Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2013-1855
4.3
MEDIUMCVSS v2
Published
March 19, 2013
Affected
2 projects
Assigned by
Red Hat
Severity scale
010
Description
The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle \n (newline) characters, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences.
rails
RubyGemsRuby on Rails is a full-stack web framework optimized for programmer happiness and sustainable productivity. It encourages beautiful code by favoring convention over configuration.
RubyGemsRuby on Rails is a full-stack web framework optimized for programmer happiness and sustainable productivity. It encourages beautiful code by favoring convention over configuration.= 3.2.0, = 3.2.7, = 3.2.8, = 3.2.9, = 3.2.1, = 3.2.5, = 3.2.6, = 3.2.11, = 3.2.10, = 3.2.4, = 3.2.3, = 3.2.2, = 3.2.12, = 1.2.4, = 0.9.3, = 0.9.4, = 0.9.4.1, = 0.14.2, = 0.10.0, = 0.11.0, = 0.9.2, = 0.13.0, = 0.14.1, = 0.12.0, = 0.11.1, = 0.9.1, = 0.12.1, = 0.13.1, = 0.10.1, = 2.3.11, = 2.2.0, = 2.2.1, = 2.1.1, = 2.1.2, = 1.2.2, = 1.2.1, = 1.2.0, = 1.1.6, = 0.14.4, = 0.14.3, = 2.3.12, = 2.3.9, = 2.3.4, = 2.0.4, = 1.2.5, = 1.2.3, = 1.1.5, = 1.1.3, = 2.3.3, = 2.3.2, = 2.3.0, = 2.0.1, = 1.9.5, = 1.1.1, = 1.1.0, = 1.0.0, = 2.3.10, = 2.3.13, = 2.3.1, = 2.2.2, = 2.1.0, = 2.0.2, = 1.2.6, = 1.1.4, = 1.1.2, = 2.3.14, = 2.3.16, = 2.3.15, = 2.0.0, = 3.0.0, = 3.0.1, = 3.0.2, = 3.0.4, = 3.0.13, = 3.0.12, = 3.0.20, = 3.0.19, = 3.0.16, = 3.0.17, = 3.0.3, = 3.0.14, = 3.0.10, = 3.0.18, = 3.0.11, = 3.0.7, = 3.0.9, = 3.0.5, = 3.0.8, = 3.0.6, = 3.1.0, = 3.1.2, = 3.1.3, = 3.1.1, = 3.1.8, = 3.1.6, = 3.1.4, = 3.1.5, = 3.1.7, = 3.1.9, = 3.1.10NVD
rails/rails
GitHubRuby on Rails
GitHubRuby on Rails