QwikSec

Security Database

CVE

CWE

Training

CVE-2014-0046

Published: Feb 27, 2014

Modified: Aug 6, 2024

PUBLISHED

Description

Cross-site scripting (XSS) vulnerability in the link-to helper in Ember.js 1.2.x before 1.2.2, 1.3.x before 1.3.2, and 1.4.x before 1.4.0-beta.6, when used in non-block form, allows remote attackers to inject arbitrary web script or HTML via the title attribute.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

emberjs-linkto-xss(91242)

vdb-entry

x_refsource_XF

third-party-advisory

x_refsource_SECUNIA

vdb-entry

x_refsource_BID

https://groups.google.com/forum/#%21topic/ember-security/1h6FRgr8lXQ

x_refsource_CONFIRM

http://emberjs.com/blog/2014/02/07/ember-security-releases.html

x_refsource_CONFIRM

[oss-security] 20140214 [CVE-2014-0046] XSS Vulnerability With {{link-to}} Helper in Non-block Form

mailing-list

x_refsource_MLIST

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.