GCVE - cpe:2.3:a:rubyonrails:rails:0.12.1:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:rubyonrails:rails:0.12.1:*:*:*:*:*:*:*

part: a version: 0.12.1 update: *

Vendor	Rubyonrails (`a0962337-0e2d-518c-b84b-f2864721d062`)
Product	Rails (`4bc463b7-a5fc-5e2f-aea1-023dcfc59b73`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:gem/rails`	purl2cpe	2026-06-01 10:11:28.273865
`pkg:github/rails/rails`	purl2cpe	2026-06-01 10:11:28.273866

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2014-0081`	vulnerable	2026-06-08 05:05:11.272766	Details available Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the (1) format, (2) negative_format, or (3) units parameter to the (a) number_to_currency, (b) number_to_percentage, or (c) number_to_human helper. Published: 2014-02-20T11:00:00.000Z Updated: 2024-08-06T09:05:38.984Z Open on db.gcve.eu Reference links http://rhn.redhat.com/errata/RHSA-2014-0215.html http://rhn.redhat.com/errata/RHSA-2014-0306.html http://www.securityfocus.com/bid/65647 http://www.securitytracker.com/id/1029782 http://openwall.com/lists/oss-security/2014/02/18/8	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-1857`	vulnerable	2026-06-08 05:03:56.909483	Details available The sanitize helper in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded : (colon) characters in URLs, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted scheme name, as demonstrated by including a : sequence. Published: 2013-03-19T22:00:00.000Z Updated: 2024-08-06T15:20:35.190Z Open on db.gcve.eu Reference links http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html http://lists.opensuse.org/opensuse-updates/2014-01/msg00013.html http://lists.opensuse.org/opensuse-updates/2013-04/msg00073.html http://support.apple.com/kb/HT5784 http://rhn.redhat.com/errata/RHSA-2013-0698.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-1855`	vulnerable	2026-06-08 05:03:56.880051	Details available The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle \n (newline) characters, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences. Published: 2013-03-19T22:00:00.000Z Updated: 2024-08-06T15:20:35.175Z Open on db.gcve.eu Reference links http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html https://groups.google.com/group/rubyonrails-security/msg/8ed835a97cdd1afd?dmode=source&output=gplain http://lists.opensuse.org/opensuse-updates/2014-01/msg00013.html http://lists.opensuse.org/opensuse-updates/2013-04/msg00073.html http://support.apple.com/kb/HT5784	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-3465`	vulnerable	2026-06-08 05:02:10.056494	Details available Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/sanitize_helper.rb in the strip_tags helper in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via malformed HTML markup. Published: 2012-08-10T10:00:00.000Z Updated: 2024-08-06T20:05:12.646Z Open on db.gcve.eu Reference links http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/ http://secunia.com/advisories/50694 http://rhn.redhat.com/errata/RHSA-2013-0154.html https://groups.google.com/group/rubyonrails-security/msg/7fbb5392d4d282b5?dmode=source&output=gplain	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-3464`	vulnerable	2026-06-08 05:02:10.022687	Details available Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a ' (quote) character. Published: 2012-08-10T10:00:00.000Z Updated: 2024-08-06T20:05:12.658Z Open on db.gcve.eu Reference links http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/ http://secunia.com/advisories/50694 http://rhn.redhat.com/errata/RHSA-2013-0154.html https://groups.google.com/group/rubyonrails-security/msg/8f1bbe1cef8c6caf?dmode=source&output=gplain	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-4214`	vulnerable	2026-06-08 04:51:47.619189	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-5189`	vulnerable	2026-06-08 04:50:50.089658	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-4094`	vulnerable	2026-06-08 04:50:37.742292	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2007-6077`	not_vulnerable	2026-06-08 04:50:07.617813	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-4111`	vulnerable	2026-06-08 04:49:10.969784	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.