CVE

Id
48358  
CVE No.
CVE-2011-0446  
Status
Candidate  
Description
Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.  
Phase
Assigned (20110113)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
525132 48358 CVE-2011-0446 MLIST:[rubyonrails-security] 20110209 Potential XSS Problem with mail_to :encode => :javascript  View
525133 48358 CVE-2011-0446 URL:http://groups.google.com/group/rubyonrails-security/msg/365b8a23b76a6b4a?dmode=source&output=gplain  View
525134 48358 CVE-2011-0446 DEBIAN:DSA-2247  View
525135 48358 CVE-2011-0446 URL:http://www.debian.org/security/2011/dsa-2247  View
525136 48358 CVE-2011-0446 FEDORA:FEDORA-2011-2133  View
525137 48358 CVE-2011-0446 URL:http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html  View
525138 48358 CVE-2011-0446 FEDORA:FEDORA-2011-2138  View
525139 48358 CVE-2011-0446 URL:http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html  View
525140 48358 CVE-2011-0446 FEDORA:FEDORA-2011-4358  View
525141 48358 CVE-2011-0446 URL:http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html  View
525142 48358 CVE-2011-0446 BID:46291  View
525143 48358 CVE-2011-0446 URL:http://www.securityfocus.com/bid/46291  View
525144 48358 CVE-2011-0446 SECTRACK:1025064  View
525145 48358 CVE-2011-0446 URL:http://www.securitytracker.com/id?1025064  View
525146 48358 CVE-2011-0446 SECUNIA:43274  View
525147 48358 CVE-2011-0446 URL:http://secunia.com/advisories/43274  View
525148 48358 CVE-2011-0446 SECUNIA:43666  View
525149 48358 CVE-2011-0446 URL:http://secunia.com/advisories/43666  View
525150 48358 CVE-2011-0446 VUPEN:ADV-2011-0587  View
525151 48358 CVE-2011-0446 URL:http://www.vupen.com/english/advisories/2011/0587  View
525152 48358 CVE-2011-0446 VUPEN:ADV-2011-0877  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
30663 JVNDB-2011-000011 EC-CUBE におけるクロスサイトスクリプティングの脆弱性 株式会社ロックオンが提供する EC-CUBE には、クロスサイトスクリプティングの脆弱性が存在します。 CVE-2011-0451 48358 4.3 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-000011.html  View