CVE

Id
40444  
CVE No.
CVE-2009-3009  
Status
Candidate  
Description
Cross-site scripting (XSS) vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject arbitrary web script or HTML by placing malformed Unicode strings into a form helper.  
Phase
Assigned (20090829)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
444376 40444 CVE-2009-3009 MLIST:[rubyonrails-security] 20090904 XSS Vulnerability in Ruby on Rails  View
444377 40444 CVE-2009-3009 URL:http://groups.google.com/group/rubyonrails-security/msg/7f57cd7794e1d1b4?dmode=source  View
444378 40444 CVE-2009-3009 CONFIRM:http://weblog.rubyonrails.org/2009/9/4/xss-vulnerability-in-ruby-on-rails  View
444379 40444 CVE-2009-3009 CONFIRM:http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=545063  View
444380 40444 CVE-2009-3009 CONFIRM:http://support.apple.com/kb/HT4077  View
444381 40444 CVE-2009-3009 APPLE:APPLE-SA-2010-03-29-1  View
444382 40444 CVE-2009-3009 URL:http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html  View
444383 40444 CVE-2009-3009 DEBIAN:DSA-1887  View
444384 40444 CVE-2009-3009 URL:http://www.debian.org/security/2009/dsa-1887  View
444385 40444 CVE-2009-3009 SUSE:SUSE-SR:2009:017  View
444386 40444 CVE-2009-3009 URL:http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html  View
444387 40444 CVE-2009-3009 BID:36278  View
444388 40444 CVE-2009-3009 URL:http://www.securityfocus.com/bid/36278  View
444389 40444 CVE-2009-3009 OSVDB:57666  View
444390 40444 CVE-2009-3009 URL:http://www.osvdb.org/57666  View
444391 40444 CVE-2009-3009 SECTRACK:1022824  View
444392 40444 CVE-2009-3009 URL:http://securitytracker.com/id?1022824  View
444393 40444 CVE-2009-3009 SECUNIA:36600  View
444394 40444 CVE-2009-3009 URL:http://secunia.com/advisories/36600  View
444395 40444 CVE-2009-3009 SECUNIA:36717  View
444396 40444 CVE-2009-3009 URL:http://secunia.com/advisories/36717  View
444397 40444 CVE-2009-3009 VUPEN:ADV-2009-2544  View
444398 40444 CVE-2009-3009 URL:http://www.vupen.com/english/advisories/2009/2544  View
444399 40444 CVE-2009-3009 XF:rubyonrails-unicode-xss(53036)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
41553 JVNDB-2009-002560 Opera における data: URI をブロックしない脆弱性 Opera には、HTTP レスポンス内の Location ヘッダにある data: URI を適切にブロックしないため、クロスサイトスクリプティング攻撃をされる脆弱性が存在します。 CVE-2009-3013 40444 4.3 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002560.html  View