CVE-2012-3465

CVE-2012-3465 affects Ruby on Rails (Action Pack) via action_view/sanitize_helper.rb strip_tags. Vulnerable in Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8; malformed HTML markup can allow remote XSS via the strip_tags path. The issue is an XSS in the Rails sanitization flow an...

CVE-2012-3464

Cross-site scripting XSS vulnerability in activesupport/lib/activesupport/coreext/string/outputsafety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a ' quote character...

CVE-2012-3463

Cross-site scripting XSS vulnerability in actionpack/lib/actionview/helpers/formtaghelper.rb in Ruby on Rails 3.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via the prompt field to the selecttag helper...

CVE-2012-3464

CVE-2012-3464 is a cross-site scripting (XSS) vulnerability in Rails where activesupport/lib/active_support/core_ext/string/output_safety.rb permits remote injection via a single quote character. Affected Rails versions are 3.0.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8. The impa...

CVE-2012-3463

Cross-site scripting XSS vulnerability in actionpack/lib/actionview/helpers/formtaghelper.rb in Ruby on Rails 3.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via the prompt field to the selecttag helper...

CVE-2012-3465

Cross-site scripting XSS vulnerability in actionpack/lib/actionview/helpers/sanitizehelper.rb in the striptags helper in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via malformed HTML markup...

CVE-2012-3463: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in actionpack/lib/actionview/helpers/formtaghelper.rb in Ruby on Rails 3.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via the prompt field to the selecttag helper...

PT-2012-4734

Name of the Vulnerable Software and Affected Versions Ruby on Rails versions prior to 2.3.16 Ruby on Rails versions 3.0.x through 3.0.16 Ruby on Rails versions 3.1.x through 3.1.7 Ruby on Rails versions 3.2.x through 3.2.7 Description A cross-site scripting XSS issue might allow remote attackers ...

CVE-2012-3464: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in activesupport/lib/activesupport/coreext/string/outputsafety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a ' quote character...

PT-2012-4733

Name of the Vulnerable Software and Affected Versions Ruby on Rails versions 3.0.0 through 3.0.16 Ruby on Rails versions 3.1.0 through 3.1.7 Ruby on Rails versions 3.2.0 through 3.2.7 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via t...

PT-2012-4735

Name of the Vulnerable Software and Affected Versions Ruby on Rails versions prior to 2.3.16 Ruby on Rails versions 3.0.x through 3.0.16 Ruby on Rails versions 3.1.x through 3.1.7 Ruby on Rails versions 3.2.x through 3.2.7 Description A cross-site scripting XSS issue exists in the strip tags help...

Ruby on Rails Potential XSS Vulnerability in select_tag prompt

When a value for the prompt field is supplied to the selecttag helper, the value is not escaped. If untrusted data is not escaped, and is supplied as the prompt value, there is a potential for XSS attacks...

Potential XSS Vulnerability in Ruby on Rails

The HTML escaping code in Ruby on Rails does not escape all potentially dangerous characters. In particular the code does not escape the single quote character. The helpers used in Rails itself never use single quotes, so most applications are unlikely to be vulnerable, however all users running ...

CVE-2012-3465: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in actionpack/lib/actionview/helpers/sanitizehelper.rb in the striptags helper in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via malformed HTML markup...

CVE-2012-3464 rubygem-actionpack: potential XSS vulnerability

Cross-site scripting XSS vulnerability in activesupport/lib/activesupport/coreext/string/outputsafety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a ' quote character...

CVE-2012-3463 rubygem-actionpack: potential XSS vulnerability in select_tag prompt

Cross-site scripting XSS vulnerability in actionpack/lib/actionview/helpers/formtaghelper.rb in Ruby on Rails 3.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via the prompt field to the selecttag helper...

CVE-2012-3424

The decodecredentials method in actionpack/lib/actioncontroller/metal/httpauthentication.rb in Ruby on Rails 3.x before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7 converts Digest Authentication strings to symbols, which allows remote attackers to cause a denial of service by leveraging...

CVE-2012-3424

The decodecredentials method in actionpack/lib/actioncontroller/metal/httpauthentication.rb in Ruby on Rails 3.x before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7 converts Digest Authentication strings to symbols, which allows remote attackers to cause a denial of service by leveraging...

CVE-2012-3424

The decodecredentials method in actionpack/lib/actioncontroller/metal/httpauthentication.rb in Ruby on Rails 3.x before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7 converts Digest Authentication strings to symbols, which allows remote attackers to cause a denial of service by leveraging...

CVE-2012-3424

The vulnerability CVE-2012-3424 affects Ruby on Rails Action Pack HTTP Digest authentication. The decode_credentials path in action_controller/metal/http_authentication.rb converts Digest strings to Ruby symbols, enabling a remote attacker who can access an app using with_http_digest/authenticate...