Some vulnerabilities have been reported in Ruby on Rails, which can be exploited by malicious people to conduct cross-site scripting attacks.

1) The "strip_tags" helper method does not properly sanitise malformed HTML, which can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

2) Input passed via a "prompt" value is not properly sanitised in the "select_tag" helper method before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

3) The HTML escaping code functionality does not properly escape a single quote character, which can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerabilities are reported in versions prior to 3.0.17, prior to 3.1.8, and prior to 3.2.8.

Solution
Update to version 3.0.17, 3.1.8, or 3.2.8.

Provided and/or discovered by
1) The vendor credits Marek, Nethemba.
2, 3) Reported by the vendor.

Original Advisory
Ruby on Rails:
http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/
https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/FgVEtBajcTY
https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/fV3QUToSMSw
https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/kKGNeMrnmiY

Deep Links
Links available to Secunia VIM customers