[SECURITY] Fedora 17 Update: rubygem-passenger-3.0.21-1.fc17

Phusion Passenger=E2=84=A2 =E2=80=94 a.k.a. modrails or modrack =E2=80=94 makes deployment of Ruby web applications, such as those built on the revolutionary Ruby on Rails web framework, a breeze. It follows the usual Ruby on Rails conventions, such as...

[SECURITY] Fedora 18 Update: rubygem-passenger-3.0.21-1.fc18

Phusion Passenger=E2=84=A2 =E2=80=94 a.k.a. modrails or modrack =E2=80=94 makes deployment of Ruby web applications, such as those built on the revolutionary Ruby on Rails web framework, a breeze. It follows the usual Ruby on Rails conventions, such as...

Ruby on Rails exploit could hijack unpatched servers for botnet

Server Administrators are being urged to update their Ruby on Rails servers following the discovery of an active malware campaign targeting vulnerable versions of the web development framework. According to security researcher Jeff Jarmoc, Hackers are exploiting a known and patched vulnerability ...

Ruby on Rails Exploit Harvests IRC Botnet

Developers who have not updated their Ruby on Rails installations with a five-month-old security patch would do well to secure the Web development framework now. Exploit code has surfaced for CVE-2013-0156 that is being used to build a botnet of compromised servers. Exploit code has been publicly...

VulnCheck KEV: CVE-2013-0156

activesupport/coreext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a...

http-vuln-cve2013-0156 NSE Script

Detects Ruby on Rails servers vulnerable to object injection, remote command executions and denial of service attacks. CVE-2013-0156 All Ruby on Rails versions before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 are vulnerable. This script sends 3 harmless YAML payloa...

Ruby on Rails Active Record 数据类型注入漏洞(CVE-2013-3221)

CVE ID:CVE-2013-3221 Ruby on Rails是一个使用Ruby语言所写的开源网络应用框架。 Ruby on Rails Active Record组件在对数据库列中输入值和存储值进行比较时，没有确保使用该数据库列所声明的数据类型，允许远程攻击者比较容易的通过特殊值对Ruby on Rails应用程序进行数据类型注入的攻击。如可通过"typed XML"特和Mysql数据库特殊的交互来利用此漏洞。 0 Ruby on Rails 2.3.x Ruby on Rails 3.0.x Ruby on Rails 3.1.x Ruby on Rails 3.2.x...

CVE-2013-3221

The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attack...

CVE-2013-3221

The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attack...

DEBIAN-CVE-2013-3221

The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attack...

Sql injection

The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attack...

CVE-2013-3221

The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attack...

CVE-2013-3221

CVE-2013-3221 involves the Active Record component of Ruby on Rails (versions 2.3.x, 3.0.x, 3.1.x, 3.2.x). The issue arises because the database column data type declared for a column is not consistently used when comparing input values to stored values, enabling data-type injection attacks. The ...

CVE-2013-3221

The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attack...

[Brakeman v1.9.5] The Static analysis security scanner for Ruby on Rails

Brakeman is an open source vulnerability scanner specifically designed for Ruby on Rails applications. It statically analyzes Rails application code to find security issues at any stage of development. Unlike many web security scanners, Brakeman looks at the source code of your application. This...

Data-type injection vulnerability

The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attack...

FreeBSD : rubygem-rails -- multiple vulnerabilities (db0c4b00-a24c-11e2-9601-000d601460a4)

Ruby on Rails team reports : Rails versions 3.2.13 has been released. This release contains important security fixes. It is recommended users upgrade as soon as possible. Four vulnerabilities have been discovered and fixed : - CVE-2013-1854 Symbol DoS vulnerability in Active Record - CVE-2013-185...

Ruby on Rails Known Secret Session Cookie Remote Code Execution

This module implements Remote Command Execution on Ruby on Rails applications. Prerequisite is knowledge of the "secrettoken" Rails 2/3 or "secretkeybase" Rails 4. The values for those can be usually found in the file "RAILSROOT/config/initializers/secrettoken.rb". The module achieves RCE by...

Moderate: Red Hat Security Advisory: rubygem-actionpack and ruby193-rubygem-actionpack security update

Updated rubygem-actionpack and ruby193-rubygem-actionpack packages that fix two security issues are now available for Red Hat OpenShift Enterprise 1.1.3. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base...

Moderate: Red Hat Security Advisory: ruby193-rubygem-activerecord security update

Updated ruby193-rubygem-activerecord packages that fix one security issue are now available for Red Hat OpenShift Enterprise 1.1.3. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a...