Lucene search
PRIOn knowledge basePRION:CVE-2024-27285HistoryFeb 28, 2024 - 8:15 p.m.
Cross site scripting
2024-02-2820:15:00
PRIOn knowledge base
www.prio-n.com
8
cross site scripting
ruby documentation
user input sanitization
javascript
frames.html
frames.erb
nvd
0.0004 Low
EPSS
Percentile
10.4%
YARD is a Ruby Documentation tool. The “frames.html” file within the Yard Doc’s generated documentation is vulnerable to Cross-Site Scripting (XSS) attacks due to inadequate sanitization of user input within the JavaScript segment of the “frames.erb” template file. This vulnerability is fixed in 0.9.36.
References
github.com/lsegal/yard/commit/1fcb2d8b316caf8779cfdcf910715e9ab583f0aa
github.com/lsegal/yard/commit/2069e2bf08293bda2fcc78f7d0698af6354054be
github.com/lsegal/yard/pull/1538
github.com/lsegal/yard/security/advisories/GHSA-8mq4-9jjh-9xrc
github.com/rubysec/ruby-advisory-db/blob/master/gems/yard/CVE-2024-27285.yml
lists.debian.org/debian-lts-announce/2024/03/msg00006.html
Related
osv
osv
YARD's default template vulnerable to Cross-site Scripting in generated frames.html
2024-02-28 18:57:19
CVE-2024-27285
2024-02-28 20:15:41
yard - security update
2024-03-04 00:00:00
debian
debian
[SECURITY] [DSA 5635-1] yard security update
2024-03-04 20:48:13
[SECURITY] [DLA 3753-1] yard security update
2024-03-06 21:45:00
nessus
nessus
Fedora 38 : rubygem-yard (2024-3744975c4b)
2024-03-20 00:00:00
Debian dsa-5635 : yard - security update
2024-03-05 00:00:00
Debian dla-3753 : yard - security update
2024-03-07 00:00:00
openvas
openvas
Fedora: Security Advisory for rubygem-yard (FEDORA-2024-3744975c4b)
2024-03-25 00:00:00
Debian: Security Advisory (DSA-5635-1)
2024-03-05 00:00:00
Debian: Security Advisory (DLA-3753-1)
2024-03-07 00:00:00
github
github
debiancve
debiancve
CVE-2024-27285
2024-02-28 20:15:41
veracode
veracode
Cross-Site Scripting(XSS)
2024-02-29 05:45:38
ubuntucve
ubuntucve
CVE-2024-27285
2024-02-29 00:00:00
redhatcve
redhatcve
CVE-2024-27285
2024-03-01 15:02:08
cve
cve
CVE-2024-27285
2024-02-28 20:15:41
nvd
nvd
CVE-2024-27285
2024-02-28 20:15:41
cvelist
cvelist
fedora
fedora
[SECURITY] Fedora 38 Update: rubygem-yard-0.9.36-1.fc38
2024-03-21 01:28:26
ubuntu
ubuntu
YARD vulnerabilities
2024-04-15 00:00:00
rapid7blog
rapid7blog
Metasploit Wrap-Up 03/08/2024
2024-03-08 17:00:00