4.3
CVE-2013-6415
- EPSS 3.17%
- Veröffentlicht 07.12.2013 00:55:03
- Zuletzt bearbeitet 29.04.2026 01:13:23
- Erkennungen
LoginCross-site scripting (XSS) vulnerability in the number_to_currency helper in actionpack/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the unit parameter.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Rubyonrails ≫ Rails Version 3.0.0
Rubyonrails ≫ Rails Version 3.0.0 Update beta
Rubyonrails ≫ Rails Version 3.0.0 Update beta2
Rubyonrails ≫ Rails Version 3.0.0 Update beta3
Rubyonrails ≫ Rails Version 3.0.0 Update beta4
Rubyonrails ≫ Rails Version 3.0.0 Update rc
Rubyonrails ≫ Rails Version 3.0.0 Update rc2
Rubyonrails ≫ Rails Version 3.0.1
Rubyonrails ≫ Rails Version 3.0.1 Update pre
Rubyonrails ≫ Rails Version 3.0.2
Rubyonrails ≫ Rails Version 3.0.2 Update pre
Rubyonrails ≫ Rails Version 3.0.3
Rubyonrails ≫ Rails Version 3.0.4 Update rc1
Rubyonrails ≫ Rails Version 3.0.5
Rubyonrails ≫ Rails Version 3.0.5 Update rc1
Rubyonrails ≫ Rails Version 3.0.6
Rubyonrails ≫ Rails Version 3.0.6 Update rc1
Rubyonrails ≫ Rails Version 3.0.6 Update rc2
Rubyonrails ≫ Rails Version 3.0.7
Rubyonrails ≫ Rails Version 3.0.7 Update rc1
Rubyonrails ≫ Rails Version 3.0.7 Update rc2
Rubyonrails ≫ Rails Version 3.0.8
Rubyonrails ≫ Rails Version 3.0.8 Update rc1
Rubyonrails ≫ Rails Version 3.0.8 Update rc2
Rubyonrails ≫ Rails Version 3.0.8 Update rc3
Rubyonrails ≫ Rails Version 3.0.8 Update rc4
Rubyonrails ≫ Rails Version 3.0.9
Rubyonrails ≫ Rails Version 3.0.9 Update rc1
Rubyonrails ≫ Rails Version 3.0.9 Update rc2
Rubyonrails ≫ Rails Version 3.0.9 Update rc3
Rubyonrails ≫ Rails Version 3.0.9 Update rc4
Rubyonrails ≫ Rails Version 3.0.9 Update rc5
Rubyonrails ≫ Rails Version 3.0.10
Rubyonrails ≫ Rails Version 3.0.10 Update rc1
Rubyonrails ≫ Rails Version 3.0.11
Rubyonrails ≫ Rails Version 3.0.12
Rubyonrails ≫ Rails Version 3.0.12 Update rc1
Rubyonrails ≫ Rails Version 3.0.13
Rubyonrails ≫ Rails Version 3.0.13 Update rc1
Rubyonrails ≫ Rails Version 3.0.14
Rubyonrails ≫ Rails Version 3.0.16
Rubyonrails ≫ Rails Version 3.0.17
Rubyonrails ≫ Rails Version 3.0.18
Rubyonrails ≫ Rails Version 3.0.19
Rubyonrails ≫ Rails Version 3.0.20
Rubyonrails ≫ Rails Version 3.1.0
Rubyonrails ≫ Rails Version 3.1.0 Update beta1
Rubyonrails ≫ Rails Version 3.1.0 Update rc1
Rubyonrails ≫ Rails Version 3.1.0 Update rc2
Rubyonrails ≫ Rails Version 3.1.0 Update rc3
Rubyonrails ≫ Rails Version 3.1.0 Update rc4
Rubyonrails ≫ Rails Version 3.1.0 Update rc5
Rubyonrails ≫ Rails Version 3.1.0 Update rc6
Rubyonrails ≫ Rails Version 3.1.0 Update rc7
Rubyonrails ≫ Rails Version 3.1.0 Update rc8
Rubyonrails ≫ Rails Version 3.1.1
Rubyonrails ≫ Rails Version 3.1.1 Update rc1
Rubyonrails ≫ Rails Version 3.1.1 Update rc2
Rubyonrails ≫ Rails Version 3.1.1 Update rc3
Rubyonrails ≫ Rails Version 3.1.2
Rubyonrails ≫ Rails Version 3.1.2 Update rc1
Rubyonrails ≫ Rails Version 3.1.2 Update rc2
Rubyonrails ≫ Rails Version 3.1.3
Rubyonrails ≫ Rails Version 3.1.4
Rubyonrails ≫ Rails Version 3.1.4 Update rc1
Rubyonrails ≫ Rails Version 3.1.5
Rubyonrails ≫ Rails Version 3.1.5 Update rc1
Rubyonrails ≫ Rails Version 3.1.6
Rubyonrails ≫ Rails Version 3.1.7
Rubyonrails ≫ Rails Version 3.1.8
Rubyonrails ≫ Rails Version 3.1.9
Rubyonrails ≫ Rails Version 3.1.10
Rubyonrails ≫ Rails Version 3.2.0
Rubyonrails ≫ Rails Version 3.2.0 Update rc1
Rubyonrails ≫ Rails Version 3.2.0 Update rc2
Rubyonrails ≫ Rails Version 3.2.1
Rubyonrails ≫ Rails Version 3.2.2
Rubyonrails ≫ Rails Version 3.2.2 Update rc1
Rubyonrails ≫ Rails Version 3.2.3
Rubyonrails ≫ Rails Version 3.2.3 Update rc1
Rubyonrails ≫ Rails Version 3.2.3 Update rc2
Rubyonrails ≫ Rails Version 3.2.4
Rubyonrails ≫ Rails Version 3.2.4 Update rc1
Rubyonrails ≫ Rails Version 3.2.5
Rubyonrails ≫ Rails Version 3.2.6
Rubyonrails ≫ Rails Version 3.2.7
Rubyonrails ≫ Rails Version 3.2.8
Rubyonrails ≫ Rails Version 3.2.9
Rubyonrails ≫ Rails Version 3.2.10
Rubyonrails ≫ Rails Version 3.2.11
Rubyonrails ≫ Rails Version 3.2.12
Rubyonrails ≫ Rails Version 3.2.13
Rubyonrails ≫ Rails Version 3.2.13 Update rc1
Rubyonrails ≫ Rails Version 3.2.13 Update rc2
Rubyonrails ≫ Ruby On Rails Version <= 3.2.15
Rubyonrails ≫ Ruby On Rails Version 3.0.4
Rubyonrails ≫ Ruby On Rails Version 3.1.11
Rubyonrails ≫ Ruby On Rails Version 3.2.14
Rubyonrails ≫ Ruby On Rails Version 3.2.14 Update rc1
Rubyonrails ≫ Ruby On Rails Version 3.2.14 Update rc2
Rubyonrails ≫ Ruby On Rails Version 3.2.15 Update rc1
Rubyonrails ≫ Ruby On Rails Version 3.2.15 Update rc2
Rubyonrails ≫ Rails Update - Version <= 4.0.1
Rubyonrails ≫ Rails Version 4.0.0 Update -
Rubyonrails ≫ Rails Version 4.0.0 Update beta
Rubyonrails ≫ Rails Version 4.0.0 Update rc1
Rubyonrails ≫ Rails Version 4.0.0 Update rc2
Rubyonrails ≫ Rails Version 4.0.1 Update rc1
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 3.17% | 0.864 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 4.3 | 8.6 | 2.9 |
AV:N/AC:M/Au:N/C:N/I:P/A:N
|
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
http://lists.opensuse.org/opensuse-updates/2013-12/msg00079.html
http://lists.opensuse.org/opensuse-updates/2013-12/msg00081.html
http://lists.opensuse.org/opensuse-updates/2013-12/msg00082.html
http://lists.opensuse.org/opensuse-updates/2014-01/msg00003.html
http://rhn.redhat.com/errata/RHSA-2014-1863.html
http://lists.opensuse.org/opensuse-updates/2014-01/msg00013.html
http://www.debian.org/security/2014/dsa-2888
http://rhn.redhat.com/errata/RHSA-2013-1794.html
http://rhn.redhat.com/errata/RHSA-2014-0008.html
http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/
http://lists.opensuse.org/opensuse-updates/2013-12/msg00080.html
http://secunia.com/advisories/56093
http://www.securityfocus.com/bid/64077
https://groups.google.com/forum/message/raw?msg=ruby-security-ann/9WiRn2nhfq0/2K2KRB4LwCMJ
https://puppet.com/security/cve/cve-2013-6415