Cross-site Scripting in Chartkick

Description

References

• nvd.nist.gov/vuln/detail/CVE-2019-12732 · ADVISORY
• ankane/chartkick · WEB
• ankane/chartkick · PACKAGE
• ankane/chartkick · WEB

chartkick 的其他漏洞

• CVE-2020-16254中危 6.1The Chartkick gem through 3.3.2 for Ruby allows Cascading Style Sheets (CSS) Injection (without attribute).
• CVE-2019-18841高危 7.3Chartkick.js 3.1.0 through 3.1.3, as used in the Chartkick gem before 3.3.0 for Ruby, allows prototype pollution.