) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.
Search Results (Refine Search)
- Results Type: Overview
- Keyword (text search): cpe:2.3:a:rubyonrails:rails:3.2.18:*:*:*:*:*:*:*
| Vuln ID | Summary | CVSS Severity |
|---|---|---|
| CVE-2013-6416 |
Cross-site scripting (XSS) vulnerability in the simple_format helper in actionpack/lib/action_view/helpers/text_helper.rb in Ruby on Rails 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML attribute. Published: December 06, 2013; 7:55:03 PM -0500 |
V3.x:(not available) V2.0: 4.3 MEDIUM |
| CVE-2013-6415 |
Cross-site scripting (XSS) vulnerability in the number_to_currency helper in actionpack/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the unit parameter. Published: December 06, 2013; 7:55:03 PM -0500 |
V3.x:(not available) V2.0: 4.3 MEDIUM |
| CVE-2013-6414 |
actionpack/lib/action_view/lookup_context.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to cause a denial of service (memory consumption) via a header containing an invalid MIME type that leads to excessive caching. Published: December 06, 2013; 7:55:03 PM -0500 |
V3.x:(not available) V2.0: 5.0 MEDIUM |
| CVE-2013-4491 |
Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/translation_helper.rb in the internationalization component in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted string that triggers generation of a fallback string by the i18n gem. Published: December 06, 2013; 7:55:03 PM -0500 |
V3.x:(not available) V2.0: 4.3 MEDIUM |