Search for packages
| purl | pkg:deb/debian/yard@0.8.2.1-2 |
| Next non-vulnerable version | 0.9.24-1+deb11u1 |
| Latest non-vulnerable version | 0.9.24-1+deb11u1 |
| Risk |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-4fgr-usag-z7dm
Aliases: CVE-2024-27285 GHSA-8mq4-9jjh-9xrc |
YARD's default template vulnerable to Cross-site Scripting in generated frames.html The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file. |
Affected by 0 other vulnerabilities. |
|
VCID-pnw3-qk8w-ayhc
Aliases: CVE-2017-17042 GHSA-gj4p-3wh3-2rmf |
Directory traversal `lib/yard/core_ext/file.rb` does not block relative paths with an initial `../` sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files. |
Affected by 2 other vulnerabilities. |
|
VCID-xkbj-n36y-8bbr
Aliases: CVE-2019-1020001 GHSA-xfhh-rx56-rxcr |
Arbitrary path traversal and file access via `yard server` A path traversal vulnerability was discovered in YARD <= 0.9.19 when using `yard server` to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions. The issue is resolved in v0.9.20 and later. |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-06-06T08:42:47.741548+00:00 | Debian Oval Importer | Affected by | VCID-4fgr-usag-z7dm | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 38.6.0 |
| 2026-06-06T01:21:20.740977+00:00 | Debian Oval Importer | Affected by | VCID-pnw3-qk8w-ayhc | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 38.6.0 |
| 2026-06-06T00:20:36.466700+00:00 | Debian Oval Importer | Affected by | VCID-xkbj-n36y-8bbr | https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 | 38.6.0 |