CVE-2013-4170
1 advisory.
RubyGems/ember-source CVE-2013-4170: medium 6.1
Ember.js Potential XSS Exploit When Binding `tagName` to User-Supplied Data
Action: Upgrade ember-source to 1.0.0.rc1.1 or later.
bundle update ember-sourceAffected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.0.0.rc1.1 | - |
| 1.0.0.rc2.0 | 1.0.0.rc2.1 | - |
| 1.0.0.rc3.0 | 1.0.0.rc3.1 | - |
| 1.0.0.rc4.0 | 1.0.0.rc4.1 | - |
| 1.0.0.rc5.0 | 1.0.0.rc5.1 | - |
| 1.0.0.rc6.0 | 1.0.0.rc6.1 | - |
Fixed versions
| 1.0.0.rc1.1 | 1.0.0.rc2.1 | 1.0.0.rc3.1 | 1.0.0.rc4.1 | 1.0.0.rc5.1 | 1.0.0.rc6.1 |
Sources
- osv: GHSA-5m48-c37x-f792
- https://nvd.nist.gov/vuln/detail/CVE-2013-4170
- https://github.com/emberjs/ember.js
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ember-source/CVE-2013-4170.yml
- https://groups.google.com/forum/#!topic/ember-security/dokLVwwxAdM
- https://groups.google.com/g/ember-security/c/dokLVwwxAdM
- https://rubysec.com/advisories/CVE-2013-4170
- https://security.snyk.io/vuln/SNYK-RUBY-EMBERSOURCE-20102
CVE-2013-4170 · published · modified · JSON