CVE-2012-6684

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Cross-site scripting (XSS) vulnerability in the RedCloth library 4.2.9 for Ruby and earlier allows remote attackers to inject arbitrary web script or HTML via a javascript: URI.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://co3k.org/blog/redcloth-unfixed-xss-enBroken Link
http://jgarber.lighthouseapp.com/projects/13054-redcloth/tickets/243-xssThird Party Advisory
http://seclists.org/fulldisclosure/2014/Dec/50Exploit, Mailing List, Third Party Advisory
http://www.debian.org/security/2015/dsa-3168Third Party Advisory
https://gist.github.com/co3k/75b3cb416c342aa1414cIssue Tracking, Patch
http://co3k.org/blog/redcloth-unfixed-xss-enBroken Link
http://jgarber.lighthouseapp.com/projects/13054-redcloth/tickets/243-xssThird Party Advisory
http://seclists.org/fulldisclosure/2014/Dec/50Exploit, Mailing List, Third Party Advisory
http://www.debian.org/security/2015/dsa-3168Third Party Advisory
https://gist.github.com/co3k/75b3cb416c342aa1414cIssue Tracking, Patch

Timeline

Published: Jan 8, 2015
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-66857.5Nokogiri before 1.5.4 is vulnerable to XXE attacks CVE-2012-66875.0FastCGI (aka fcgi and libfcgi) 2.4.0 allows remote attackers to cause a denial of service (segmentation fault and crash) via a large number CVE-2012-66897.8The netlink_sendmsg function in net/netlink/af_netlink.c in the Linux kernel before 3.5.5 does not validate the dst_pid field, which allows CVE-2012-66916.8Multiple cross-site request forgery (CSRF) vulnerabilities in the admin panel in osCMax before 2.5.1 allow remote attackers to hijack the au CVE-2012-66924.3Cross-site scripting (XSS) vulnerability in js/wp-seo-metabox.js in the WordPress SEO by Yoast plugin before 2.2 for WordPress allows remote CVE-2012-669310.0GE Healthcare Centricity PACS 4.0 Server has a default password of (1) nasro for the nasro (ReadOnly) user and (2) nasrw for the nasrw (Read CVE-2012-669410.0GE Healthcare Centricity PACS Workstation 4.0 and 4.0.1, and Server 4.0, has a password of 2charGE for the geservice account, which has unsp CVE-2012-669510.0GE Healthcare Centricity PACS Workstation 4.0 and 4.0.1 has a password of ddpadmin for the ddpadmin user, which has unspecified impact and a CVE-2012-66969.8inspircd in Debian before 2.0.7 does not properly handle unsigned integers. NOTE: This vulnerability exists because of an incomplete fix to CVE-2012-66977.5InspIRCd before 2.0.7 allows remote attackers to cause a denial of service (infinite loop).CVE-2012-66987.5The decode_search function in dhcp.c in dhcpcd 3.x allows remote DHCP servers to cause a denial of service (out-of-bounds write) via a craft CVE-2012-66997.5The decode_search function in dhcp.c in dhcpcd 3.x allows remote DHCP servers to cause a denial of service (out-of-bounds read) via a crafte