NVD

Id
41473  
Name
CVE-2013-6415  
Description
Cross-site scripting (XSS) vulnerability in the number_to_currency helper in actionpack/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the unit parameter.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-18  
Published
2013-12-06  
Modified Date
2016-12-30  
Seq
2013-6415  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
209533 41473 CVE-2013-6415 openSUSE-SU-2013:1904  View
209534 41473 CVE-2013-6415 openSUSE-SU-2013:1905  View
209535 41473 CVE-2013-6415 openSUSE-SU-2013:1906  View
209536 41473 CVE-2013-6415 openSUSE-SU-2013:1907  View
209537 41473 CVE-2013-6415 openSUSE-SU-2014:0009  View
209538 41473 CVE-2013-6415 openSUSE-SU-2014:0019  View
209539 41473 CVE-2013-6415 RHSA-2013:1794  View
209540 41473 CVE-2013-6415 RHSA-2014:0008  View
209541 41473 CVE-2013-6415 RHSA-2014:1863  View
209542 41473 CVE-2013-6415 http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/  View
209543 41473 CVE-2013-6415 DSA-2888  View
209544 41473 CVE-2013-6415 64077  View
209545 41473 CVE-2013-6415 [ruby-security-ann] 20131203 [CVE-2013-6415] XSS Vulnerability in number_to_currency  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
23794 JVNDB-2013-005369 Ruby on Rails の actionpack/lib/action_view/helpers/number_helper.rb におけるクロスサイトスクリプティングの脆弱性 Ruby on Rails の actionpack/lib/action_view/helpers/number_helper.rb の number_to_currency ヘルパーには、クロスサイトスクリプティングの脆弱性が存在します。 CVE-2013-6415 66357 CVE-2013-6415 41473 4.3 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-005369.html 2013-12-03 2014-12-18 View