Search for packages
| purl | pkg:gem/yard@0.2.2 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-4fgr-usag-z7dm
Aliases: CVE-2024-27285 GHSA-8mq4-9jjh-9xrc |
YARD's default template vulnerable to Cross-site Scripting in generated frames.html The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file. |
Affected by 0 other vulnerabilities. |
|
VCID-pnw3-qk8w-ayhc
Aliases: CVE-2017-17042 GHSA-gj4p-3wh3-2rmf |
Directory traversal `lib/yard/core_ext/file.rb` does not block relative paths with an initial `../` sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files. |
Affected by 2 other vulnerabilities. |
|
VCID-xkbj-n36y-8bbr
Aliases: CVE-2019-1020001 GHSA-xfhh-rx56-rxcr |
Arbitrary path traversal and file access via `yard server` A path traversal vulnerability was discovered in YARD <= 0.9.19 when using `yard server` to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions. The issue is resolved in v0.9.20 and later. |
Affected by 1 other vulnerability. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||