability-database/CVE-2022-23514) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.5 | Not Defined | 0.1% | loofah-2.19.0.gem | Transitive | N/A* | &#10060;| |
| [CVE-2022-23476](https://www.mend.io/vulnerability-database/CVE-2022-23476) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.5 | Not Defined | 0.1% | nokogiri-1.13.8-x86_64-linux.gem | Transitive | N/A* | &#10060;| |
| [CVE-2022-23519](https://www.mend.io/vulnerability-database/CVE-2022-23519) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.2 | Not Defined | 0.1% | rails-html-sanitizer-1.4.3.gem | Transitive | N/A* | &#10060;| |
| [CVE-2022-27777](https://www.mend.io/vulnerability-database/CVE-2022-27777) | <img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> Medium | 6.1 | Not Defined | 0.1% | actionview-5.0.7.2.gem | Transitive | N/A* | &#10060;| |
| [CVE-2022-23520](https://www.mend.io/vulnerability-database/CVE-2022-23520) | <img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> Medium | 6.1 | Not Defined | 0.1% | rails-html-sanitizer-1.4.3.gem | Transitive | N/A* | &#10060;| |
| [CVE-2022-23518](https://www.mend.io/vulnerability-database/CVE-2022-23518) | <img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> Medium | 6.1 | Not Defined | 0.1% | rails-html-sanitizer-1.4.3.gem | Transitive | N/A* | &#10060;| |
| [CVE-2022-23515](https://www.mend.io/vulnerability-database/CVE-2022-23515) | <img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> Medium | 6.1 | Not Defined | 0.2% | loofah-2.19.0.gem | Transitive | N/A* | &#10060;| |
| [CVE-2020-15169](https://www.mend.io/vulnerability-database/CVE-2020-15169) | <img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> Medium | 5.4 | Not Defined | 0.2% | actionview-5.0.7.2.gem | Transitive | N/A* | &#10060;| |
| [CVE-2024-53989](https://www.mend.io/vulnerability-database/CVE-2024-53989) | <img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> Medium | 4.7 | Not Defined | 0.0% | rails-html-sanitizer-1.4.3.gem | Transitive | N/A* | &#10060;| |
| [CVE-2024-53988](https://www.mend.io/vulnerability-database/CVE-2024-53988) | <img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> Medium | 4.7 | Not Defined | 0.0% | rails-html-sanitizer-1.4.3.gem | Transitive | N/A* | &#10060;| |
| [CVE-2024-53987](https://www.mend.io/vulnerability-database/CVE-2024-53987) | <img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> Medium | 4.7 | Not Defined | 0.0% | rails-html-sanitizer-1.4.3.gem | Transitive | N/A* | &#10060;| |
| [CVE-2024-53986](https://www.mend.io/vulnerability-database/CVE-2024-53986) | <img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> Medium | 4.7 | Not Defined | 0.0% | rails-html-sanitizer-1.4.3.gem | Transitive | N/A* | &#10060;| |
| [CVE-2024-53985](https://www.mend.io/vulnerability-database/CVE-2024-53985) | <img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> Medium | 4.7 | Not Defined | 0.0% | rails-html-sanitizer-1.4.3.gem | Transitive | N/A* | &#10060;| |
| [CVE-2020-5267](https://www.mend.io/vulnerability-database/CVE-2020-5267) | <img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> Medium | 4.0 | Not Defined | 0.2% | actionview-5.0.7.2.gem | Transitive | N/A* | &#10060;| |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

## Details

<details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/critical_vul.png?' width=19 height=20> CVE-2020-8165</summary>


### Vulnerable Library - activesupport-5.0.7.2.gem

A toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Rich support for multibyte strings, internationalization, time zones, and testing.
Library home page: <a href="https://rubygems.org/gems/activesupport-5.0.7.2.gem">https://rubygems.org/gems/activesupport-5.0.7.2.gem</a>
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/activesupport-5.0.7.2.gem


Dependency Hierarchy:
 - jbuilder-2.11.5.gem (Root Library)
 - :x: **activesupport-5.0.7.2.gem** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/Nexmo/ruby-2fa/commit/ab21a9f862ff3da3db0787ca394d129f490c3cfe">ab21a9f862ff3da3db0787ca394d129f490c3cfe</a>
Found in base branch: main




### Vulnerability Details
 
 
A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore potentially resulting in an RCE.

Publish Date: 2020-06-19
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2020-8165>CVE-2020-8165</a>




### Threat Assessment
 

Exploit Maturity: Not Defined
EPSS: 35.8%




### CVSS 3 Score Details (9.8)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: High
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://github.com/advisories/GHSA-2p68-f74v-9wc6">https://github.com/advisories/GHSA-2p68-f74v-9wc6</a>
Release Date: 2020-06-19
Fix Resolution: 5.2.4.3,6.0.3.1





</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> CVE-2023-22796</summary>


### Vulnerable Library - activesupport-5.0.7.2.gem

A toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Rich support for multibyte strings, internationalization, time zones, and testing.
Library home page: <a href="https://rubygems.org/gems/activesupport-5.0.7.2.gem">https://rubygems.org/gems/activesupport-5.0.7.2.gem</a>
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/activesupport-5.0.7.2.gem


Dependency Hierarchy:
 - jbuilder-2.11.5.gem (Root Library)
 - :x: **activesupport-5.0.7.2.gem** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/Nexmo/ruby-2fa/commit/ab21a9f862ff3da3db0787ca394d129f490c3cfe">ab21a9f862ff3da3db0787ca394d129f490c3cfe</a>
Found in base branch: main




### Vulnerability Details
 
 
A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially crafted string passed to the underscore method can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability.

Publish Date: 2023-02-09
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2023-22796>CVE-2023-22796</a>




### Threat Assessment
 

Exploit Maturity: Not Defined
EPSS: 0.2%




### CVSS 3 Score Details (7.5)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: None
 - Integrity Impact: None
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://github.com/advisories/GHSA-j6gc-792m-qgm2">https://github.com/advisories/GHSA-j6gc-792m-qgm2</a>
Release Date: 2023-02-09
Fix Resolution: activesupport - 6.1.7.1,7.0.4.1





</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> CVE-2022-23517</summary>


### Vulnerable Library - rails-html-sanitizer-1.4.3.gem

HTML sanitization for Rails applications
Library home page: <a href="https://rubygems.org/gems/rails-html-sanitizer-1.4.3.gem">https://rubygems.org/gems/rails-html-sanitizer-1.4.3.gem</a>
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rails-html-sanitizer-1.4.3.gem


Dependency Hierarchy:
 - jbuilder-2.11.5.gem (Root Library)
 - actionview-5.0.7.2.gem
 - :x: **rails-html-sanitizer-1.4.3.gem** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/Nexmo/ruby-2fa/commit/ab21a9f862ff3da3db0787ca394d129f490c3cfe">ab21a9f862ff3da3db0787ca394d129f490c3cfe</a>
Found in base branch: main




### Vulnerability Details
 
 
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Certain configurations of rails-html-sanitizer < 1.4.4 use an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a denial of service through CPU resource consumption. This issue has been patched in version 1.4.4.

Publish Date: 2022-12-14
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2022-23517>CVE-2022-23517</a>




### Threat Assessment
 

Exploit Maturity: Not Defined
EPSS: 0.1%




### CVSS 3 Score Details (7.5)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: None
 - Integrity Impact: None
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-5x79-w82f-gw8w">https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-5x79-w82f-gw8w</a>
Release Date: 2022-12-14
Fix Resolution: rails-html-sanitizer - 1.4.4





</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> CVE-2022-23516</summary>


### Vulnerable Library - loofah-2.19.0.gem

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri.

Loofah excels at HTML sanitization (XSS prevention). It includes some nice HTML sanitizers, which are based on HTML5lib's safelist, so it most likely won't make your codes less secure. (These statements have not been evaluated by Netexperts.)

ActiveRecord extensions for sanitization are available in the [`loofah-activerecord` gem](https://github.com/flavorjones/loofah-activerecord).
Library home page: <a href="https://rubygems.org/gems/loofah-2.19.0.gem">https://rubygems.org/gems/loofah-2.19.0.gem</a>
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/loofah-2.19.0.gem


Dependency Hierarchy:
 - jbuilder-2.11.5.gem (Root Library)
 - actionview-5.0.7.2.gem
 - rails-html-sanitizer-1.4.3.gem
 - :x: **loofah-2.19.0.gem** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/Nexmo/ruby-2fa/commit/ab21a9f862ff3da3db0787ca394d129f490c3cfe">ab21a9f862ff3da3db0787ca394d129f490c3cfe</a>
Found in base branch: main




### Vulnerability Details
 
 
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.2.0, < 2.19.1 uses recursion for sanitizing CDATA sections, making it susceptible to stack exhaustion and raising a SystemStackError exception. This may lead to a denial of service through CPU resource consumption. This issue is patched in version 2.19.1. Users who are unable to upgrade may be able to mitigate this vulnerability by limiting the length of the strings that are sanitized.

Publish Date: 2022-12-14
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2022-23516>CVE-2022-23516</a>




### Threat Assessment
 

Exploit Maturity: Not Defined
EPSS: 0.1%




### CVSS 3 Score Details (7.5)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: None
 - Integrity Impact: None
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://github.com/flavorjones/loofah/security/advisories/GHSA-3x8r-x6xp-q4vm">https://github.com/flavorjones/loofah/security/advisories/GHSA-3x8r-x6xp-q4vm</a>
Release Date: 2022-12-14
Fix Resolution: loofah - 2.19.1





</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> CVE-2022-23514</summary>


### Vulnerable Library - loofah-2.19.0.gem

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri.

Loofah excels at HTML sanitization (XSS prevention). It includes some nice HTML sanitizers, which are based on HTML5lib's safelist, so it most likely won't make your codes less secure. (These statements have not been evaluated by Netexperts.)

ActiveRecord extensions for sanitization are available in the [`loofah-activerecord` gem](https://github.com/flavorjones/loofah-activerecord).
Library home page: <a href="https://rubygems.org/gems/loofah-2.19.0.gem">https://rubygems.org/gems/loofah-2.19.0.gem</a>
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/loofah-2.19.0.gem


Dependency Hierarchy:
 - jbuilder-2.11.5.gem (Root Library)
 - actionview-5.0.7.2.gem
 - rails-html-sanitizer-1.4.3.gem
 - :x: **loofah-2.19.0.gem** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/Nexmo/ruby-2fa/commit/ab21a9f862ff3da3db0787ca394d129f490c3cfe">ab21a9f862ff3da3db0787ca394d129f490c3cfe</a>
Found in base branch: main




### Vulnerability Details
 
 
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah < 2.19.1 contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a denial of service through CPU resource consumption. This issue is patched in version 2.19.1.

Publish Date: 2022-12-14
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2022-23514>CVE-2022-23514</a>




### Threat Assessment
 

Exploit Maturity: Not Defined
EPSS: 0.1%




### CVSS 3 Score Details (7.5)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: None
 - Integrity Impact: None
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://github.com/advisories/GHSA-486f-hjj9-9vhh">https://github.com/advisories/GHSA-486f-hjj9-9vhh</a>
Release Date: 2022-12-14
Fix Resolution: loofah - 2.19.1





</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> CVE-2022-23476</summary>


### Vulnerable Library - nokogiri-1.13.8-x86_64-linux.gem

Nokogiri (鋸) makes it easy and painless to work with XML and HTML from Ruby. It provides a
sensible, easy-to-understand API for reading, writing, modifying, and querying documents. It is
fast and standards-compliant by relying on native parsers like libxml2 (C) and xerces (Java).

Library home page: <a href="https://rubygems.org/gems/nokogiri-1.13.8-x86_64-linux.gem">https://rubygems.org/gems/nokogiri-1.13.8-x86_64-linux.gem</a>
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/nokogiri-1.13.8-x86_64-linux.gem


Dependency Hierarchy:
 - jbuilder-2.11.5.gem (Root Library)
 - actionview-5.0.7.2.gem
 - rails-html-sanitizer-1.4.3.gem
 - loofah-2.19.0.gem
 - :x: **nokogiri-1.13.8-x86_64-linux.gem** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/Nexmo/ruby-2fa/commit/ab21a9f862ff3da3db0787ca394d129f490c3cfe">ab21a9f862ff3da3db0787ca394d129f490c3cfe</a>
Found in base branch: main




### Vulnerability Details
 
 
Nokogiri is an open source XML and HTML library for the Ruby programming language. Nokogiri `1.13.8` and `1.13.9` fail to check the return value from `xmlTextReaderExpand` in the method `Nokogiri::XML::Reader#attribute_hash`. This can lead to a null pointer exception when invalid markup is being parsed. For applications using `XML::Reader` to parse untrusted inputs, this may potentially be a vector for a denial of service attack. Users are advised to upgrade to Nokogiri `>= 1.13.10`. Users may be able to search their code for calls to either `XML::Reader#attributes` or `XML::Reader#attribute_hash` to determine if they are affected.

Publish Date: 2022-12-08
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2022-23476>CVE-2022-23476</a>




### Threat Assessment
 

Exploit Maturity: Not Defined
EPSS: 0.1%




### CVSS 3 Score Details (7.5)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: None
 - Integrity Impact: None
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Release Date: 2022-12-08
Fix Resolution: nokogiri - 1.13.10





</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> CVE-2022-23519</summary>


### Vulnerable Library - rails-html-sanitizer-1.4.3.gem

HTML sanitization for Rails applications
Library home page: <a href="https://rubygems.org/gems/rails-html-sanitizer-1.4.3.gem">https://rubygems.org/gems/rails-html-sanitizer-1.4.3.gem</a>
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rails-html-sanitizer-1.4.3.gem


Dependency Hierarchy:
 - jbuilder-2.11.5.gem (Root Library)
 - actionview-5.0.7.2.gem
 - :x: **rails-html-sanitizer-1.4.3.gem** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/Nexmo/ruby-2fa/commit/ab21a9f862ff3da3db0787ca394d129f490c3cfe">ab21a9f862ff3da3db0787ca394d129f490c3cfe</a>
Found in base branch: main




### Vulnerability Details
 
 
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags in either of the following ways: allow both "math" and "style" elements, or allow both "svg" and "style" elements. Code is only impacted if allowed tags are being overridden. . This issue is fixed in version 1.4.4. All users overriding the allowed tags to include "math" or "svg" and "style" should either upgrade or use the following workaround immediately: Remove "style" from the overridden allowed tags, or remove "math" and "svg" from the overridden allowed tags.


Publish Date: 2022-12-14
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2022-23519>CVE-2022-23519</a>




### Threat Assessment
 

Exploit Maturity: Not Defined
EPSS: 0.1%




### CVSS 3 Score Details (7.2)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Changed
- Impact Metrics:
 - Confidentiality Impact: Low
 - Integrity Impact: Low
 - Availability Impact: None

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-9h9g-93gc-623h">https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-9h9g-93gc-623h</a>
Release Date: 2022-12-14
Fix Resolution: rails-html-sanitizer - 1.4.4





</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> CVE-2022-27777</summary>


### Vulnerable Library - actionview-5.0.7.2.gem

Simple, battle-tested conventions and helpers for building web pages.
Library home page: <a href="https://rubygems.org/gems/actionview-5.0.7.2.gem">https://rubygems.org/gems/actionview-5.0.7.2.gem</a>
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/actionview-5.0.7.2.gem


Dependency Hierarchy:
 - jbuilder-2.11.5.gem (Root Library)
 - :x: **actionview-5.0.7.2.gem** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/Nexmo/ruby-2fa/commit/ab21a9f862ff3da3db0787ca394d129f490c3cfe">ab21a9f862ff3da3db0787ca394d129f490c3cfe</a>
Found in base branch: main




### Vulnerability Details
 
 
A XSS Vulnerability in Action View tag helpers >= 5.2.0 and < 5.2.0 which would allow an attacker to inject content if able to control input into specific attributes.

Publish Date: 2022-05-26
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2022-27777>CVE-2022-27777</a>




### Threat Assessment
 

Exploit Maturity: Not Defined
EPSS: 0.1%




### CVSS 3 Score Details (6.1)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: Required
 - Scope: Changed
- Impact Metrics:
 - Confidentiality Impact: Low
 - Integrity Impact: Low
 - Availability Impact: None

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://github.com/advisories/GHSA-ch3h-j2vf-95pv">https://github.com/advisories/GHSA-ch3h-j2vf-95pv</a>
Release Date: 2022-05-26
Fix Resolution: actionview - 5.2.7.1,6.0.4.8,6.1.5.1,7.0.2.4





</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> CVE-2022-23520</summary>


### Vulnerable Library - rails-html-sanitizer-1.4.3.gem

HTML sanitization for Rails applications
Library home page: <a href="https://rubygems.org/gems/rails-html-sanitizer-1.4.3.gem">https://rubygems.org/gems/rails-html-sanitizer-1.4.3.gem</a>
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rails-html-sanitizer-1.4.3.gem


Dependency Hierarchy:
 - jbuilder-2.11.5.gem (Root Library)
 - actionview-5.0.7.2.gem
 - :x: **rails-html-sanitizer-1.4.3.gem** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/Nexmo/ruby-2fa/commit/ab21a9f862ff3da3db0787ca394d129f490c3cfe">ab21a9f862ff3da3db0787ca394d129f490c3cfe</a>
Found in base branch: main




### Vulnerability Details
 
 
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, there is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer due to an incomplete fix of CVE-2022-32209. Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags to allow both "select" and "style" elements. Code is only impacted if allowed tags are being overridden. This issue is patched in version 1.4.4. All users overriding the allowed tags to include both "select" and "style" should either upgrade or use this workaround: Remove either "select" or "style" from the overridden allowed tags. NOTE: Code is _not_ impacted if allowed tags are overridden using either the :tags option to the Action View helper method sanitize or the :tags option to the instance method SafeListSanitizer#sanitize.


Publish Date: 2022-12-14
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2022-23520>CVE-2022-23520</a>




### Threat Assessment
 

Exploit Maturity: Not Defined
EPSS: 0.1%




### CVSS 3 Score Details (6.1)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: Required
 - Scope: Changed
- Impact Metrics:
 - Confidentiality Impact: Low
 - Integrity Impact: Low
 - Availability Impact: None

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-rrfc-7g8p-99q8">https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-rrfc-7g8p-99q8</a>
Release Date: 2022-12-14
Fix Resolution: rails-html-sanitizer - 1.4.4





</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> CVE-2022-23518</summary>


### Vulnerable Library - rails-html-sanitizer-1.4.3.gem

HTML sanitization for Rails applications
Library home page: <a href="https://rubygems.org/gems/rails-html-sanitizer-1.4.3.gem">https://rubygems.org/gems/rails-html-sanitizer-1.4.3.gem</a>
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rails-html-sanitizer-1.4.3.gem


Dependency Hierarchy:
 - jbuilder-2.11.5.gem (Root Library)
 - actionview-5.0.7.2.gem
 - :x: **rails-html-sanitizer-1.4.3.gem** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/Nexmo/ruby-2fa/commit/ab21a9f862ff3da3db0787ca394d129f490c3cfe">ab21a9f862ff3da3db0787ca394d129f490c3cfe</a>
Found in base branch: main




### Vulnerability Details
 
 
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Versions >= 1.0.3, < 1.4.4 are vulnerable to cross-site scripting via data URIs when used in combination with Loofah >= 2.1.0. This issue is patched in version 1.4.4.

Publish Date: 2022-12-14
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2022-23518>CVE-2022-23518</a>




### Threat Assessment
 

Exploit Maturity: Not Defined
EPSS: 0.1%




### CVSS 3 Score Details (6.1)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: Required
 - Scope: Changed
- Impact Metrics:
 - Confidentiality Impact: Low
 - Integrity Impact: Low
 - Availability Impact: None

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-mcvf-2q2m-x72m">https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-mcvf-2q2m-x72m</a>
Release Date: 2022-12-14
Fix Resolution: rails-html-sanitizer - 1.4.4





</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> CVE-2022-23515</summary>


### Vulnerable Library - loofah-2.19.0.gem

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri.

Loofah excels at HTML sanitization (XSS prevention). It includes some nice HTML sanitizers, which are based on HTML5lib's safelist, so it most likely won't make your codes less secure. (These statements have not been evaluated by Netexperts.)

ActiveRecord extensions for sanitization are available in the [`loofah-activerecord` gem](https://github.com/flavorjones/loofah-activerecord).
Library home page: <a href="https://rubygems.org/gems/loofah-2.19.0.gem">https://rubygems.org/gems/loofah-2.19.0.gem</a>
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/loofah-2.19.0.gem


Dependency Hierarchy:
 - jbuilder-2.11.5.gem (Root Library)
 - actionview-5.0.7.2.gem
 - rails-html-sanitizer-1.4.3.gem
 - :x: **loofah-2.19.0.gem** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/Nexmo/ruby-2fa/commit/ab21a9f862ff3da3db0787ca394d129f490c3cfe">ab21a9f862ff3da3db0787ca394d129f490c3cfe</a>
Found in base branch: main




### Vulnerability Details
 
 
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.1.0, < 2.19.1 is vulnerable to cross-site scripting via the image/svg+xml media type in data URIs. This issue is patched in version 2.19.1.

Publish Date: 2022-12-14
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2022-23515>CVE-2022-23515</a>




### Threat Assessment
 

Exploit Maturity: Not Defined
EPSS: 0.2%




### CVSS 3 Score Details (6.1)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: Required
 - Scope: Changed
- Impact Metrics:
 - Confidentiality Impact: Low
 - Integrity Impact: Low
 - Availability Impact: None

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://github.com/advisories/GHSA-228g-948r-83gx">https://github.com/advisories/GHSA-228g-948r-83gx</a>
Release Date: 2022-12-14
Fix Resolution: loofah - 2.19.1





</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> CVE-2020-15169</summary>


### Vulnerable Library - actionview-5.0.7.2.gem

Simple, battle-tested conventions and helpers for building web pages.
Library home page: <a href="https://rubygems.org/gems/actionview-5.0.7.2.gem">https://rubygems.org/gems/actionview-5.0.7.2.gem</a>
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/actionview-5.0.7.2.gem


Dependency Hierarchy:
 - jbuilder-2.11.5.gem (Root Library)
 - :x: **actionview-5.0.7.2.gem** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/Nexmo/ruby-2fa/commit/ab21a9f862ff3da3db0787ca394d129f490c3cfe">ab21a9f862ff3da3db0787ca394d129f490c3cfe</a>
Found in base branch: main




### Vulnerability Details
 
 
In Action View before versions 5.2.4.4 and 6.0.3.3 there is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translation helpers. Views that allow the user to control the default (not found) value of the `t` and `translate` helpers could be susceptible to XSS attacks. When an HTML-unsafe string is passed as the default for a missing translation key named html or ending in _html, the default string is incorrectly marked as HTML-safe and not escaped. This is patched in versions 6.0.3.3 and 5.2.4.4. A workaround without upgrading is proposed in the source advisory.

Publish Date: 2020-09-11
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2020-15169>CVE-2020-15169</a>




### Threat Assessment
 

Exploit Maturity: Not Defined
EPSS: 0.2%




### CVSS 3 Score Details (5.4)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: High
 - Privileges Required: None
 - User Interaction: None
 - Scope: Changed
- Impact Metrics:
 - Confidentiality Impact: Low
 - Integrity Impact: Low
 - Availability Impact: None

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://rubygems.org/gems/actionview/versions/6.0.3.3">https://rubygems.org/gems/actionview/versions/6.0.3.3</a>
Release Date: 2020-09-11
Fix Resolution: 6.0.3.3, 5.2.4.4





</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> CVE-2024-53989</summary>


### Vulnerable Library - rails-html-sanitizer-1.4.3.gem

HTML sanitization for Rails applications
Library home page: <a href="https://rubygems.org/gems/rails-html-sanitizer-1.4.3.gem">https://rubygems.org/gems/rails-html-sanitizer-1.4.3.gem</a>
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rails-html-sanitizer-1.4.3.gem


Dependency Hierarchy:
 - jbuilder-2.11.5.gem (Root Library)
 - actionview-5.0.7.2.gem
 - :x: **rails-html-sanitizer-1.4.3.gem** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/Nexmo/ruby-2fa/commit/ab21a9f862ff3da3db0787ca394d129f490c3cfe">ab21a9f862ff3da3db0787ca394d129f490c3cfe</a>
Found in base branch: main




### Vulnerability Details
 
 
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags for the the "noscript" element. This vulnerability is fixed in 1.6.1.

Publish Date: 2024-12-02
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2024-53989>CVE-2024-53989</a>




### Threat Assessment
 

Exploit Maturity: Not Defined
EPSS: 0.0%




### CVSS 3 Score Details (4.7)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: High
 - Privileges Required: None
 - User Interaction: Required
 - Scope: Changed
- Impact Metrics:
 - Confidentiality Impact: Low
 - Integrity Impact: Low
 - Availability Impact: None

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-rxv5-gxqc-xx8g">https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-rxv5-gxqc-xx8g</a>
Release Date: 2024-12-02
Fix Resolution: rails-html-sanitizer - 1.6.1





</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> CVE-2024-53988</summary>


### Vulnerable Library - rails-html-sanitizer-1.4.3.gem

HTML sanitization for Rails applications
Library home page: <a href="https://rubygems.org/gems/rails-html-sanitizer-1.4.3.gem">https://rubygems.org/gems/rails-html-sanitizer-1.4.3.gem</a>
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rails-html-sanitizer-1.4.3.gem


Dependency Hierarchy:
 - jbuilder-2.11.5.gem (Root Library)
 - actionview-5.0.7.2.gem
 - :x: **rails-html-sanitizer-1.4.3.gem** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/Nexmo/ruby-2fa/commit/ab21a9f862ff3da3db0787ca394d129f490c3cfe">ab21a9f862ff3da3db0787ca394d129f490c3cfe</a>
Found in base branch: main




### Vulnerability Details
 
 
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags where the "math", "mtext", "table", and "style" elements are allowed and either either "mglyph" or "malignmark" are allowed. This vulnerability is fixed in 1.6.1.

Publish Date: 2024-12-02
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2024-53988>CVE-2024-53988</a>




### Threat Assessment
 

Exploit Maturity: Not Defined
EPSS: 0.0%




### CVSS 3 Score Details (4.7)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: High
 - Privileges Required: None
 - User Interaction: Required
 - Scope: Changed
- Impact Metrics:
 - Confidentiality Impact: Low
 - Integrity Impact: Low
 - Availability Impact: None

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-cfjx-w229-hgx5">https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-cfjx-w229-hgx5</a>
Release Date: 2024-12-02
Fix Resolution: rails-html-sanitizer - 1.6.1





</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> CVE-2024-53987</summary>


### Vulnerable Library - rails-html-sanitizer-1.4.3.gem

HTML sanitization for Rails applications
Library home page: <a href="https://rubygems.org/gems/rails-html-sanitizer-1.4.3.gem">https://rubygems.org/gems/rails-html-sanitizer-1.4.3.gem</a>
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rails-html-sanitizer-1.4.3.gem


Dependency Hierarchy:
 - jbuilder-2.11.5.gem (Root Library)
 - actionview-5.0.7.2.gem
 - :x: **rails-html-sanitizer-1.4.3.gem** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/Nexmo/ruby-2fa/commit/ab21a9f862ff3da3db0787ca394d129f490c3cfe">ab21a9f862ff3da3db0787ca394d129f490c3cfe</a>
Found in base branch: main




### Vulnerability Details
 
 
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags where the "style" element is explicitly allowed and the "svg" or "math" element is not allowed. This vulnerability is fixed in 1.6.1.

Publish Date: 2024-12-02
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2024-53987>CVE-2024-53987</a>




### Threat Assessment
 

Exploit Maturity: Not Defined
EPSS: 0.0%




### CVSS 3 Score Details (4.7)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: High
 - Privileges Required: None
 - User Interaction: Required
 - Scope: Changed
- Impact Metrics:
 - Confidentiality Impact: Low
 - Integrity Impact: Low
 - Availability Impact: None

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-2x5m-9ch4-qgrr">https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-2x5m-9ch4-qgrr</a>
Release Date: 2024-12-02
Fix Resolution: rails-html-sanitizer - 1.6.1





</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> CVE-2024-53986</summary>


### Vulnerable Library - rails-html-sanitizer-1.4.3.gem

HTML sanitization for Rails applications
Library home page: <a href="https://rubygems.org/gems/rails-html-sanitizer-1.4.3.gem">https://rubygems.org/gems/rails-html-sanitizer-1.4.3.gem</a>
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rails-html-sanitizer-1.4.3.gem


Dependency Hierarchy:
 - jbuilder-2.11.5.gem (Root Library)
 - actionview-5.0.7.2.gem
 - :x: **rails-html-sanitizer-1.4.3.gem** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/Nexmo/ruby-2fa/commit/ab21a9f862ff3da3db0787ca394d129f490c3cfe">ab21a9f862ff3da3db0787ca394d129f490c3cfe</a>
Found in base branch: main




### Vulnerability Details
 
 
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags where the "math" and "style" elements are both explicitly allowed. This vulnerability is fixed in 1.6.1.

Publish Date: 2024-12-02
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2024-53986>CVE-2024-53986</a>




### Threat Assessment
 

Exploit Maturity: Not Defined
EPSS: 0.0%




### CVSS 3 Score Details (4.7)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: High
 - Privileges Required: None
 - User Interaction: Required
 - Scope: Changed
- Impact Metrics:
 - Confidentiality Impact: Low
 - Integrity Impact: Low
 - Availability Impact: None

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-638j-pmjw-jq48">https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-638j-pmjw-jq48</a>
Release Date: 2024-12-02
Fix Resolution: rails-html-sanitizer - 1.6.1





</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> CVE-2024-53985</summary>


### Vulnerable Library - rails-html-sanitizer-1.4.3.gem

HTML sanitization for Rails applications
Library home page: <a href="https://rubygems.org/gems/rails-html-sanitizer-1.4.3.gem">https://rubygems.org/gems/rails-html-sanitizer-1.4.3.gem</a>
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rails-html-sanitizer-1.4.3.gem


Dependency Hierarchy:
 - jbuilder-2.11.5.gem (Root Library)
 - actionview-5.0.7.2.gem
 - :x: **rails-html-sanitizer-1.4.3.gem** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/Nexmo/ruby-2fa/commit/ab21a9f862ff3da3db0787ca394d129f490c3cfe">ab21a9f862ff3da3db0787ca394d129f490c3cfe</a>
Found in base branch: main




### Vulnerability Details
 
 
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0 and Nokogiri < 1.15.7, or 1.16.x < 1.16.8. The XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags with both "math" and "style" elements or both both "svg" and "style" elements. This vulnerability is fixed in 1.6.1.

Publish Date: 2024-12-02
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2024-53985>CVE-2024-53985</a>




### Threat Assessment
 

Exploit Maturity: Not Defined
EPSS: 0.0%




### CVSS 3 Score Details (4.7)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: High
 - Privileges Required: None
 - User Interaction: Required
 - Scope: Changed
- Impact Metrics:
 - Confidentiality Impact: Low
 - Integrity Impact: Low
 - Availability Impact: None

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-w8gc-x259-rc7x">https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-w8gc-x259-rc7x</a>
Release Date: 2024-12-02
Fix Resolution: rails-html-sanitizer - 1.6.1





</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> CVE-2020-5267</summary>


### Vulnerable Library - actionview-5.0.7.2.gem

Simple, battle-tested conventions and helpers for building web pages.
Library home page: <a href="https://rubygems.org/gems/actionview-5.0.7.2.gem">https://rubygems.org/gems/actionview-5.0.7.2.gem</a>
Path to dependency file: /Gemfile.lock
Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/actionview-5.0.7.2.gem


Dependency Hierarchy:
 - jbuilder-2.11.5.gem (Root Library)
 - :x: **actionview-5.0.7.2.gem** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/Nexmo/ruby-2fa/commit/ab21a9f862ff3da3db0787ca394d129f490c3cfe">ab21a9f862ff3da3db0787ca394d129f490c3cfe</a>
Found in base branch: main




### Vulnerability Details
 
 
In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the `j` or `escape_javascript` methods may be susceptible to XSS attacks. The issue is fixed in versions 6.0.2.2 and 5.2.4.2.

Publish Date: 2020-03-19
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2020-5267>CVE-2020-5267</a>




### Threat Assessment
 

Exploit Maturity: Not Defined
EPSS: 0.2%




### CVSS 3 Score Details (4.0)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: High
 - Privileges Required: High
 - User Interaction: Required
 - Scope: Changed
- Impact Metrics:
 - Confidentiality Impact: Low
 - Integrity Impact: Low
 - Availability Impact: None

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5267">https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5267</a>
Release Date: 2020-03-19
Fix Resolution: actionview:6.0.2.2, 5.2.4.2





</details>

CVE	Severity	CVSS	Exploit Maturity	EPSS	Dependency	Type	Fixed in (jbuilder version)	Remediation Possible**
CVE-2020-8165	Critical	9.8	Not Defined	35.8%	activesupport-5.0.7.2.gem	Transitive	N/A*	❌
CVE-2023-22796	High	7.5	Not Defined	0.2%	activesupport-5.0.7.2.gem	Transitive	N/A*	❌
CVE-2022-23517	High	7.5	Not Defined	0.1%	rails-html-sanitizer-1.4.3.gem	Transitive	N/A*	❌
CVE-2022-23516	High	7.5	Not Defined	0.1%	loofah-2.19.0.gem	Transitive	N/A*	❌
CVE-2022-23514	High	7.5	Not Defined	0.1%	loofah-2.19.0.gem	Transitive	N/A*	❌
CVE-2022-23476	High	7.5	Not Defined	0.1%	nokogiri-1.13.8-x86_64-linux.gem	Transitive	N/A*	❌
CVE-2022-23519	High	7.2	Not Defined	0.1%	rails-html-sanitizer-1.4.3.gem	Transitive	N/A*	❌
CVE-2022-27777	Medium	6.1	Not Defined	0.1%	actionview-5.0.7.2.gem	Transitive	N/A*	❌
CVE-2022-23520	Medium	6.1	Not Defined	0.1%	rails-html-sanitizer-1.4.3.gem	Transitive	N/A*	❌
CVE-2022-23518	Medium	6.1	Not Defined	0.1%	rails-html-sanitizer-1.4.3.gem	Transitive	N/A*	❌
CVE-2022-23515	Medium	6.1	Not Defined	0.2%	loofah-2.19.0.gem	Transitive	N/A*	❌
CVE-2020-15169	Medium	5.4	Not Defined	0.2%	actionview-5.0.7.2.gem	Transitive	N/A*	❌
CVE-2024-53989	Medium	4.7	Not Defined	0.0%	rails-html-sanitizer-1.4.3.gem	Transitive	N/A*	❌
CVE-2024-53988	Medium	4.7	Not Defined	0.0%	rails-html-sanitizer-1.4.3.gem	Transitive	N/A*	❌
CVE-2024-53987	Medium	4.7	Not Defined	0.0%	rails-html-sanitizer-1.4.3.gem	Transitive	N/A*	❌
CVE-2024-53986	Medium	4.7	Not Defined	0.0%	rails-html-sanitizer-1.4.3.gem	Transitive	N/A*	❌
CVE-2024-53985	Medium	4.7	Not Defined	0.0%	rails-html-sanitizer-1.4.3.gem	Transitive	N/A*	❌
CVE-2020-5267	Medium	4.0	Not Defined	0.2%	actionview-5.0.7.2.gem	Transitive	N/A*	❌

jbuilder-2.11.5.gem: 18 vulnerabilities (highest severity is: 9.8) #23

Description

Vulnerabilities

Details

Vulnerable Library - activesupport-5.0.7.2.gem

Vulnerability Details

Threat Assessment

CVSS 3 Score Details (9.8)

Suggested Fix

Vulnerable Library - activesupport-5.0.7.2.gem

Vulnerability Details

Threat Assessment

CVSS 3 Score Details (7.5)

Suggested Fix

Vulnerable Library - rails-html-sanitizer-1.4.3.gem

Vulnerability Details

Threat Assessment

CVSS 3 Score Details (7.5)

Suggested Fix

Vulnerable Library - loofah-2.19.0.gem

Vulnerability Details

Threat Assessment

CVSS 3 Score Details (7.5)

Suggested Fix

Vulnerable Library - loofah-2.19.0.gem

Vulnerability Details

Threat Assessment

CVSS 3 Score Details (7.5)

Suggested Fix

Vulnerable Library - nokogiri-1.13.8-x86_64-linux.gem

Vulnerability Details

Threat Assessment

CVSS 3 Score Details (7.5)

Suggested Fix

Vulnerable Library - rails-html-sanitizer-1.4.3.gem

Vulnerability Details

Threat Assessment

CVSS 3 Score Details (7.2)

Suggested Fix

Vulnerable Library - actionview-5.0.7.2.gem

Vulnerability Details

Threat Assessment

CVSS 3 Score Details (6.1)

Suggested Fix

Vulnerable Library - rails-html-sanitizer-1.4.3.gem

Vulnerability Details

Threat Assessment

CVSS 3 Score Details (6.1)

Suggested Fix

Vulnerable Library - rails-html-sanitizer-1.4.3.gem

Vulnerability Details

Threat Assessment

CVSS 3 Score Details (6.1)

Suggested Fix

Vulnerable Library - loofah-2.19.0.gem

Vulnerability Details

Threat Assessment

CVSS 3 Score Details (6.1)

Suggested Fix

Vulnerable Library - actionview-5.0.7.2.gem

Vulnerability Details

Threat Assessment

CVSS 3 Score Details (5.4)

Suggested Fix

Vulnerable Library - rails-html-sanitizer-1.4.3.gem

Vulnerability Details

Threat Assessment

CVSS 3 Score Details (4.7)

Suggested Fix

Vulnerable Library - rails-html-sanitizer-1.4.3.gem

Vulnerability Details

Threat Assessment

CVSS 3 Score Details (4.7)

Suggested Fix

Vulnerable Library - rails-html-sanitizer-1.4.3.gem

Vulnerability Details

Threat Assessment

CVSS 3 Score Details (4.7)

Suggested Fix

Vulnerable Library - rails-html-sanitizer-1.4.3.gem