Known vulnerabilities in Ruby on Rails 3.0.9.rc2

Vendor: Rails
Software: Ruby on Rails
Version: 3.0.9.rc2
Software CPE: cpe:2.3:a:rails:ruby_on_rails:*:*:*:*:*:*:*:*
Total vulnerabilities: 8
Public exploits: 1
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.3

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting Ruby on Rails version 3.0.9.rc2 Ruby on Rails 3.0.9.rc2 is affected by 8 vulnerabilities: 1 high, 7 medium Critical High Medium Low

Vulnerabilities (8)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU116187 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2013-0333
CWE-89 Medium
Public exploit available
Exploited
2.3.16, 3.0.20 30.09.2025 SB2013013001
#VU116186 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2012-3464
CWE-79 Medium
No
No
3.0.17, 3.1.8, 3.2.8 30.09.2025 SB2012081002
#VU116167 - Permissions, Privileges, and Access Controls
CVE-2012-2660
CWE-264 Medium
No
No
3.0.13, 3.1.5, 3.2.4 29.09.2025 SB2012062226
#VU116162 - NULL Pointer Dereference
CVE-2012-2694
CWE-476 Medium
No
No
3.0.14, 3.1.6, 3.2.6 29.09.2025 SB2012062225
#VU116160 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2012-3465
CWE-79 Medium
No
No
3.0.17, 3.1.8, 3.2.8 29.09.2025 SB2012081001
#VU116153 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2012-2695
CWE-89 Medium
No
No
3.0.14, 3.1.6, 3.2.6 29.09.2025 SB2012062224
#VU116152 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2012-2661
CWE-89 Medium
No
No
3.0.13, 3.1.5, 3.2.4 29.09.2025 SB2012062223
#VU116148 - Deserialization of Untrusted Data
CVE-2013-0277
CWE-502 High
No
No
2.3.17, 3.1.0 29.09.2025 SB2013021310