Most recent entries from all

certa-2013-avi-193 — De multiples vulnérabilités ont été corrigées dans Ruby on Rails. Elles permettent à un att…

certa-2013-avi-193

EUVD-2026-105689

fkie_cve-2013-1857

The sanitize helper in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded : (colon) characters in URLs, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted scheme name, as demonstrated by including a : sequence.

GHSA-j838-vfpq-fmf2 — actionpack Cross-site Scripting vulnerability

Affected: RubyGems: actionpack

The sanitize helper in `lib/action_controller/vendor/html-scanner/html/sanitizer.rb` in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded `:` (colon) characters in URLs, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted scheme name, as demonstrated by including a `:` sequence.

gsd-2013-1857

RHSA-2013:0698 — Red Hat Security Advisory: rubygem-actionpack and ruby193-rubygem-actionpack security update

rubygem-actionpack: css_sanitization: XSS vulnerability in sanitize_css rubygem-actionpack: sanitize_protocol: XSS Vulnerability in the helper of Ruby on Rails