Search for packages
| purl | pkg:gem/rdoc@3.5 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-3tdt-b5tc-aaak
Aliases: CVE-2015-9251 GHSA-rmxg-73gg-4p98 |
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed. |
Affected by 2 other vulnerabilities. |
|
VCID-421x-nuyc-aaap
Aliases: CVE-2024-27281 GHSA-592j-995h-p23j |
RDoc RCE vulnerability with .rdoc_options |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 1 other vulnerability. Affected by 0 other vulnerabilities. |
|
VCID-6837-vzhf-aaad
Aliases: CVE-2013-0256 GHSA-v2r9-c84j-v7xm OSV-90004 |
Moderate severity vulnerability that affects rdoc |
Affected by 5 other vulnerabilities. Affected by 6 other vulnerabilities. Affected by 6 other vulnerabilities. Affected by 5 other vulnerabilities. Affected by 5 other vulnerabilities. |
|
VCID-gmf4-gcd5-aaab
Aliases: CVE-2021-31799 GHSA-ggxm-pgc9-g7fp |
In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename. |
Affected by 1 other vulnerability. Affected by 0 other vulnerabilities. Affected by 1 other vulnerability. |
|
VCID-q1qe-zr6p-aaap
Aliases: CVE-2012-6708 GHSA-2pqj-h3vj-pqgw |
jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common. |
Affected by 2 other vulnerabilities. |
|
VCID-tv97-anfg-aaam
Aliases: CVE-2019-11358 GHSA-6c3j-c64m-qhgq |
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype. |
Affected by 2 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-fhgh-jkwa-aaah | In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0. |
CVE-2020-11023
GHSA-jpcq-cgw6-v4j6 |
| VCID-kkd1-e4k1-aaam | In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0. |
CVE-2020-11022
GHSA-gxr4-xjj5-5px2 |