2121 matches found
Gentoo Security Advisory GLSA 200912-02 (rails)
The remote host is missing updates announced in advisory GLSA 200912-02. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...
Gentoo Security Advisory GLSA 200912-02 (rails)
The remote host is missing updates announced in advisory GLSA 200912-02. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR GPL-3.0-only...
Ruby on Rails消息Digest验证非固定时间算法漏洞
BUGTRAQ ID: 37427 CVE ID: CVE-2009-3086 Ruby on Rails是一个新的Web应用程序框架，构建在Ruby语言之上。 Ruby on Rails用于验证cookie store中消息digest的代码中存在漏洞。由于使用了非固定的时间算法来验证时间签名，攻击者可以判断伪造的签名在何时为部分正确，反复执行这个过程就可以成功的伪造出digest。 David Heinemeier Hansson Ruby on Rails 2.x 厂商补丁： David Heinemeier Hansson ------------------------...
GLSA-200912-02 : Ruby on Rails: Multiple vulnerabilities
The remote host is affected by the vulnerability described in GLSA-200912-02 Ruby on Rails: Multiple vulnerabilities The following vulnerabilities were discovered: sameer reported that lib/actioncontroller/cgiprocess.rb removes the :cookieonly attribute from the default session options...
Redmine 0.8.7 UTF-7 Cross Site Scripting
Redmine prior to . Thus it may be possible to create a page with encoded to UTF-7 JavaScript in title and it will be executed in Internet Explorer 7/8 with Auto-Select encoding on Proof-of-Concept: 1. Create new issue with title "+ADw-script+AD4-alert'XSS';+ADw-/script+AD4-" without quotes 2. Ope...
Ruby on Rails: Multiple vulnerabilities
Background Ruby on Rails is a web-application and persistence framework. Description The following vulnerabilities were discovered: sameer reported that lib/actioncontroller/cgiprocess.rb removes the :cookieonly attribute from the default session options CVE-2007-6077, due to an incomplete fix fo...
Redmine <= 0.8.7 UTF-7 XSS Vulnerability
No description provided by source. Redmine = 0.8.7 UTF-7 XSS Vulnerability Discovered by: p0deje http://p0deje.blogspot.com Application: http://www.redmine.org/wiki/redmine/Download SA: - Date: 01.12.2009 Versions affected: = 0.8.7 Vulnerability: Cross-site Scripting Platform: Ruby Ruby On Rails...
Ruby on Rails 'protect_from_forgery'跨站脚本请求伪造漏洞
Bugraq ID: 37322 CVE ID：CVE-2009-4136 Ruby on Rails是一款Web应用程序框架，构建在Ruby语言之上。 Ruby on Rails 'protectfromforgery'存在跨站请求伪造攻击，远程攻击者可以利用漏洞执行部分管理员操作，获得对应用程序的未授权访问或删除部分数据。 Ruby on Rails Ruby on Rails 2.3.5 Ruby on Rails Ruby on Rails 2.3.4 Ruby on Rails Ruby on Rails 2.3.3 Ruby on Rails Ruby on Rails...
CVE-2008-7248
Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery CSRF protection for requests to applications that rely on this protection, as demonstrated using text/plain...
CVE-2008-7248
Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery CSRF protection for requests to applications that rely on this protection, as demonstrated using text/plain...
CVE-2008-7248
Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery CSRF protection for requests to applications that rely on this protection, as demonstrated using text/plain...
Cross site request forgery (csrf)
Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery CSRF protection for requests to applications that rely on this protection, as demonstrated using text/plain...
CVE-2008-7248
Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery CSRF protection for requests to applications that rely on this protection, as demonstrated using text/plain...
CVE-2008-7248
Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery CSRF protection for requests to applications that rely on this protection, as demonstrated using text/plain...
PT-2009-2715 · Ruby · Ruby On Rails
Name of the Vulnerable Software and Affected Versions: Ruby on Rails versions 2.1 through 2.1.3 and versions 2.2.x through 2.2.2 Description: The issue allows remote attackers to bypass cross-site request forgery CSRF protection for requests to applications that rely on this protection. This is...
Ruby on Rails 2.3.5 - protect_from_forgery Cross-Site Request Forgery
Ruby on Rails 2.3.5 - protectfromforgery Cross-Site Request Forgery source: https://www.securityfocus.com/bid/37322/info Ruby on Rails is prone to a cross-site request-forgery vulnerability. Exploiting this issue may allow a remote attacker to perform certain administrative actions, gain...
Redmine <= 0.8.6 CSRF Add Admin User Exploit
Exploit for unknown platform in category web applications ============================================ Redmine input style="display: none" type="checkbox" value="1" name="us...
Redmine <= 0.8.6 CSRF Add Admin User Exploit
No description provided by source. / Redmine = 0.8.6 CSRF Add Admin User Exploit Discovered by: p0deje http://p0deje.blogspot.com Application: http://www.redmine.org/wiki/redmine/Download SA: http://www.redmine.org/news/30 Date: 13.11.2009 Versions affected: = 0.8.6 Vulnerability: Cross-site...
