The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a ' (quote) character.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade rails | Jul 30, 2024 | Aug 10, 2012 |
| Freebsd | — | Upgrade rubygem-actionpackUpgrade rubygem-activesupportUpgrade rubygem-rails | Dec 10, 2025 | Aug 10, 2012 |
| Ruby_on_rails | — | Upgrade to the latest version of Ruby on Rails | Jan 3, 2020 | Aug 10, 2012 |
| Suse | — | Upgrade rubygem-activesupport-2_3Upgrade rubygem-actionpack-3_2Upgrade rubygem-actionpack-2_3 | Dec 12, 2013 | Jun 28, 2013 |
| Ubuntu | — | Upgrade ruby-activesupport-3.2 | Nov 19, 2024 | Aug 10, 2012 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub