From ${URL} : Description Some vulnerabilities have been reported in the will_paginate gem for Ruby, which can be exploited by malicious people to conduct cross-site scripting attacks. Certain input related to generated pagination links is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. The vulnerabilities are reported in version prior to 3.0.5. Solution: Update to version 3.0.5. Further details available to Secunia VIM customers Provided and/or discovered by: Reported by the vendor. Original Advisory: https://github.com/mislav/will_paginate/releases/tag/v3.0.5
will_paginate 3.0.5 is already in the tree for a few months, and I've just remove the older vulnerable versions. No stable versions.
Thank you much, closing noglsa.
CVE-2013-6459 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-6459): Cross-site scripting (XSS) vulnerability in the will_paginate gem before 3.0.5 for Ruby allows remote attackers to inject arbitrary web script or HTML via vectors involving generated pagination links.