Lucene search
GoogleOSV:GHSA-VXVP-4XWC-JPP6HistoryOct 24, 2017 - 6:33 p.m.
activesupport Cross-site Scripting vulnerability
2017-10-2418:33:36
Google
osv.dev
11
0.003 Low
EPSS
Percentile
65.6%
Cross-site scripting (XSS) vulnerability in json/encoding.rb in Active Support in Ruby on Rails 3.x and 4.1.x before 4.1.11 and 4.2.x before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted Hash that is mishandled during JSON encoding.
References
openwall.com/lists/oss-security/2015/06/16/17
www.debian.org/security/2016/dsa-3464
groups.google.com/forum/message/raw?msg=rubyonrails-security/7VlB_pck3hU/3QZrGIaQW6cJ
nvd.nist.gov/vuln/detail/CVE-2015-3226
web.archive.org/web/20200228033946/www.securityfocus.com/bid/75231
web.archive.org/web/20200517005133/www.securitytracker.com/id/1033755
Related
ubuntucve
ubuntucve
CVE-2015-3226
2015-07-26 00:00:00
cvelist
cvelist
CVE-2015-3226
2015-07-26 22:00:00
gitlab
gitlab
XSS Vulnerability in ActiveSupport::JSON.encode
2015-07-26 00:00:00
github
github
activesupport Cross-site Scripting vulnerability
2017-10-24 18:33:36
ibm
ibm
openvas
openvas
Ruby on Rails Active Support Cross Site Scripting Vulnerability - Windows
2016-10-13 00:00:00
Ruby on Rails Active Support Cross Site Scripting Vulnerability - Linux
2016-10-13 00:00:00
Fedora Update for rubygem-activesupport FEDORA-2015-10538
2015-07-07 00:00:00
cve
cve
CVE-2015-3226
2015-07-26 22:59:05
debiancve
debiancve
CVE-2015-3226
2015-07-26 22:59:05
hackerone
hackerone
Ruby on Rails: JSON keys are not properly escaped
2015-02-10 01:00:04
prion
prion
Cross site scripting
2015-07-26 22:59:00
nvd
nvd
CVE-2015-3226
2015-07-26 22:59:05
fedora
fedora
[SECURITY] Fedora 22 Update: rubygem-activesupport-4.2.0-2.fc22
2015-06-30 20:18:47
[SECURITY] Fedora 21 Update: rubygem-activesupport-4.1.5-2.fc21
2015-06-30 20:19:18
nessus
nessus
Fedora 22 : rubygem-activesupport-4.2.0-2.fc22 (2015-10538)
2015-07-01 00:00:00
Fedora 21 : rubygem-activesupport-4.1.5-2.fc21 (2015-10545)
2015-07-01 00:00:00
freebsd
freebsd
rubygem-rails -- multiple vulnerabilities
2015-06-16 00:00:00
debian
debian
[SECURITY] [DSA 3464-1] rails security update
2016-01-31 18:43:51