CVE

Id
79117  
CVE No.
CVE-2015-1840  
Status
Candidate  
Description
jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.  
Phase
Assigned (20150217)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
720664 79117 CVE-2015-1840 MLIST:[oss-security] 20150616 [CVE-2015-1840] CSRF Vulnerability in jquery-ujs and jquery-rails  View
720665 79117 CVE-2015-1840 URL:http://openwall.com/lists/oss-security/2015/06/16/15  View
720666 79117 CVE-2015-1840 MLIST:[rubyonrails-security] 20150616 [CVE-2015-1840] CSRF Vulnerability in jquery-ujs and jquery-rails  View
720667 79117 CVE-2015-1840 URL:https://groups.google.com/forum/message/raw?msg=rubyonrails-security/XIZPbobuwaY/fqnzzpuOlA4J  View
720668 79117 CVE-2015-1840 CONFIRM:https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md  View
720669 79117 CVE-2015-1840 CONFIRM:https://github.com/rails/jquery-ujs/blob/master/CHANGELOG.md  View
720670 79117 CVE-2015-1840 FEDORA:FEDORA-2015-10144  View
720671 79117 CVE-2015-1840 URL:http://lists.fedoraproject.org/pipermail/package-announce/2015-June/161043.html  View
720672 79117 CVE-2015-1840 FEDORA:FEDORA-2015-10258  View
720673 79117 CVE-2015-1840 URL:http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160906.html  View
720674 79117 CVE-2015-1840 SUSE:openSUSE-SU-2015:1260  View
720675 79117 CVE-2015-1840 URL:http://lists.opensuse.org/opensuse-updates/2015-07/msg00041.html  View
720676 79117 CVE-2015-1840 BID:75239  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
6728 JVNDB-2015-002048 IBM Security Access Manager for Web のマルチキャスト DNS (mDNS) レスポンダにおけるサービス運用妨害 (DoS) の脆弱性 IBM Security Access Manager for Web のマルチキャスト DNS (mDNS) レスポンダは、リンクローカルでない送信元アドレスを持つユニキャストクエリに誤って応答するため、サービス運用妨害 (トラフィックの増幅) 状態にされる、または重要な情報を取得される脆弱性が存在します。 CVE-2015-1892 79117 5 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-002048.html  View