Description

Cross-site scripting (XSS) vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject arbitrary web script or HTML by placing malformed Unicode strings into a form helper.

Remediation

References

CVE-2009-3009

Related Vulnerabilities

GlassFish Observable Discrepancy Vulnerability (CVE-2013-1620)

PHP Out-of-bounds Write Vulnerability (CVE-2016-7126)

Oracle Database Server CVE-2012-0534 Vulnerability (CVE-2012-0534)

WordPress Plugin Advanced Order Export For WooCommerce CSV Injection (1.5.4)

WordPress Plugin Booking Calendar PHP Object Injection (9.1)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-707 CVE-2009-3009