5174 matches found
[SECURITY] Fedora 9 Update: rubygem-rails-2.1.1-2.fc9
Rails is a framework for building web-application using CGI, FCGI, modruby, or WEBrick on top of either MySQL, PostgreSQL, SQLite, DB2, SQL Server, or Oracle with eRuby- or Builder-based templates...
Gentoo Security Advisory GLSA 200711-17 (rails)
The remote host is missing updates announced in advisory GLSA 200711-17. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...
Gentoo Security Advisory GLSA 200608-20 (rails)
The remote host is missing updates announced in advisory GLSA 200608-20. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...
Gentoo Security Advisory GLSA 200711-17 (rails)
The remote host is missing updates announced in advisory GLSA 200711-17. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
FreeBSD Ports: rubygem-rails
The remote host is missing an update to the system as announced in the referenced advisory. VID 8e8b8b94-7f1d-11dd-a66a-0019666436c2 OpenVAS Vulnerability Test $ Description: Auto generated from VID 8e8b8b94-7f1d-11dd-a66a-0019666436c2 Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...
FreeBSD Ports: rubygem-rails
The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...
Ruby on Rails < 2.1.1 Active Record Multiple Parameter SQL Injection
Binary data 4679.prm...
Ruby on Rails ":offset"和":limit" SQL注入漏洞
Ruby on Rails是一款Web应用程序框架，构建在Ruby语言之上。 Ruby on Rails不正确处理用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，获得敏感信息。 问题是Active Record没有过滤":offset"和":limit"参数就直接作为SQL查询使用，构建恶意的SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息。 Ruby on Rails 2.1.x 升级到Ruby on Rails 2.1.1版本： http://www.rubyonrails.org/...
rubygem-rails -- SQL injection vulnerability
Jonathan Weiss reports, that it is possible to perform an SQL injection in Rails applications via not correctly sanitized :limit and :offset parameters. It is possible to change arbitrary values in affected tables or gain access to the sensitive data...
FreeBSD Ports: rubygem-rails
The remote host is missing an update to the system as announced in the referenced advisory. VID 90064567-28b1-11db-844d-000c6ec775d9 OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...
FreeBSD Ports: rubygem-rails
The remote host is missing an update to the system as announced in the referenced advisory. VID 44fb0302-9d38-11dc-9114-001c2514716c OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...
FreeBSD Ports: rubygem-rails
The remote host is missing an update to the system as announced in the referenced advisory. VID 30acb8ae-9d46-11dc-9114-001c2514716c OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...
FreeBSD Ports: rubygem-rails
The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...
FreeBSD Ports: rubygem-rails
The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...
FreeBSD Ports: rubygem-rails
The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...
JVN#00945448 Redmine vulnerable to cross-site scripting
Redmine is open source project management software written by Ruby on Rails framework. Redmine contains a cross-site scripting vulnerability. Impact An arbitrary script can be executed on the user's web browser. Solution Update the Software Apply the latest update provided by the developer...
FreeBSD : rubygem-rails -- session-fixation vulnerability (30acb8ae-9d46-11dc-9114-001c2514716c)
Rails core team reports : The rails core team has released ruby on rails 1.2.6 to address a bug in the fix for session fixation attacks CVE-2007-5380. The CVE Identifier for this new issue is CVE-2007-6077. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package chec...
FreeBSD : rubygem-rails -- JSON XSS vulnerability (44fb0302-9d38-11dc-9114-001c2514716c)
Rails core team reports : All users of Rails 1.2.4 or earlier are advised to upgrade to 1.2.5, though it isn't strictly necessary if you aren't working with JSON. For more information the JSON vulnerability, see CVE-2007-3227. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...
Ruby on Rails Multiple Method Session Fixation
The web server on the remote host appears to be a version of Ruby on Rails that supports URL-based sessions. An unauthenticated, remote attacker may be able to leverage this issue to obtain an authenticated session. Note that Ruby on Rails version 1.2.4 was initially supposed to address this issu...