CVE-2014-0081

CVE-2014-0081 affects Ruby on Rails: multiple XSS flaws in actionview/lib/action_view/helpers/number_helper.rb allow remote injection via format, negative_format, or units in number_to_currency, number_to_percentage, and number_to_human. Affected Rails versions: 3.2.x before 3.2.17, 4.0.x before ...

CVE-2014-0082

CVE-2014-0082 affects Ruby on Rails (Action Pack) in Rails 3.x prior to 3.2.17. The vulnerability arises when rendering with the :text option in ActionView::Template, where MIME type strings are converted to symbols, enabling remote attackers to trigger memory consumption DoS. Public details in c...