Skip to main content
cve.nowby Sazabi
← RubyGems
RubyGemsPackage

phlex

3 known vulnerabilities (3 high), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
3 · 3 high
Registry
RubyGems

Advisories 3

  • Cross-site Scripting (XSS) possible with maliciously formed HTML attribute names and values in Phlex

    Affected: fixed in 1.9.3; from 1.10.0, fixed in 1.10.2.

  • phlex makes Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `<a>` tags

    Affected: from 1.10.0, fixed in 1.10.1; from 1.9.0, fixed in 1.9.2; from 1.8.0, fixed in 1.8.3; from 1.7.0, fixed in 1.7.2; from 1.6.0, fixed in 1.6.3; from 1.5.0, fixed in 1.5.3; fixed in 1.4.2.

  • Cross-site Scripting (XSS) possible with maliciously formed HTML attribute names and values in Phlex

    Affected: from 1.9.0, fixed in 1.9.1; from 1.8.0, fixed in 1.8.2; from 1.7.0, fixed in 1.7.1; from 1.6.0, fixed in 1.6.2; from 1.5.0, fixed in 1.5.2; from 1.4.0, fixed in 1.4.1; from 1.3.0, fixed in 1.3.3; from 1.2.0, fixed in 1.2.2; from 1.1.0, fixed in 1.1.1; fixed in 1.0.1.