DEBIAN-CVE-2013-0233

Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass...

Moderate: Red Hat Security Advisory: rubygem packages security update

This update fixes one security issue in multiple rubygem packages for Red Hat OpenShift Enterprise 1.1.3. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Ruby on Rails Active Record组件SQL注入漏洞(CVE-2012-6496)

CVE ID:CVE-2012-6496 Ruby on Rails是一款Web应用程序框架，构建在Ruby语言之上。 Ruby on Rails Active Record组件存在一个SQL注入漏洞，允许攻击者利用"findby"方法进行SQL注入攻击，可获得敏感信息或控制应用系统。 0 Ruby on Rails 3.0.x Ruby on Rails 3.1.x Ruby on Rails 3.2.x 厂商解决方案 Ruby on Rails 3.0.18，3.1.9和3.2.10已经修复此漏洞，建议用户下载使用： http://www.ruby-lang.org...

Ruby on Rails Authlogic gem SQL注入漏洞

CVE ID: CVE-2012-5664 Ruby on Rails是一款Web应用程序框架，构建在Ruby语言之上 AuthLogic gem实现存在一个SQL注入漏洞，如果Ruby on Rails应用使用AuthLogic gem进行验证，并且攻击者在能访问Rails应用的私钥的情况下，可绕过安全限制进行未授权访问 0 Ruby on Rails 厂商补丁： Ruby on Rails ---------- 目前没有详细解决方案提供： http://rubygems.org/gems/authlogic...

Ruby on Rails多个跨站脚本执行漏洞

BUGTRAQ ID: 52264 Ruby on Rails简称RoR或Rails，是一个使用Ruby语言写的开源Web应用框架，它是严格按照MVC结构开发的。 通过SafeBuffer直接操作传递的输入没有正确过滤，通过手动生成的选择标签传递的某些输入没有正确过滤，导致在用户浏览器中执行任意HTML和脚本代码 0 Ruby on Rails 3.2.x Ruby on Rails 3.1.x Ruby on Rails 3.0.x 厂商补丁： Ruby ---- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.ruby-lang.org/...

irb, ruby security update

CentOS Errata and Security Advisory CESA-2012:0070 Updated ruby packages that fix two security issues are now available for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base...

CentOS Update for irb CESA-2011:0908 centos4 i386

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Ruby on Rails跨站脚本执行及跨站请求伪造漏洞

BUGTRAQ ID: 46291 CVE ID: CVE-2011-0446,CVE-2011-0447 Ruby on Rails简称RoR或Rails，是一个使用Ruby语言写的开源Web应用框架，它是严格按照MVC结构开发的。 Ruby on Rails在实现上存在跨站脚本执行和跨站请求伪造漏洞，攻击者可利用跨站脚本执行漏洞在受影响浏览器中执行任意脚本代码，窃取Cookie验证凭证。 Ruby on Rails Ruby on Rails 3.x Ruby on Rails Ruby on Rails 2.x Ruby on Rails Ruby on Rails 1.x 厂商补...

CVE-2010-3119

Google Chrome before 5.0.375.127 and webkitgtk before 1.2.6 do not properly support the Ruby language, which allows attackers to cause a denial of service memory corruption or possibly have unspecified other impact via unknown vectors...

Memory corruption

Google Chrome before 5.0.375.127 and webkitgtk before 1.2.6 do not properly support the Ruby language, which allows attackers to cause a denial of service memory corruption or possibly have unspecified other impact via unknown vectors...

CVE-2010-3119

Google Chrome before 5.0.375.127 and webkitgtk before 1.2.6 do not properly support the Ruby language, which allows attackers to cause a denial of service memory corruption or possibly have unspecified other impact via unknown vectors...

CVE-2010-3119

Removed by vendor...

CVE-2010-3119

Google Chrome before 5.0.375.127 and webkitgtk before 1.2.6 do not properly support the Ruby language, which allows attackers to cause a denial of service memory corruption or possibly have unspecified other impact via unknown vectors...

Fedora Update for ruby FEDORA-2010-0530

Check for the Version of ruby OpenVAS Vulnerability Test Fedora Update for ruby FEDORA-2010-0530 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms of...

Ruby on Rails http_authentication.rb Nil凭据绕过认证漏洞

BUGTRAQ ID: 35579 Ruby on Rails是一个新的Web应用程序框架，构建在Ruby语言之上。 Ruby on Rails的actionpack/lib/actioncontroller/httpauthentication.rb文件中的 validatedigestresponse函数在处理nil凭据时存在错误，如果没有找到用户返回的是nil，而正确的行为是返回 false。远程攻击者发送空的认证凭据就可以绕过HTTP认证获得非授权访问。 David Heinemeier Hansson Ruby on Rails 2.3.2 厂商补丁： David...

Debian Security Advisory DSA 1618-1 (ruby1.9)

The remote host is missing an update to ruby1.9 announced via advisory DSA 1618-1. OpenVAS Vulnerability Test $Id: deb16181.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1618-1 ruby1.9 Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

Ruby存在安全绕过和拒绝服务漏洞

BUGTRAQ ID: 30644 CNCAN ID：CNCAN-2008081415 Ruby是一种功能强大的面向对象的脚本语言。 Ruby的1.8.6-p287或1.8.7-p72之前版本存在多个安全漏洞，远程攻击者可以利用漏洞绕过某些安全限制、造成拒绝服务或执行欺骗攻击。 1 安全等级限制实现中存在多个错误，可导致在第4安全层调用untracevar、执行syslog操作、修改$PROGRAMNAME，或在1到3层调用不安全的方法。 2...

[SECURITY] [DSA 1618-1] New ruby1.9 packages fix several vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-1618-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff July 26, 2008 http://www.debian.org/security/faq -...

DSA-1618-1 ruby1.9 - several vulnerabilities

Bulletin has no description...

Debian DSA-1612-1 : ruby1.8 - several vulnerabilities

Several vulnerabilities have been discovered in the interpreter for the Ruby language, which may lead to denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2008-2662 Drew Yao discovered that multiple...