CVE-2011-2197

The cross-site scripting XSS prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does not properly handle mutation of safe buffers, which makes it easier for remote attackers to conduct XSS attacks via crafted strings to an application that uses a...

[SECURITY] Fedora 15 Update: rubygem-activesupport-3.0.5-3.fc15

Utility library which carries commonly used classes and goodies from the Rails framework...

Debian DSA-2260-1 : rails - several vulnerabilities

Two vulnerabilities were discovered in Ruby on Rails, a web application framework. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-3086 The cookie store may be vulnerable to a timing attack, potentially allowing remote attackers to forge message...

[SECURITY] [DSA 2259-1] rails security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2260-1 [email protected] http://www.debian.org/security/ Florian Weimer June 14, 2011 http://www.debian.org/security/faq -...

DSA-2260-1 rails - several

Bulletin has no description...

Debian DSA-2247-1 : rails - several vulnerabilities

Several vulnerabilities have been discovered in Rails, the Ruby web application framework. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2011-0446 Multiple cross-site scripting XSS vulnerabilities when JavaScript encoding is used, allow remote attacker...

[SECURITY] [DSA 2247-1] rails security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2247-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst May 31, 2011 http://www.debian.org/security/faq -...

[SECURITY] [DSA 2247-1] rails security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2247-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst May 31, 2011 http://www.debian.org/security/faq -...

DSA-2247-1 rails - several vulnerabilities

Bulletin has no description...

Spreecommerce api/orders.json Search Function Arbitrary Command Execution

The remote web server hosts Spree, an open source e-commerce application for Ruby on Rails. The version of this application installed on the remote host has a flaw in the third-party 'rdsearchlogic' Ruby gem. An unauthenticated, remote attacker can inject arbitrary Ruby code via the...

Ruby on Rails安全限制绕过和SQL注入漏洞

BUGTRAQ ID: 46292 CVE ID: CVE-2011-0448,CVE-2011-0449 Ruby on Rails简称RoR 或Rails，是一个使用Ruby语言写的开源Web应用框架，它是严格按照MVC结构开发的。 Ruby on Rails在实现上存在安全限制绕过和SQL注入漏洞，攻击者可利用安全限制绕过漏洞绕过某些安全限制和执行未授权操作，利用SQL注入漏洞修改SQL请求，完全控制受影响软件，检索信息或修改数据。 Ruby on Rails Ruby on Rails 3.x 厂商补丁： Ruby on Rails -------------...

Ruby on Rails跨站脚本执行及跨站请求伪造漏洞

BUGTRAQ ID: 46291 CVE ID: CVE-2011-0446,CVE-2011-0447 Ruby on Rails简称RoR或Rails，是一个使用Ruby语言写的开源Web应用框架，它是严格按照MVC结构开发的。 Ruby on Rails在实现上存在跨站脚本执行和跨站请求伪造漏洞，攻击者可利用跨站脚本执行漏洞在受影响浏览器中执行任意脚本代码，窃取Cookie验证凭证。 Ruby on Rails Ruby on Rails 3.x Ruby on Rails Ruby on Rails 2.x Ruby on Rails Ruby on Rails 1.x 厂商补...

Redmine 1.1.1 Cross Site Scripting

Information -------------------- Name : XSS vulnerability in Redmine Software : all Redmine versions from 1.0.1 to 1.1.1 Vendor Homepage : http://www.redmine.org Vulnerability Type : Cross-Site Scripting Severity : High Researcher : Mesut Timur Advisory Reference : NS-11-004 Description...

XSS Vulnerability in Redmine 1.0.1 to 1.1.1

Information -------------------- Name : XSS vulnerability in Redmine Software : all Redmine versions from 1.0.1 to 1.1.1 Vendor Homepage : http://www.redmine.org Vulnerability Type : Cross-Site Scripting Severity : High Researcher : Mesut Timur mesut at mavitunasecurity dot com Advisory Reference...

[SECURITY] Fedora 15 Update: rubygem-rails-3.0.5-2.fc15

Rails is a framework for building web-application using CGI, FCGI, modruby, or WEBrick on top of either MySQL, PostgreSQL, SQLite, DB2, SQL Server, or Oracle with eRuby- or Builder-based templates...

[SECURITY] Fedora 15 Update: rubygem-railties-3.0.5-1.fc15

Rails internals: application bootup, plugins, generators, and rake tasks. Railties is responsible to glue all frameworks together. Overall, it: handles all the bootstrapping process for a Rails application; manager rails command line interface; provides Rails generators core;...

[SECURITY] Fedora 15 Update: rubygem-activesupport-3.0.5-1.fc15

Utility library which carries commonly used classes and goodies from the Rails framework...

Ruby on Rails Logfile Injection Vulnerability (Mar 2011)

Ruby on Rails is prone to a file injection vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:rubyonrails:rails";...

Rails 3.0.5 Log File Injection Proof Of Concept

Encoding: UTF-8 Log-File-Injection - Ruby on Rails 3.05 possibilities: - possible date back attacks tried with request-log-analyzer: worked but teasercheckwarnings - ip spoofing - binary log-injections - DOS if ip is used with an iptables-ban-script !! works only on intranet apps !! Fix: validate...

Ruby on Rails 3.x < 3.0.4 Security Bypass and SQLi Vulnerabilities

Ruby on Rails is prone to security bypass and SQL injection SQLi vulnerabilities. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...