PT-2012-3768

Name of the Vulnerable Software and Affected Versions Redmine versions prior to 1.3.2 HMIWeb Browser ActiveX Control affected versions not specified Description The issue allows remote attackers to set attributes in various models, including Comment, Document, IssueCategory, MembersController,...

PT-2012-1266

Name of the Vulnerable Software and Affected Versions Spree version 0.2.0 Description The issue allows remote attackers to bypass the intended payment step by modifying a URL, related to a mass assignment vulnerability. This occurs because the software does not properly restrict the use of a hash...

CVE-2008-7310: Undefined Security Weakness

Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the Order state value and bypass the intended payment step via a modified URL, related to a "mass assignment" vulnerability...

PT-2012-1265

Name of the Vulnerable Software and Affected Versions Insoshi versions prior to 20080920 Description The issue allows remote attackers to set the ForumPost user id value via a modified URL, related to a mass assignment vulnerability. This occurs because the software does not properly restrict the...

Ruby On Rails Attributes Mass Assignment Scanner

This module scans Ruby On Rails sites for models with attributes not protected by attrprotected or attraccessible. After attempting to assign a non-existent field, the default rails with activerecord setup will raise an ActiveRecord::UnknownAttributeError exception, and reply with HTTP code 500...

redmine -- multiple vulnerabilities

Redmine reports: Mass-assignment vulnerability that would allow an attacker to bypass part of the security checks. Persistent XSS vulnerability...