NVD

Id
21117  
Name
CVE-2016-6316  
Description
Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-19  
Published
2016-09-07  
Modified Date
2016-11-28  
Seq
2016-6316  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
114981 21117 CVE-2016-6316 RHSA-2016:1855  View
114982 21117 CVE-2016-6316 RHSA-2016:1856  View
114983 21117 CVE-2016-6316 RHSA-2016:1857  View
114984 21117 CVE-2016-6316 RHSA-2016:1858  View
114985 21117 CVE-2016-6316 http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/  View
114986 21117 CVE-2016-6316 DSA-3651  View
114987 21117 CVE-2016-6316 [oss-security] 20160811 [CVE-2016-6316] Possible XSS Vulnerability in Action View  View
114988 21117 CVE-2016-6316 92430  View
114989 21117 CVE-2016-6316 [ruby-security-ann] 20160811 [CVE-2016-6316] Possible XSS Vulnerability in Action View  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
3799 JVNDB-2016-004572 Ruby on Rails の Action View におけるクロスサイトスクリプティングの脆弱性 Ruby on Rails の Action View には、クロスサイトスクリプティングの脆弱性が存在します。 CVE-2016-6316 92823 CVE-2016-6316 21117 4.3 6.1 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-004572.html 2016-08-11 2016-09-09 View