4859 matches found
[SECURITY] [DSA 1887-1] New rails packages fix cross-site scripting
------------------------------------------------------------------------ Debian Security Advisory DSA-1887-1 [email protected] http://www.debian.org/security/ Steffen Joeris September 15, 2009 http://www.debian.org/security/faq -...
[SECURITY] [DSA 1887-1] New rails packages fix cross-site scripting
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1887-1 [email protected] http://www.debian.org/security/ Steffen Joeris September 15, 2009 http://www.debian.org/security/faq -...
DSA-1887-1 rails - cross-site scripting
Bulletin has no description...
CVE-2009-3086
A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, leaks information about the complexity of message-digest signature verification in the cookie store, which might allow remote attackers to forge a digest via multiple attempts...
CVE-2009-3009
Cross-site scripting XSS vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject arbitrary web script or HTML by placing malformed Unicode strings into a form helper...
CVE-2009-3086
A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, leaks information about the complexity of message-digest signature verification in the cookie store, which might allow remote attackers to forge a digest via multiple attempts...
CVE-2009-3009
Cross-site scripting XSS vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject arbitrary web script or HTML by placing malformed Unicode strings into a form helper...
Information disclosure
A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, leaks information about the complexity of message-digest signature verification in the cookie store, which might allow remote attackers to forge a digest via multiple attempts...
Cross site scripting
Cross-site scripting XSS vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject arbitrary web script or HTML by placing malformed Unicode strings into a form helper...
CVE-2009-3009
Cross-site scripting XSS vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject arbitrary web script or HTML by placing malformed Unicode strings into a form helper...
DEBIAN-CVE-2009-3009
Cross-site scripting XSS vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject arbitrary web script or HTML by placing malformed Unicode strings into a form helper...
CVE-2009-3086
A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, leaks information about the complexity of message-digest signature verification in the cookie store, which might allow remote attackers to forge a digest via multiple attempts...
DEBIAN-CVE-2009-3086
A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, leaks information about the complexity of message-digest signature verification in the cookie store, which might allow remote attackers to forge a digest via multiple attempts...
CVE-2009-3086
Ruby on Rails cookie store vulnerability CVE-2009-3086 affects Rails 2.1.0–2.2.2 and 2.3.x before 2.3.4. The issue leaks information about the complexity of message-digest verification and may allow remote attackers to forge a digest via multiple attempts (timing attack). Debian fixes: 2.1.0-7+le...
CVE-2009-3086
A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, leaks information about the complexity of message-digest signature verification in the cookie store, which might allow remote attackers to forge a digest via multiple attempts...
CVE-2009-3009
Ruby on Rails 2.x before 2.2.3, and 2.3.x before 2.3.4, are affected by CVE-2009-3009 due to an input sanitization flaw in a form helper that can allow cross-site scripting via malformed Unicode strings. This is a known XSS vulnerability that could enable remote attackers to inject arbitrary scri...
CVE-2009-3009
Cross-site scripting XSS vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject arbitrary web script or HTML by placing malformed Unicode strings into a form helper...
CVE-2009-3086
A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, leaks information about the complexity of message-digest signature verification in the cookie store, which might allow remote attackers to forge a digest via multiple attempts...
Ruby on Rails表单帮助程序Unicode字符串处理跨站脚本漏洞
BUGTRAQ ID: 36278 CVECAN ID: CVE-2009-3009 Ruby on Rails是一个新的Web应用程序框架，构建在Ruby语言之上。 Ruby on Rails的表单帮助程序中的转义代码存在跨站脚本漏洞，远程攻击者可以通过向其提交恶意的Unicode字符串绕过转义检查，在用户浏览器会话中注入并执行任意HTML代码。 David Heinemeier Hansson Ruby on Rails 2.x 厂商补丁： David Heinemeier Hansson ------------------------...
CVE-2009-3086: Exposure of Sensitive Information to an Unauthorized Actor
A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, leaks information about the complexity of message-digest signature verification in the cookie store, which might allow remote attackers to forge a digest via multiple attempts...