Design/Logic Flaw

Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing...

CVE-2016-6317

Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing...

CVE-2016-6316

Cross-site scripting XSS vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers...

Cross site scripting

Cross-site scripting XSS vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers...

CVE-2016-6317

Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing...

CVE-2016-6317

The CVE-2016-6317 entry affects Ruby on Rails 4.2.x before 4.2.7.1, where Active Record and JSON parameter handling differences can allow remote attackers to bypass query restrictions and trigger NULL checks or missing WHERE clauses via crafted requests (e.g., [nil]). Root cause is inconsistent p...

CVE-2016-6316

Cross-site scripting XSS vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers...

CVE-2016-6317

Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing...

CVE-2016-6316

Cross-site scripting XSS vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers...

CVE-2016-6316

Summary : CVE-2016-6316 is a cross-site scripting (XSS) vulnerability in Rails’ Action View. The root cause is that quotes were not escaped for strings declared as HTML safe when used as attribute values in tag helpers, enabling remote attackers to inject script or HTML. Affected products include...

Debian DLA-603-1 : ruby-activesupport-3.2 security update

The support and utility classes used by the Rails 3.2 framework allow remote attackers to cause a denial of service SystemStackError via a large XML document depth. For Debian 7 'Wheezy', these problems have been fixed in version 3.2.6-6+deb7u2. Additionally this upload adds...

DLA-604-1 ruby-actionpack-3.2 - security update

Bulletin has no description...

[SECURITY] Fedora 25 Update: rubygem-railties-5.0.0.1-2.fc25

Rails internals: application bootup, plugins, generators, and rake tasks. Railties is responsible to glue all frameworks together. Overall, it: handles all the bootstrapping process for a Rails application; manager rails command line interface; provides Rails generators core;...

[SECURITY] Fedora 25 Update: rubygem-activesupport-5.0.0.1-1.fc25

A toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Rich support for multibyte strings, internationalization, time zones, and testing...

[SECURITY] Fedora 25 Update: rubygem-rails-5.0.0.1-1.fc25

Ruby on Rails is a full-stack web framework optimized for programmer happin ess and sustainable productivity. It encourages beautiful code by favoring convention over configuration...

DLA-603-1 ruby-activesupport-3.2 - security update

Bulletin has no description...

Debian DSA-3651-1 : rails - security update

Andrew Carpenter of Critical Juncture discovered a cross-site scripting vulnerability affecting Action View in rails, a web application framework written in Ruby. Text declared as 'HTML safe' will not have quotes escaped when used as attribute values in tag helpers. %NASLMINLEVEL 70300 C Tenable...

[SECURITY] [DSA 3651-1] rails security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3651-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 25, 2016 https://www.debian.org/security/faq -...

DSA-3651-1 rails - security update

Bulletin has no description...

Debian Security Advisory DSA 3651-1 (rails - security update)

Andrew Carpenter of Critical Juncture discovered a cross-site scripting vulnerability affecting Action View in rails, a web application framework written in Ruby. Text declared as HTML safe will not have quotes escaped when used as attribute values in tag helpers. OpenVAS Vulnerability Test $Id:...