CVE-2008-4094

Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the 1 :limit and 2 :offset parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer...

CVE-2008-4094

Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the 1 :limit and 2 :offset parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer...

Sql injection

Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the 1 :limit and 2 :offset parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer...

CVE-2008-4094

CVE-2008-4094 corresponds to multiple SQL injection vulnerabilities in Ruby on Rails prior to 2.1.1, exploitable via the :limit and :offset parameters in ActiveRecord (and related components). Remote attackers could cause arbitrary SQL execution and potentially affect data integrity. The linked d...

CVE-2008-4094

Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the 1 :limit and 2 :offset parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer...

CVE-2008-4094

Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the 1 :limit and 2 :offset parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer...

CVE-2008-4094: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the 1 :limit and 2 :offset parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer...

[SECURITY] Fedora 9 Update: rubygem-rails-2.1.1-2.fc9

Rails is a framework for building web-application using CGI, FCGI, modruby, or WEBrick on top of either MySQL, PostgreSQL, SQLite, DB2, SQL Server, or Oracle with eRuby- or Builder-based templates...

Gentoo Security Advisory GLSA 200711-17 (rails)

The remote host is missing updates announced in advisory GLSA 200711-17. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Gentoo Security Advisory GLSA 200608-20 (rails)

The remote host is missing updates announced in advisory GLSA 200608-20. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Gentoo Security Advisory GLSA 200711-17 (rails)

The remote host is missing updates announced in advisory GLSA 200711-17. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

FreeBSD Ports: rubygem-rails

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

FreeBSD Ports: rubygem-rails

The remote host is missing an update to the system as announced in the referenced advisory. VID 8e8b8b94-7f1d-11dd-a66a-0019666436c2 OpenVAS Vulnerability Test $ Description: Auto generated from VID 8e8b8b94-7f1d-11dd-a66a-0019666436c2 Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

Ruby on Rails ":offset"和":limit" SQL注入漏洞

Ruby on Rails是一款Web应用程序框架，构建在Ruby语言之上。 Ruby on Rails不正确处理用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，获得敏感信息。 问题是Active Record没有过滤":offset"和":limit"参数就直接作为SQL查询使用，构建恶意的SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息。 Ruby on Rails 2.1.x 升级到Ruby on Rails 2.1.1版本： http://www.rubyonrails.org/...

Ruby on Rails < 2.1.1 Active Record Multiple Parameter SQL Injection

Binary data 4679.prm...

rubygem-rails -- SQL injection vulnerability

Jonathan Weiss reports, that it is possible to perform an SQL injection in Rails applications via not correctly sanitized :limit and :offset parameters. It is possible to change arbitrary values in affected tables or gain access to the sensitive data...

FreeBSD Ports: rubygem-rails

The remote host is missing an update to the system as announced in the referenced advisory. VID 44fb0302-9d38-11dc-9114-001c2514716c OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

FreeBSD Ports: rubygem-rails

The remote host is missing an update to the system as announced in the referenced advisory. VID 90064567-28b1-11db-844d-000c6ec775d9 OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

FreeBSD Ports: rubygem-rails

The remote host is missing an update to the system as announced in the referenced advisory. VID 30acb8ae-9d46-11dc-9114-001c2514716c OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

FreeBSD Ports: rubygem-rails

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...