Skip to content
OpenAdvisories
Unscored DSA-2247-1 2 CVEs

rails - several vulnerabilities

Published May 31, 2011 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 2

ReleasePackageFixed in
Debian · 5.0 rails 2.1.0-7+lenny0.1
Debian · 6.0 rails 2.3.5-1.2+squeeze0.1

Vulnerabilities 2

  • Medium —
    CVE-2011-0446

    Rails actionpack gem vulnerable to Cross-site Scripting

    Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email…

    rails actionpack actionview Debian RubyGems
  • Medium —
    CVE-2011-0447

    actionpack Cross-Site Request Forgery vulnerability

    Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via fo…

    rails actionpack Debian RubyGems