emberjs ember.js vulnerabilities

Latest emberjs ember.js CVEs

Newest publication first

1. CVE-2013-4170 Ember.js Potential XSS Exploit When Binding `tagName` to User-Supplied Data

   Published 2022-06-30

   Medium·CVSS 6.1 EPSS 0.94% PoC

   In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, the tagName property of an Ember.View was inserted into such a string without being sanitized. This means that if an application assigns a view...

2. CVE-2014-0014 ember-source Cross-site Scripting vulnerability

   Published 2018-02-15

   Medium·CVSS 5.4 EPSS 1.2% PoC

   Ember.js 1.0.x before 1.0.1, 1.1.x before 1.1.3, 1.2.x before 1.2.1, 1.3.x before 1.3.1, and 1.4.x before 1.4.0-beta.2 allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging an application using the "{{group}}" Helper and a crafted payload.

3. CVE-2014-0013 Ember.js Cross-site Scripting vulnerability

   Published 2018-02-15

   Medium·CVSS 5.4 EPSS 0.67%

   Ember.js 1.0.x before 1.0.1, 1.1.x before 1.1.3, 1.2.x before 1.2.1, 1.3.x before 1.3.1, and 1.4.x before 1.4.0-beta.2 allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging an application that contains templates whose context is set to a user-supplie...

4. CVE-2015-1866 ember-source vulnerable to Cross-site Scripting

   Published 2017-09-20

   Medium·CVSS 6.1 EPSS 1.1% PoC

   Cross-site scripting (XSS) vulnerability in Ember.js 1.10.x before 1.10.1 and 1.11.x before 1.11.2.

5. CVE-2015-7565 ember-source Cross-site Scripting vulnerability

   Published 2017-04-13

   Medium·CVSS 6.1 EPSS 0.82% PoC

   Cross-site scripting (XSS) vulnerability in Ember.js 1.8.x through 1.10.x, 1.11.x before 1.11.4, 1.12.x before 1.12.2, 1.13.x before 1.13.12, 2.0.x before 2.0.3, 2.1.x before 2.1.2, and 2.2.x before 2.2.1 allows remote attackers to inject arbitrary web script or HTML.

6. CVE-2014-0046 ember-source Cross-site Scripting vulnerability

   Published 2014-02-27

   Low·CVSS 2.6 EPSS 1.5%

   Cross-site scripting (XSS) vulnerability in the link-to helper in Ember.js 1.2.x before 1.2.2, 1.3.x before 1.3.2, and 1.4.x before 1.4.0-beta.6, when used in non-block form, allows remote attackers to inject arbitrary web script or HTML via the title attribute.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.