Chartkick

CVE-2020-16254 Aug 05, 20:15 Ruby MEDIUM POC PATCH This Month

The Chartkick gem through 3.3.2 for Ruby allows Cascading Style Sheets (CSS) Injection (without attribute). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2019-18841 Nov 11, 01:15 LIB HIGH PATCH This Week

Chartkick.js 3.1.0 through 3.1.3, as used in the Chartkick gem before 3.3.0 for Ruby, allows prototype pollution. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2019-12732 Jun 06, 15:29 Ruby MEDIUM POC PATCH This Month

The Chartkick gem through 3.1.0 for Ruby allows XSS. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.