CVE-2018-0499: Cross-site Scripting

July 2, 2018 (updated August 28, 2018)

A cross-site scripting vulnerability in the xapian-core library that is wrapped by this gem due to incomplete HTML escaping by Xapian::MSet::snippet().

References

lists.xapian.org/pipermail/xapian-discuss/2018-July/009652.html
nvd.nist.gov/vuln/detail/CVE-2018-0499
trac.xapian.org/wiki/SecurityFixes/2018-07-02

Detect and mitigate CVE-2018-0499 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →