4495 matches found
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
SQL injection vulnerability in activerecord/lib/activerecord/connectionadapters/postgresql/cast.rb in Active Record in Ruby on Rails beta1, when PostgreSQL is used, allows remote attackers to execute "add data" SQL commands via vectors involving \ backslash characters that are not properly handle...
CVE-2014-0080 rubygem-activerecord: PostgreSQL array data injection vulnerability
SQL injection vulnerability in activerecord/lib/activerecord/connectionadapters/postgresql/cast.rb in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute "add data" SQL commands via vectors involving \ backslash character...
CVE-2014-0082 rubygem-actionpack: Action View string handling denial of service
actionpack/lib/actionview/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during use of the :text option to the render method, which allows remote attackers to cause a denial of service memory consumption by including these strings in heade...
[SECURITY] Fedora 19 Update: rubygem-activesupport-3.2.13-2.fc19
Utility library which carries commonly used classes and goodies from the Rails framework...
Cross site request forgery (csrf)
CloudForms 3.0 Management Engine before 5.2.1.6 allows remote attackers to bypass the Ruby on Rails protectfromforgery mechanism and conduct cross-site request forgery CSRF attacks via a destructive action in a request...
CVE-2013-6443
CloudForms 3.0 Management Engine before 5.2.1.6 allows remote attackers to bypass the Ruby on Rails protectfromforgery mechanism and conduct cross-site request forgery CSRF attacks via a destructive action in a request...
CVE-2013-6443
CVE-2013-6443 affects CloudForms 3.0 Management Engine prior to 5.2.1.6, where a GET request for a destructive action could bypass Rails protect_from_forgery and enable CSRF exploitation. The issue arises in the CloudForms web application where CSRF protections could be bypassed, allowing unautho...
echor Gem for Ruby backplane.rb perform_request Function Arbitrary Command Execution
Echor Gem for Ruby contains a flaw in backplane.rb in the performrequest function that is triggered when a semi-colon ; is injected into a username or password. This may allow a context-dependent attacker to inject arbitrary commands if the gem is used in a rails application...
[SECURITY] [DSA 2830-1] ruby-i18n security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2830-1 [email protected] http://www.debian.org/security/ Florian Weiemr December 30, 2013 http://www.debian.org/security/faq -...
Important: Red Hat Security Advisory: ruby193-rubygem-actionpack security update
Updated ruby193-rubygem-actionpack packages that fix multiple security issues are now available for Red Hat OpenStack 3.0. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severi...
rubygem-actionpack: i18n missing translation XSS
It was discovered that the internationalization component of Ruby on Rails could, under certain circumstances, return a fallback HTML string that contained user input. A remote attacker could possibly use this flaw to perform a reflective cross-site scripting XSS attack by providing a specially...
rubygem-actionpack: unsafe query generation risk (incomplete fix for CVE-2013- 0155)
actionpack/lib/actiondispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query...
[SECURITY] [DSA 2830-1] ruby-i18n security update
------------------------------------------------------------------------- Debian Security Advisory DSA-2830-1 [email protected] http://www.debian.org/security/ Florian Weiemr December 30, 2013 http://www.debian.org/security/faq -...
DSA-2830-1 ruby-i18n - cross-site scripting
Bulletin has no description...
Debian Security Advisory DSA 2830-1 (ruby-i18n - cross-site scripting)
Peter McLarnan discovered that the internationalization component of Ruby on Rails does not properly encode parameters in generated HTML code, resulting in a cross-site scripting vulnerability. This update corrects the underlying vulnerability in the i18n gem, as provided by the ruby-i18n package...
Red Hat CloudForms Management Engine 5.1 agent/linuxpkgs Path Traversal
This Metasploit module exploits a path traversal vulnerability in the "linuxpkgs" action of "agent" controller of the Red Hat CloudForms Management Engine 5.1 ManageIQ Enterprise Virtualization Manager 5.0 and earlier. It uploads a fake controller to the controllers directory of the Rails...
Fat Free CRM CSRF / SQL Injection / Known Secret
To whom it may concern: A rather informal advisory on Fat Free CRM http://fatfreecrm.com/: Timeline: Aug 27th 2013 Initial email containing the findings listed below including a note that there more vulnerabilities which just need to be verified. Send to [email protected] and...
CVE-2013-3709
WebYaST 1.3 uses weak permissions for config/initializers/secrettoken.rb, which allows local users to gain privileges by reading the Rails secret token from this file...
Design/Logic Flaw
WebYaST 1.3 uses weak permissions for config/initializers/secrettoken.rb, which allows local users to gain privileges by reading the Rails secret token from this file...