Prototype Pollution in handlebars

Versions of handlebars prior to 4.0.14 are vulnerable to Prototype Pollution. Templates may alter an Objects' prototype, thus allowing an attacker to execute arbitrary code on the server. Recommendation For handlebars 4.1.x upgrade to 4.1.2 or later. For handlebars 4.0.x upgrade to 4.0.14 or late...

GHSA-Q42P-PG8M-CQH6 Prototype Pollution in handlebars

Versions of handlebars prior to 4.0.14 are vulnerable to Prototype Pollution. Templates may alter an Objects' prototype, thus allowing an attacker to execute arbitrary code on the server. Recommendation For handlebars 4.1.x upgrade to 4.1.2 or later. For handlebars 4.0.x upgrade to 4.0.14 or late...

Fedora 30 : nodejs-handlebars (2019-c1213f866c)

Security fix for https://www.npmjs.com/advisories/755 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

Remote Code Execution

handlebars is vulnerable to remote code execution. The vulnerability exists because it is possible to manipulate the template and access the constructor in the template, allowing an attacker to inject arbitrary code through it...

Remote Code Execution (RCE)

handlebars is vulnerable to remote code execution. Access to the constructor in templates is not prohibited, allowing an attacker to inject arbitrary templates into the Handlebars setup and execute arbitrary code...

Prototype Pollution

Overview Versions of handlebars prior to 4.0.14 are vulnerable to Prototype Pollution. Templates may alter an Objects' prototype, thus allowing an attacker to execute arbitrary code on the server. Recommendation For handlebars 4.1.x upgrade to 4.1.2 or later. For handlebars 4.0.x upgrade to 4.0.1...

Cross-Site Scripting in handlebars

Versions of handlebars prior to 4.0.0 are affected by a cross-site scripting vulnerability when attributes in handlebar templates are not quoted. Proof of Concept Template: Input: 'foo' : 'test.com onload=alert1' Rendered result: Recommendation Update to version 4.0.0 or later. Alternatively,...

GHSA-9PRH-257W-9277 Cross-Site Scripting in handlebars

Versions of handlebars prior to 4.0.0 are affected by a cross-site scripting vulnerability when attributes in handlebar templates are not quoted. Proof of Concept Template: Input: 'foo' : 'test.com onload=alert1' Rendered result: Recommendation Update to version 4.0.0 or later. Alternatively,...

CVE-2014-0013

Ember.js 1.0.x before 1.0.1, 1.1.x before 1.1.3, 1.2.x before 1.2.1, 1.3.x before 1.3.1, and 1.4.x before 1.4.0-beta.2 allows remote attackers to conduct cross-site scripting XSS attacks by leveraging an application that contains templates whose context is set to a user-supplied primitive value a...

Cross site scripting

Ember.js 1.0.x before 1.0.1, 1.1.x before 1.1.3, 1.2.x before 1.2.1, 1.3.x before 1.3.1, and 1.4.x before 1.4.0-beta.2 allows remote attackers to conduct cross-site scripting XSS attacks by leveraging an application that contains templates whose context is set to a user-supplied primitive value a...

CVE-2014-0013

Ember.js 1.0.x before 1.0.1, 1.1.x before 1.1.3, 1.2.x before 1.2.1, 1.3.x before 1.3.1, and 1.4.x before 1.4.0-beta.2 allows remote attackers to conduct cross-site scripting XSS attacks by leveraging an application that contains templates whose context is set to a user-supplied primitive value a...

CVE-2014-0013

Ember.js 1.0.x before 1.0.1, 1.1.x before 1.1.3, 1.2.x before 1.2.1, 1.3.x before 1.3.1, and 1.4.x before 1.4.0-beta.2 allows remote attackers to conduct cross-site scripting XSS attacks by leveraging an application that contains templates whose context is set to a user-supplied primitive value a...

PT-2018-4116

Name of the Vulnerable Software and Affected Versions Ember.js versions 1.0.x through 1.0.0, 1.1.x through 1.1.2, 1.2.x through 1.2.0, 1.3.x through 1.3.0, and 1.4.x through 1.4.0-beta.1 Description The issue allows remote attackers to conduct cross-site scripting XSS attacks by leveraging an...

CVE-2014-0013: Improper Neutralization of Input During Web Page Generation

Ember.js 1.0.x before 1.0.1, 1.1.x before 1.1.3, 1.2.x before 1.2.1, 1.3.x before 1.3.1, and 1.4.x before 1.4.0-beta.2 allows remote attackers to conduct cross-site scripting XSS attacks by leveraging an application that contains templates whose context is set to a user-supplied primitive value a...

Moderate severity vulnerability that affects handlebars

Withdrawn: Duplicate of GHSA-9prh-257w-9277...

Cross-site Scripting (XSS)

rendr-handlebars is vulnerable to cross-site scripting XSS attacks. This is because unsanitized data is passed to the client, allowing the attacks to be performed...

Cross site scripting

The handlebars package before 4.0.0 for Node.js allows remote attackers to conduct cross-site scripting XSS attacks by leveraging a template with an attribute that is not quoted...

CVE-2015-8861

The handlebars package before 4.0.0 for Node.js allows remote attackers to conduct cross-site scripting XSS attacks by leveraging a template with an attribute that is not quoted...

DEBIAN-CVE-2015-8861

The handlebars package before 4.0.0 for Node.js allows remote attackers to conduct cross-site scripting XSS attacks by leveraging a template with an attribute that is not quoted...

CVE-2015-8861

The handlebars package before 4.0.0 for Node.js allows remote attackers to conduct cross-site scripting XSS attacks by leveraging a template with an attribute that is not quoted...