CVE-2019-18841: Undefined Security Weakness

Chartkick.js 3.1.0 through 3.1.3, as used in the Chartkick gem before 3.3.0 for Ruby, allows prototype pollution...

Ruby Chartkick gem cross-site scripting vulnerability

Ruby Chartkick gem is a Ruby-based package for creating Javascript charts. A cross-site scripting vulnerability exists in Ruby Chartkick gem version 3.1.0 and earlier. The vulnerability stems from a lack of proper validation of client-side data by the web application. An attacker can exploit this...

GHSA-G45G-G52H-39RG Cross-site Scripting in Chartkick

The Chartkick gem through 3.1.0 for Ruby allows XSS...

Cross-site Scripting in Chartkick

The Chartkick gem through 3.1.0 for Ruby allows XSS...

CVE-2019-12732

The Chartkick gem through 3.1.0 for Ruby allows XSS...

CVE-2019-12732

The Chartkick gem through 3.1.0 for Ruby allows XSS...

Cross site scripting

The Chartkick gem through 3.1.0 for Ruby allows XSS...

CVE-2019-12732

CVE-2019-12732 concerns the Chartkick gem for Ruby, up to version 3.1.0, which allows Cross‑Site Scripting (XSS). The vulnerability stems from how data is handled by the chart rendering path (e.g., json data passed to chartkick_chart), where insufficient sanitization/validation can lead to arbitr...

CVE-2019-12732

The Chartkick gem through 3.1.0 for Ruby allows XSS...

Cross-site Scripting (XSS)

Chartkick is vulnerable to Cross-Site Scripting. The JSON data passed to the chartkickchart function is not properly sanitised, thus allowing an attacker to input malicious data to execute arbitrary Javascript code on the victim's browser...

CVE-2019-12732: Improper Neutralization of Input During Web Page Generation

The Chartkick gem through 3.1.0 for Ruby allows XSS...

XSS Vulnerability in Chartkick Ruby Gem

Chartkick is vulnerable to a cross-site scripting XSS attack if both the following conditions are met: Condition 1: It's used with ActiveSupport.escapehtmlentitiesinjson = false this is not the default for Rails OR used with a non-Rails framework like Sinatra. Condition 2: Untrusted data or optio...