{"url":"http://public2.vulnerablecode.io/api/packages/51662?format=json","purl":"pkg:gem/rails@3.0.0","type":"gem","namespace":"","name":"rails","version":"3.0.0","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"3.0.1","latest_non_vulnerable_version":"7.1.3.1","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/39070?format=json","vulnerability_id":"VCID-8n6u-hbhg-7qdx","summary":"Improper Input Validation\nRuby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs.","references":[{"reference_url":"http://secunia.com/advisories/41930","reference_id":"","reference_type":"","scores":[],"url":"http://secunia.com/advisories/41930"},{"reference_url":"http://securitytracker.com/id?1024624","reference_id":"","reference_type":"","scores":[],"url":"http://securitytracker.com/id?1024624"},{"reference_url":"https://github.com/rails/rails/commit/2d96bccb1e8b62e3e11ca0c5d38aaa8cece889ae","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/rails/rails/commit/2d96bccb1e8b62e3e11ca0c5d38aaa8cece889ae"},{"reference_url":"https://github.com/rails/rails/commit/96183e0f284bab27667e5a38fa6a1578eb029585","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/rails/rails/commit/96183e0f284bab27667e5a38fa6a1578eb029585"},{"reference_url":"https://web.archive.org/web/20101129225633/http://securitytracker.com/alerts/2010/Oct/1024624.html","reference_id":"","reference_type":"","scores":[],"url":"https://web.archive.org/web/20101129225633/http://securitytracker.com/alerts/2010/Oct/1024624.html"},{"reference_url":"https://web.archive.org/web/20111225083933/http://secunia.com/advisories/41930","reference_id":"","reference_type":"","scores":[],"url":"https://web.archive.org/web/20111225083933/http://secunia.com/advisories/41930"},{"reference_url":"https://web.archive.org/web/20201208053819/http://securitytracker.com/id?1024624","reference_id":"","reference_type":"","scores":[],"url":"https://web.archive.org/web/20201208053819/http://securitytracker.com/id?1024624"},{"reference_url":"http://weblog.rubyonrails.org/2010/10/15/security-vulnerability-in-nested-attributes-code-in-ruby-on-rails-2-3-9-and-3-0-0","reference_id":"","reference_type":"","scores":[],"url":"http://weblog.rubyonrails.org/2010/10/15/security-vulnerability-in-nested-attributes-code-in-ruby-on-rails-2-3-9-and-3-0-0"},{"reference_url":"http://www.vupen.com/english/advisories/2010/2719","reference_id":"","reference_type":"","scores":[],"url":"http://www.vupen.com/english/advisories/2010/2719"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2010-3933","reference_id":"CVE-2010-3933","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-3933"},{"reference_url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2010-3933.yml","reference_id":"CVE-2010-3933.YML","reference_type":"","scores":[],"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2010-3933.yml"},{"reference_url":"https://github.com/advisories/GHSA-gjxw-5w2q-7grf","reference_id":"GHSA-gjxw-5w2q-7grf","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-gjxw-5w2q-7grf"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/54499?format=json","purl":"pkg:gem/rails@3.0.1","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/rails@3.0.1"}],"aliases":["CVE-2010-3933","GHSA-gjxw-5w2q-7grf"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-8n6u-hbhg-7qdx"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/39089?format=json","vulnerability_id":"VCID-bcwq-ngna-fqhd","summary":"Cross-Site Request Forgery (CSRF)\nRuby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged (1) AJAX or (2) API requests that leverage \"combinations of browser plugins and HTTP redirects,\" a related issue to CVE-2011-0696.","references":[{"reference_url":"http://groups.google.com/group/rubyonrails-security/msg/c22ea1668c0d181c?dmode=source&output=gplain","reference_id":"","reference_type":"","scores":[],"url":"http://groups.google.com/group/rubyonrails-security/msg/c22ea1668c0d181c?dmode=source&output=gplain"},{"reference_url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html","reference_id":"","reference_type":"","scores":[],"url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html"},{"reference_url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html","reference_id":"","reference_type":"","scores":[],"url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html"},{"reference_url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html","reference_id":"","reference_type":"","scores":[],"url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html"},{"reference_url":"http://secunia.com/advisories/43274","reference_id":"","reference_type":"","scores":[],"url":"http://secunia.com/advisories/43274"},{"reference_url":"http://secunia.com/advisories/43666","reference_id":"","reference_type":"","scores":[],"url":"http://secunia.com/advisories/43666"},{"reference_url":"https://github.com/rails/rails/commit/66ce3843d32e9f2ac3b1da20067af53019bbb034","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/rails/rails/commit/66ce3843d32e9f2ac3b1da20067af53019bbb034"},{"reference_url":"https://github.com/rails/rails/commit/7e86f9b4d2b7dfa974c10ae7e6d8ef90f3d77f06","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/rails/rails/commit/7e86f9b4d2b7dfa974c10ae7e6d8ef90f3d77f06"},{"reference_url":"https://web.archive.org/web/20120527023027/http://www.securityfocus.com/bid/46291","reference_id":"","reference_type":"","scores":[],"url":"https://web.archive.org/web/20120527023027/http://www.securityfocus.com/bid/46291"},{"reference_url":"https://web.archive.org/web/20170223045008/http://www.securitytracker.com/id?1025060","reference_id":"","reference_type":"","scores":[],"url":"https://web.archive.org/web/20170223045008/http://www.securitytracker.com/id?1025060"},{"reference_url":"http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails","reference_id":"","reference_type":"","scores":[],"url":"http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails"},{"reference_url":"http://www.debian.org/security/2011/dsa-2247","reference_id":"","reference_type":"","scores":[],"url":"http://www.debian.org/security/2011/dsa-2247"},{"reference_url":"http://www.securityfocus.com/bid/46291","reference_id":"","reference_type":"","scores":[],"url":"http://www.securityfocus.com/bid/46291"},{"reference_url":"http://www.securitytracker.com/id?1025060","reference_id":"","reference_type":"","scores":[],"url":"http://www.securitytracker.com/id?1025060"},{"reference_url":"http://www.vupen.com/english/advisories/2011/0587","reference_id":"","reference_type":"","scores":[],"url":"http://www.vupen.com/english/advisories/2011/0587"},{"reference_url":"http://www.vupen.com/english/advisories/2011/0877","reference_id":"","reference_type":"","scores":[],"url":"http://www.vupen.com/english/advisories/2011/0877"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2011-0447","reference_id":"CVE-2011-0447","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-0447"},{"reference_url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-0447.yml","reference_id":"CVE-2011-0447.YML","reference_type":"","scores":[],"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-0447.yml"},{"reference_url":"https://github.com/advisories/GHSA-24fg-p96v-hxh8","reference_id":"GHSA-24fg-p96v-hxh8","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-24fg-p96v-hxh8"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/54467?format=json","purl":"pkg:gem/rails@3.0.4","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/rails@3.0.4"}],"aliases":["CVE-2011-0447","GHSA-24fg-p96v-hxh8"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-bcwq-ngna-fqhd"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37419?format=json","vulnerability_id":"VCID-cbvq-4ze7-r3g6","summary":"Translate helper method which may allow an attacker to insert arbitrary code into a page\nThe helper method for i18n translations has a convention whereby translations strings with a name ending in 'html' are considered HTML safe. There is also a mechanism for interpolation. It has been discovered that these 'html' strings allow arbitrary values to be contained in the interpolated input, and these values are not escaped.","references":[{"reference_url":"http://groups.google.com/group/rubyonrails-security/browse_thread/thread/2b61d70fb73c7cc5?pli=1","reference_id":"","reference_type":"","scores":[],"url":"http://groups.google.com/group/rubyonrails-security/browse_thread/thread/2b61d70fb73c7cc5?pli=1"},{"reference_url":"http://groups.google.com/group/rubyonrails-security/msg/c65c24fbc4b6dd82?dmode=source&output=gplain","reference_id":"","reference_type":"","scores":[],"url":"http://groups.google.com/group/rubyonrails-security/msg/c65c24fbc4b6dd82?dmode=source&output=gplain"},{"reference_url":"http://openwall.com/lists/oss-security/2011/11/18/8","reference_id":"","reference_type":"","scores":[],"url":"http://openwall.com/lists/oss-security/2011/11/18/8"},{"reference_url":"http://osvdb.org/77199","reference_id":"","reference_type":"","scores":[],"url":"http://osvdb.org/77199"},{"reference_url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/71364","reference_id":"","reference_type":"","scores":[],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/71364"},{"reference_url":"https://github.com/rails/rails/commit/ba2d85012088fd0db0fab98b2e512c77c83cbade#diff-79e8a3e6d1d2808c4f93f63b3928a5a1","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/rails/rails/commit/ba2d85012088fd0db0fab98b2e512c77c83cbade#diff-79e8a3e6d1d2808c4f93f63b3928a5a1"},{"reference_url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/OSVDB-77199.yml","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/OSVDB-77199.yml"},{"reference_url":"https://groups.google.com/forum/#!topic/rubyonrails-security/K2HXD7c8fMU","reference_id":"","reference_type":"","scores":[],"url":"https://groups.google.com/forum/#!topic/rubyonrails-security/K2HXD7c8fMU"},{"reference_url":"http://weblog.rubyonrails.org/2011/11/18/rails-3-0-11-has-been-released","reference_id":"","reference_type":"","scores":[],"url":"http://weblog.rubyonrails.org/2011/11/18/rails-3-0-11-has-been-released"},{"reference_url":"http://weblog.rubyonrails.org/2011/11/18/rails-3-1-2-has-been-released","reference_id":"","reference_type":"","scores":[],"url":"http://weblog.rubyonrails.org/2011/11/18/rails-3-1-2-has-been-released"},{"reference_url":"http://www.securityfocus.com/bid/50722","reference_id":"","reference_type":"","scores":[],"url":"http://www.securityfocus.com/bid/50722"},{"reference_url":"http://www.securitytracker.com/id?1026342","reference_id":"","reference_type":"","scores":[],"url":"http://www.securitytracker.com/id?1026342"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2011-4319","reference_id":"CVE-2011-4319","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-4319"},{"reference_url":"https://github.com/advisories/GHSA-xxr8-833v-c7wc","reference_id":"GHSA-xxr8-833v-c7wc","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-xxr8-833v-c7wc"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/54598?format=json","purl":"pkg:gem/rails@3.0.11","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/rails@3.0.11"},{"url":"http://public2.vulnerablecode.io/api/packages/54599?format=json","purl":"pkg:gem/rails@3.1.2","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/rails@3.1.2"}],"aliases":["CVE-2011-4319","GHSA-xxr8-833v-c7wc"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-cbvq-4ze7-r3g6"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/39093?format=json","vulnerability_id":"VCID-chxq-j9us-cygh","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nThe cross-site scripting (XSS) prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does not properly handle mutation of safe buffers, which makes it easier for remote attackers to conduct XSS attacks via crafted strings to an application that uses a problematic string method, as demonstrated by the sub method.","references":[{"reference_url":"http://groups.google.com/group/rubyonrails-security/msg/663b600d4471e0d4?dmode=source&output=gplain","reference_id":"","reference_type":"","scores":[],"url":"http://groups.google.com/group/rubyonrails-security/msg/663b600d4471e0d4?dmode=source&output=gplain"},{"reference_url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062514.html","reference_id":"","reference_type":"","scores":[],"url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062514.html"},{"reference_url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-June/062090.html","reference_id":"","reference_type":"","scores":[],"url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-June/062090.html"},{"reference_url":"http://openwall.com/lists/oss-security/2011/06/09/2","reference_id":"","reference_type":"","scores":[],"url":"http://openwall.com/lists/oss-security/2011/06/09/2"},{"reference_url":"http://openwall.com/lists/oss-security/2011/06/13/9","reference_id":"","reference_type":"","scores":[],"url":"http://openwall.com/lists/oss-security/2011/06/13/9"},{"reference_url":"http://secunia.com/advisories/44789","reference_id":"","reference_type":"","scores":[],"url":"http://secunia.com/advisories/44789"},{"reference_url":"https://gist.github.com/NZKoz/b2ceb626fc2bcdfe497f","reference_id":"","reference_type":"","scores":[],"url":"https://gist.github.com/NZKoz/b2ceb626fc2bcdfe497f"},{"reference_url":"https://github.com/rails/rails/commit/53a2c0baf2b128dd4808eca313256f6f4bb8c4cd","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/rails/rails/commit/53a2c0baf2b128dd4808eca313256f6f4bb8c4cd"},{"reference_url":"https://github.com/rails/rails/commit/ed3796434af6069ced6a641293cf88eef3b284da","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/rails/rails/commit/ed3796434af6069ced6a641293cf88eef3b284da"},{"reference_url":"http://weblog.rubyonrails.org/2011/6/8/potential-xss-vulnerability-in-ruby-on-rails-applications","reference_id":"","reference_type":"","scores":[],"url":"http://weblog.rubyonrails.org/2011/6/8/potential-xss-vulnerability-in-ruby-on-rails-applications"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2011-2197","reference_id":"CVE-2011-2197","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-2197"},{"reference_url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2011-2197.yml","reference_id":"CVE-2011-2197.YML","reference_type":"","scores":[],"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2011-2197.yml"},{"reference_url":"https://github.com/advisories/GHSA-v9v4-7jp6-8c73","reference_id":"GHSA-v9v4-7jp6-8c73","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-v9v4-7jp6-8c73"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/54592?format=json","purl":"pkg:gem/rails@3.0.8","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/rails@3.0.8"}],"aliases":["CVE-2011-2197","GHSA-v9v4-7jp6-8c73"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-chxq-j9us-cygh"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37599?format=json","vulnerability_id":"VCID-gadc-jens-nuga","summary":"Denial of Service Vulnerability in Action View\nThere is a denial of service vulnerability in the header handling component of Action View. Strings sent in specially crafted headers will be cached indefinitely. This can cause the cache to grow infinitely, which will eventually consume all memory on the target machine, causing a denial of service.","references":[{"reference_url":"http://seclists.org/oss-sec/2013/q4/400","reference_id":"","reference_type":"","scores":[],"url":"http://seclists.org/oss-sec/2013/q4/400"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2013-6414","reference_id":"CVE-2013-6414","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-6414"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/51664?format=json","purl":"pkg:gem/rails@3.2.16","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/rails@3.2.16"},{"url":"http://public2.vulnerablecode.io/api/packages/51665?format=json","purl":"pkg:gem/rails@4.0.2","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/rails@4.0.2"}],"aliases":["CVE-2013-6414"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-gadc-jens-nuga"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/44231?format=json","vulnerability_id":"VCID-sw7t-5s3e-vkhx","summary":"ReDoS based DoS vulnerability in Action Dispatch\nThere is a possible regular expression based DoS vulnerability in Action Dispatch. Specially crafted cookies, in combination with a specially crafted `X_FORWARDED_HOST` header can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.","references":[{"reference_url":"https://discuss.rubyonrails.org/t/cve-2023-22792-possible-redos-based-dos-vulnerability-in-action-dispatch/82115","reference_id":"","reference_type":"","scores":[],"url":"https://discuss.rubyonrails.org/t/cve-2023-22792-possible-redos-based-dos-vulnerability-in-action-dispatch/82115"},{"reference_url":"https://github.com/rails/rails/releases/tag/v7.0.4.1","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/rails/rails/releases/tag/v7.0.4.1"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-22792","reference_id":"CVE-2023-22792","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-22792"},{"reference_url":"https://github.com/advisories/GHSA-p84v-45xj-wwqj","reference_id":"GHSA-p84v-45xj-wwqj","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-p84v-45xj-wwqj"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/63885?format=json","purl":"pkg:gem/rails@6.0.6.1","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/rails@6.0.6.1"},{"url":"http://public2.vulnerablecode.io/api/packages/63886?format=json","purl":"pkg:gem/rails@6.1.7.1","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/rails@6.1.7.1"},{"url":"http://public2.vulnerablecode.io/api/packages/63882?format=json","purl":"pkg:gem/rails@7.0.4.1","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/rails@7.0.4.1"}],"aliases":["CVE-2023-22792","GHSA-p84v-45xj-wwqj","GMS-2023-58"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-sw7t-5s3e-vkhx"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/39053?format=json","vulnerability_id":"VCID-z21g-8h32-yyf6","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nMultiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.","references":[{"reference_url":"http://groups.google.com/group/rubyonrails-security/msg/365b8a23b76a6b4a?dmode=source&output=gplain","reference_id":"","reference_type":"","scores":[],"url":"http://groups.google.com/group/rubyonrails-security/msg/365b8a23b76a6b4a?dmode=source&output=gplain"},{"reference_url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html","reference_id":"","reference_type":"","scores":[],"url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html"},{"reference_url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html","reference_id":"","reference_type":"","scores":[],"url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html"},{"reference_url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html","reference_id":"","reference_type":"","scores":[],"url":"http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html"},{"reference_url":"http://secunia.com/advisories/43274","reference_id":"","reference_type":"","scores":[],"url":"http://secunia.com/advisories/43274"},{"reference_url":"http://secunia.com/advisories/43666","reference_id":"","reference_type":"","scores":[],"url":"http://secunia.com/advisories/43666"},{"reference_url":"https://github.com/rails/rails/commit/abe97736b8316f1b714cac56c115c0779aa73217","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/rails/rails/commit/abe97736b8316f1b714cac56c115c0779aa73217"},{"reference_url":"https://github.com/rails/rails/commit/e3dd2107c57a8efaaea5d61cf8da65f7444760b2","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/rails/rails/commit/e3dd2107c57a8efaaea5d61cf8da65f7444760b2"},{"reference_url":"https://groups.google.com/g/rubyonrails-security/c/8CpI7egxX4E/m/SmtqtyOKWzYJ","reference_id":"","reference_type":"","scores":[],"url":"https://groups.google.com/g/rubyonrails-security/c/8CpI7egxX4E/m/SmtqtyOKWzYJ"},{"reference_url":"https://web.archive.org/web/20111225083933/http://secunia.com/advisories/43274","reference_id":"","reference_type":"","scores":[],"url":"https://web.archive.org/web/20111225083933/http://secunia.com/advisories/43274"},{"reference_url":"https://web.archive.org/web/20111225083933/http://secunia.com/advisories/43666","reference_id":"","reference_type":"","scores":[],"url":"https://web.archive.org/web/20111225083933/http://secunia.com/advisories/43666"},{"reference_url":"https://web.archive.org/web/20120527023027/http://www.securityfocus.com/bid/46291","reference_id":"","reference_type":"","scores":[],"url":"https://web.archive.org/web/20120527023027/http://www.securityfocus.com/bid/46291"},{"reference_url":"https://web.archive.org/web/20200812054342/http://www.securitytracker.com/id?1025064","reference_id":"","reference_type":"","scores":[],"url":"https://web.archive.org/web/20200812054342/http://www.securitytracker.com/id?1025064"},{"reference_url":"http://www.debian.org/security/2011/dsa-2247","reference_id":"","reference_type":"","scores":[],"url":"http://www.debian.org/security/2011/dsa-2247"},{"reference_url":"http://www.securityfocus.com/bid/46291","reference_id":"","reference_type":"","scores":[],"url":"http://www.securityfocus.com/bid/46291"},{"reference_url":"http://www.securitytracker.com/id?1025064","reference_id":"","reference_type":"","scores":[],"url":"http://www.securitytracker.com/id?1025064"},{"reference_url":"http://www.vupen.com/english/advisories/2011/0587","reference_id":"","reference_type":"","scores":[],"url":"http://www.vupen.com/english/advisories/2011/0587"},{"reference_url":"http://www.vupen.com/english/advisories/2011/0877","reference_id":"","reference_type":"","scores":[],"url":"http://www.vupen.com/english/advisories/2011/0877"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2011-0446","reference_id":"CVE-2011-0446","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-0446"},{"reference_url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-0446.yml","reference_id":"CVE-2011-0446.YML","reference_type":"","scores":[],"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-0446.yml"},{"reference_url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2011-0446.yml","reference_id":"CVE-2011-0446.YML","reference_type":"","scores":[],"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2011-0446.yml"},{"reference_url":"https://github.com/advisories/GHSA-75w6-p6mg-vh8j","reference_id":"GHSA-75w6-p6mg-vh8j","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-75w6-p6mg-vh8j"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/54467?format=json","purl":"pkg:gem/rails@3.0.4","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/rails@3.0.4"}],"aliases":["CVE-2011-0446","GHSA-75w6-p6mg-vh8j"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-z21g-8h32-yyf6"}],"fixing_vulnerabilities":[],"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/packages/pkg:gem/rails@3.0.0"}