ember-source vulnerable to Cross-site Scripting

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2015-1866 · ADVISORY
• emberjs.com/blog/2015/04/14/security-and-bugfix-releases-ember-1-10-1-1-11-2-1-11-3.html · WEB
• Acidburn0zzz/ember.js · PACKAGE
• rubysec/ruby-advisory-db · WEB
• groups.google.com/forum · WEB
• web.archive.org/web/20200228155301/http://www.securityfocus.com/bid/74185 · WEB
• openwall.com/lists/oss-security/2015/04/14/11 · WEB
• securityfocus.com/bid/74185 · Third Party Advisory

ember-source のその他の脆弱性

• CVE-2013-4170中 6.1In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, the…
• CVE-2014-0014中 5.4Ember.js 1.0.x before 1.0.1, 1.1.x before 1.1.3, 1.2.x before 1.2.1, 1.3.x before 1.3.1, and 1.4.x before 1.4.0-beta.2 allows remote attacke…
• CVE-2014-0013中 5.4Ember.js 1.0.x before 1.0.1, 1.1.x before 1.1.3, 1.2.x before 1.2.1, 1.3.x before 1.3.1, and 1.4.x before 1.4.0-beta.2 allows remote attacke…
• CVE-2015-7565中 6.1Cross-site scripting (XSS) vulnerability in Ember.js 1.8.x through 1.10.x, 1.11.x before 1.11.4, 1.12.x before 1.12.2, 1.13.x before 1.13.12…
• CVE-2014-0046低 2.6Cross-site scripting (XSS) vulnerability in the link-to helper in Ember.js 1.2.x before 1.2.2, 1.3.x before 1.3.2, and 1.4.x before 1.4.0-be…