GCVE - cpe:2.3:a:rubyonrails:rails:2.3.14:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:rubyonrails:rails:2.3.14:*:*:*:*:*:*:*

part: a version: 2.3.14 update: *

Vendor	Rubyonrails (`a0962337-0e2d-518c-b84b-f2864721d062`)
Product	Rails (`4bc463b7-a5fc-5e2f-aea1-023dcfc59b73`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:gem/rails`	purl2cpe	2026-06-01 10:11:28.274037
`pkg:github/rails/rails`	purl2cpe	2026-06-01 10:11:28.274039

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2014-3482`	vulnerable	2026-06-08 05:05:32.899387	Details available SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting. Published: 2014-07-07T10:00:00.000Z Updated: 2024-08-06T10:43:06.174Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/68343 http://secunia.com/advisories/59973 http://openwall.com/lists/oss-security/2014/07/02/5 https://groups.google.com/forum/message/raw?msg=rubyonrails-security/wDxePLJGZdI/WP7EasCJTA4J http://secunia.com/advisories/60214	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-0081`	vulnerable	2026-06-08 05:05:11.297167	Details available Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the (1) format, (2) negative_format, or (3) units parameter to the (a) number_to_currency, (b) number_to_percentage, or (c) number_to_human helper. Published: 2014-02-20T11:00:00.000Z Updated: 2024-08-06T09:05:38.984Z Open on db.gcve.eu Reference links http://rhn.redhat.com/errata/RHSA-2014-0215.html http://rhn.redhat.com/errata/RHSA-2014-0306.html http://www.securityfocus.com/bid/65647 http://www.securitytracker.com/id/1029782 http://openwall.com/lists/oss-security/2014/02/18/8	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-3221`	vulnerable	2026-06-08 05:04:30.488113	Details available The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attacks against Ruby on Rails applications via a crafted value, as demonstrated by unintended interaction between the "typed XML" feature and a MySQL database. Published: 2013-04-22T01:00:00.000Z Updated: 2024-08-06T16:00:10.162Z Open on db.gcve.eu Reference links http://pl.reddit.com/r/netsec/comments/17yajp/mysql_madness_and_rails/ https://groups.google.com/group/rubyonrails-security/msg/1f3bc0b88a60c1ce?dmode=source&output=gplain http://www.phenoelit.org/blog/archives/2013/02/index.html http://openwall.com/lists/oss-security/2013/04/24/7 https://gist.github.com/dakull/5442275	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-1857`	vulnerable	2026-06-08 05:03:56.910230	Details available The sanitize helper in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded : (colon) characters in URLs, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted scheme name, as demonstrated by including a : sequence. Published: 2013-03-19T22:00:00.000Z Updated: 2024-08-06T15:20:35.190Z Open on db.gcve.eu Reference links http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html http://lists.opensuse.org/opensuse-updates/2014-01/msg00013.html http://lists.opensuse.org/opensuse-updates/2013-04/msg00073.html http://support.apple.com/kb/HT5784 http://rhn.redhat.com/errata/RHSA-2013-0698.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-1855`	vulnerable	2026-06-08 05:03:56.898141	Details available The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle \n (newline) characters, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences. Published: 2013-03-19T22:00:00.000Z Updated: 2024-08-06T15:20:35.175Z Open on db.gcve.eu Reference links http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html https://groups.google.com/group/rubyonrails-security/msg/8ed835a97cdd1afd?dmode=source&output=gplain http://lists.opensuse.org/opensuse-updates/2014-01/msg00013.html http://lists.opensuse.org/opensuse-updates/2013-04/msg00073.html http://support.apple.com/kb/HT5784	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-1854`	vulnerable	2026-06-08 05:03:56.860964	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-0333`	vulnerable	2026-06-08 05:03:47.096951	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-0277`	vulnerable	2026-06-08 05:03:46.784732	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-0276`	vulnerable	2026-06-08 05:03:46.756967	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.