CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2015-7579

Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem 1.0.2 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via an HTML entity that is mishandled by the Rails::Html::FullSanitizer class.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.005

EPSS Ranking 63.2%

CVSS Severity

CVSS v3 Score 6.1

CVSS v2 Score 4.3

References

Products affected by CVE-2015-7579

Rubyonrails » Html Sanitizer » Version: 1.0.0

cpe:2.3:a:rubyonrails:html_sanitizer:1.0.0
Rubyonrails » Html Sanitizer » Version: 1.0.1

cpe:2.3:a:rubyonrails:html_sanitizer:1.0.1
Rubyonrails » Html Sanitizer » Version: 1.0.2

cpe:2.3:a:rubyonrails:html_sanitizer:1.0.2
Rubyonrails » Rails » Version: 4.2.0

cpe:2.3:a:rubyonrails:rails:4.2.0
Rubyonrails » Rails » Version: 4.2.1

cpe:2.3:a:rubyonrails:rails:4.2.1
Rubyonrails » Rails » Version: 4.2.2

cpe:2.3:a:rubyonrails:rails:4.2.2
Rubyonrails » Rails » Version: 4.2.3

cpe:2.3:a:rubyonrails:rails:4.2.3
Rubyonrails » Rails » Version: 4.2.4

cpe:2.3:a:rubyonrails:rails:4.2.4
Rubyonrails » Rails » Version: 4.2.5

cpe:2.3:a:rubyonrails:rails:4.2.5
Rubyonrails » Rails » Version: 4.2.5.1

cpe:2.3:a:rubyonrails:rails:4.2.5.1
Rubyonrails » Rails » Version: 4.2.5.2

cpe:2.3:a:rubyonrails:rails:4.2.5.2
Rubyonrails » Rails » Version: 4.2.6

cpe:2.3:a:rubyonrails:rails:4.2.6
Rubyonrails » Rails » Version: 5.0.0

cpe:2.3:a:rubyonrails:rails:5.0.0

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2015-7579

Products

Pricing

Contact Us