4.3

CVE-2014-0081

Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the (1) format, (2) negative_format, or (3) units parameter to the (a) number_to_currency, (b) number_to_percentage, or (c) number_to_human helper.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Rubyonrails ≫ Rails Version 0.9.1
Rubyonrails ≫ Rails Version 0.9.2
Rubyonrails ≫ Rails Version 0.9.3
Rubyonrails ≫ Rails Version 0.9.4
Rubyonrails ≫ Rails Version 0.9.4.1
Rubyonrails ≫ Rails Version 0.10.0
Rubyonrails ≫ Rails Version 0.10.1
Rubyonrails ≫ Rails Version 0.11.0
Rubyonrails ≫ Rails Version 0.11.1
Rubyonrails ≫ Rails Version 0.12.0
Rubyonrails ≫ Rails Version 0.12.1
Rubyonrails ≫ Rails Version 0.13.0
Rubyonrails ≫ Rails Version 0.13.1
Rubyonrails ≫ Rails Version 0.14.1
Rubyonrails ≫ Rails Version 0.14.2
Rubyonrails ≫ Rails Version 0.14.3
Rubyonrails ≫ Rails Version 0.14.4
Rubyonrails ≫ Rails Version 1.0.0
Rubyonrails ≫ Rails Version 1.1.0
Rubyonrails ≫ Rails Version 1.1.1
Rubyonrails ≫ Rails Version 1.1.2
Rubyonrails ≫ Rails Version 1.1.3
Rubyonrails ≫ Rails Version 1.1.4
Rubyonrails ≫ Rails Version 1.1.5
Rubyonrails ≫ Rails Version 1.1.6
Rubyonrails ≫ Rails Version 1.2.0
Rubyonrails ≫ Rails Version 1.2.1
Rubyonrails ≫ Rails Version 1.2.2
Rubyonrails ≫ Rails Version 1.2.3
Rubyonrails ≫ Rails Version 1.2.4
Rubyonrails ≫ Rails Version 1.2.5
Rubyonrails ≫ Rails Version 1.2.6
Rubyonrails ≫ Rails Version 1.9.5
Rubyonrails ≫ Rails Version 2.0.0
Rubyonrails ≫ Rails Version 2.0.0 Update rc1
Rubyonrails ≫ Rails Version 2.0.0 Update rc2
Rubyonrails ≫ Rails Version 2.0.1
Rubyonrails ≫ Rails Version 2.0.2
Rubyonrails ≫ Rails Version 2.0.4
Rubyonrails ≫ Rails Version 2.1.0
Rubyonrails ≫ Rails Version 2.1.1
Rubyonrails ≫ Rails Version 2.1.2
Rubyonrails ≫ Rails Version 2.2.0
Rubyonrails ≫ Rails Version 2.2.1
Rubyonrails ≫ Rails Version 2.2.2
Rubyonrails ≫ Rails Version 2.3.0
Rubyonrails ≫ Rails Version 2.3.1
Rubyonrails ≫ Rails Version 2.3.2
Rubyonrails ≫ Rails Version 2.3.3
Rubyonrails ≫ Rails Version 2.3.4
Rubyonrails ≫ Rails Version 2.3.9
Rubyonrails ≫ Rails Version 2.3.10
Rubyonrails ≫ Rails Version 2.3.11
Rubyonrails ≫ Rails Version 2.3.12
Rubyonrails ≫ Rails Version 2.3.13
Rubyonrails ≫ Rails Version 2.3.14
Rubyonrails ≫ Rails Version 2.3.15
Rubyonrails ≫ Rails Version 2.3.16
Rubyonrails ≫ Rails Version 3.0.0
Rubyonrails ≫ Rails Version 3.0.0 Update beta
Rubyonrails ≫ Rails Version 3.0.0 Update beta2
Rubyonrails ≫ Rails Version 3.0.0 Update beta3
Rubyonrails ≫ Rails Version 3.0.0 Update beta4
Rubyonrails ≫ Rails Version 3.0.0 Update rc
Rubyonrails ≫ Rails Version 3.0.0 Update rc2
Rubyonrails ≫ Rails Version 3.0.1
Rubyonrails ≫ Rails Version 3.0.1 Update pre
Rubyonrails ≫ Rails Version 3.0.2
Rubyonrails ≫ Rails Version 3.0.2 Update pre
Rubyonrails ≫ Rails Version 3.0.3
Rubyonrails ≫ Rails Version 3.0.4 Update rc1
Rubyonrails ≫ Rails Version 3.0.5
Rubyonrails ≫ Rails Version 3.0.5 Update rc1
Rubyonrails ≫ Rails Version 3.0.6
Rubyonrails ≫ Rails Version 3.0.6 Update rc1
Rubyonrails ≫ Rails Version 3.0.6 Update rc2
Rubyonrails ≫ Rails Version 3.0.7
Rubyonrails ≫ Rails Version 3.0.7 Update rc1
Rubyonrails ≫ Rails Version 3.0.7 Update rc2
Rubyonrails ≫ Rails Version 3.0.8
Rubyonrails ≫ Rails Version 3.0.8 Update rc1
Rubyonrails ≫ Rails Version 3.0.8 Update rc2
Rubyonrails ≫ Rails Version 3.0.8 Update rc3
Rubyonrails ≫ Rails Version 3.0.8 Update rc4
Rubyonrails ≫ Rails Version 3.0.9
Rubyonrails ≫ Rails Version 3.0.9 Update rc1
Rubyonrails ≫ Rails Version 3.0.9 Update rc2
Rubyonrails ≫ Rails Version 3.0.9 Update rc3
Rubyonrails ≫ Rails Version 3.0.9 Update rc4
Rubyonrails ≫ Rails Version 3.0.9 Update rc5
Rubyonrails ≫ Rails Version 3.0.10
Rubyonrails ≫ Rails Version 3.0.10 Update rc1
Rubyonrails ≫ Rails Version 3.0.11
Rubyonrails ≫ Rails Version 3.0.12
Rubyonrails ≫ Rails Version 3.0.12 Update rc1
Rubyonrails ≫ Rails Version 3.0.13
Rubyonrails ≫ Rails Version 3.0.13 Update rc1
Rubyonrails ≫ Rails Version 3.0.14
Rubyonrails ≫ Rails Version 3.0.16
Rubyonrails ≫ Rails Version 3.0.17
Rubyonrails ≫ Rails Version 3.0.18
Rubyonrails ≫ Rails Version 3.0.19
Rubyonrails ≫ Rails Version 3.0.20
Rubyonrails ≫ Rails Version 3.1.0
Rubyonrails ≫ Rails Version 3.1.0 Update beta1
Rubyonrails ≫ Rails Version 3.1.0 Update rc1
Rubyonrails ≫ Rails Version 3.1.0 Update rc2
Rubyonrails ≫ Rails Version 3.1.0 Update rc3
Rubyonrails ≫ Rails Version 3.1.0 Update rc4
Rubyonrails ≫ Rails Version 3.1.0 Update rc5
Rubyonrails ≫ Rails Version 3.1.0 Update rc6
Rubyonrails ≫ Rails Version 3.1.0 Update rc7
Rubyonrails ≫ Rails Version 3.1.0 Update rc8
Rubyonrails ≫ Rails Version 3.1.1
Rubyonrails ≫ Rails Version 3.1.1 Update rc1
Rubyonrails ≫ Rails Version 3.1.1 Update rc2
Rubyonrails ≫ Rails Version 3.1.1 Update rc3
Rubyonrails ≫ Rails Version 3.1.2
Rubyonrails ≫ Rails Version 3.1.2 Update rc1
Rubyonrails ≫ Rails Version 3.1.2 Update rc2
Rubyonrails ≫ Rails Version 3.1.3
Rubyonrails ≫ Rails Version 3.1.4
Rubyonrails ≫ Rails Version 3.1.4 Update rc1
Rubyonrails ≫ Rails Version 3.1.5
Rubyonrails ≫ Rails Version 3.1.5 Update rc1
Rubyonrails ≫ Rails Version 3.1.6
Rubyonrails ≫ Rails Version 3.1.7
Rubyonrails ≫ Rails Version 3.1.8
Rubyonrails ≫ Rails Version 3.1.9
Rubyonrails ≫ Rails Version 3.1.10
Rubyonrails ≫ Rails Version 3.2.0
Rubyonrails ≫ Rails Version 3.2.0 Update rc1
Rubyonrails ≫ Rails Version 3.2.0 Update rc2
Rubyonrails ≫ Rails Version 3.2.1
Rubyonrails ≫ Rails Version 3.2.2
Rubyonrails ≫ Rails Version 3.2.2 Update rc1
Rubyonrails ≫ Rails Version 3.2.3
Rubyonrails ≫ Rails Version 3.2.3 Update rc1
Rubyonrails ≫ Rails Version 3.2.3 Update rc2
Rubyonrails ≫ Rails Version 3.2.4
Rubyonrails ≫ Rails Version 3.2.4 Update rc1
Rubyonrails ≫ Rails Version 3.2.5
Rubyonrails ≫ Rails Version 3.2.6
Rubyonrails ≫ Rails Version 3.2.7
Rubyonrails ≫ Rails Version 3.2.8
Rubyonrails ≫ Rails Version 3.2.9
Rubyonrails ≫ Rails Version 3.2.10
Rubyonrails ≫ Rails Version 3.2.11
Rubyonrails ≫ Rails Version 3.2.12
Rubyonrails ≫ Rails Version 3.2.13
Rubyonrails ≫ Rails Version 3.2.13 Update rc1
Rubyonrails ≫ Rails Version 3.2.13 Update rc2
Rubyonrails ≫ Rails Version 3.2.15
Rubyonrails ≫ Rails Version 3.2.15 Update rc3
Rubyonrails ≫ Rails Version 4.0.0 Update -
Rubyonrails ≫ Rails Version 4.0.0 Update beta
Rubyonrails ≫ Rails Version 4.0.0 Update rc1
Rubyonrails ≫ Rails Version 4.0.0 Update rc2
Rubyonrails ≫ Rails Version 4.0.1 Update -
Rubyonrails ≫ Rails Version 4.0.1 Update rc1
Rubyonrails ≫ Rails Version 4.0.1 Update rc2
Rubyonrails ≫ Rails Version 4.0.1 Update rc3
Rubyonrails ≫ Rails Version 4.0.1 Update rc4
Rubyonrails ≫ Rails Version 4.0.2
Rubyonrails ≫ Rails Version 4.1.0 Update beta1
Rubyonrails ≫ Ruby On Rails Version <= 3.2.16
Rubyonrails ≫ Ruby On Rails Version 0.5.0
Rubyonrails ≫ Ruby On Rails Version 0.5.5
Rubyonrails ≫ Ruby On Rails Version 0.5.6
Rubyonrails ≫ Ruby On Rails Version 0.5.7
Rubyonrails ≫ Ruby On Rails Version 0.6.0
Rubyonrails ≫ Ruby On Rails Version 0.6.5
Rubyonrails ≫ Ruby On Rails Version 0.7.0
Rubyonrails ≫ Ruby On Rails Version 0.8.0
Rubyonrails ≫ Ruby On Rails Version 0.8.5
Rubyonrails ≫ Ruby On Rails Version 0.9.0
Rubyonrails ≫ Ruby On Rails Version 3.0.4
Rubyonrails ≫ Ruby On Rails Version 3.2.14
Rubyonrails ≫ Ruby On Rails Version 3.2.14 Update rc1
Rubyonrails ≫ Ruby On Rails Version 3.2.14 Update rc2
Rubyonrails ≫ Ruby On Rails Version 3.2.15 Update rc1
Rubyonrails ≫ Ruby On Rails Version 3.2.15 Update rc2
Opensuse ≫ Opensuse Version 13.1
Opensuse Project ≫ Opensuse Version 12.3
Redhat ≫ Cloudforms Version 3.0
Redhat ≫ Enterprise Linux Version 6.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.03% 0.893
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://rhn.redhat.com/errata/RHSA-2014-0215.html
Third Party Advisory
http://secunia.com/advisories/57376
Permissions Required
http://lists.opensuse.org/opensuse-updates/2014-02/msg00081.html
Third Party Advisory
http://openwall.com/lists/oss-security/2014/02/18/8
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-0306.html
Third Party Advisory
http://www.securityfocus.com/bid/65647
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1029782
Third Party Advisory
VDB Entry
https://groups.google.com/forum/message/raw?msg=rubyonrails-security/tfp6gZCtzr4/j8LUHmu7fIEJ
Third Party Advisory