Description

Cross-site scripting (XSS) vulnerability in the link-to helper in Ember.js 1.2.x before 1.2.2, 1.3.x before 1.3.2, and 1.4.x before 1.4.0-beta.6, when used in non-block form, allows remote attackers to inject arbitrary web script or HTML via the title attribute.

Remediation

References

CVE-2014-0046

Related Vulnerabilities

WordPress Plugin PDF Flipbook, 3D Flipbook WordPress-DearFlip Cross-Site Scripting (1.7.9)

PHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2010-2484)

WordPress Plugin WatuPRO SQL Injection (5.5.3.6)

WordPress Plugin Word of the day Arbitrary File Upload (1.0)

WordPress Plugin Ninja Forms Contact Form-The Drag and Drop Form Builder for WordPress Multiple Vulnerabilities (2.9.42)

Severity

Low

Classification

CVE-2014-0046 CWE-707

Tags

Missing Update Known Vulnerabilities