CVE-2011-0447

Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery CSRF attacks via forged 1 AJAX or 2 API requests that...

CVE-2011-0446

Multiple cross-site scripting XSS vulnerabilities in the mailto helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted 1 name or 2 email value...

Ruby on Rails Security Bypass Vulnerability (Nov 2010)

Ruby on Rails is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:rubyonrails:rails";...

Spree e-commerce JSON Hijacking Vulnerabilities - CVE-2010-3978

Dear List, I'm writing on behalf of the Check Point Vulnerability Discovery Team to publish the following vulnerability. Check Point Software Technologies - Vulnerability Discovery Team VDT http://www.checkpoint.com/defense/ Spree e-commerce JSON Hijacking Vulnerabilities CVE-2010-3978 INTRODUCTI...

CVE-2010-3933

Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs...

Design/Logic Flaw

Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs...

CVE-2010-3933

Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs...

CVE-2010-3933

CVE-2010-3933 affects Ruby on Rails 2.3.9 and 3.0.0, where nested attributes are not handled securely. The root cause is improper handling of nested attributes, enabling a remote attacker to modify arbitrary records by altering parameter names for form inputs. Reports in connected sources corrobo...

Ruby on Rails CSRF Vulnerability (Feb 2011)

Ruby on Rails is prone to cross-site request forgery CSRF vulnerabilities. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Ruby on Rails (RoR) / Ruby Detection (HTTP)

HTTP based detection of Ruby on Rails RoR. In addition this script also tries to detect Ruby itself. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Ruby on Rails 'unicode strings' XSS Vulnerability (Sep 2009)

Ruby on Rails is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Ruby on Rails 'protect_from_forgery' Cross Site Request Forgery Vuln

Exploit for unknown platform in category web applications ============================================================================= Ruby on Rails 'protectfromforgery' Cross Site Request Forgery Vulnerability =============================================================================...

Gentoo Security Advisory GLSA 200912-02 (rails)

The remote host is missing updates announced in advisory GLSA 200912-02. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR GPL-3.0-only...

Gentoo Security Advisory GLSA 200912-02 (rails)

The remote host is missing updates announced in advisory GLSA 200912-02. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Ruby on Rails消息Digest验证非固定时间算法漏洞

BUGTRAQ ID: 37427 CVE ID: CVE-2009-3086 Ruby on Rails是一个新的Web应用程序框架，构建在Ruby语言之上。 Ruby on Rails用于验证cookie store中消息digest的代码中存在漏洞。由于使用了非固定的时间算法来验证时间签名，攻击者可以判断伪造的签名在何时为部分正确，反复执行这个过程就可以成功的伪造出digest。 David Heinemeier Hansson Ruby on Rails 2.x 厂商补丁： David Heinemeier Hansson ------------------------...

GLSA-200912-02 : Ruby on Rails: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200912-02 Ruby on Rails: Multiple vulnerabilities The following vulnerabilities were discovered: sameer reported that lib/actioncontroller/cgiprocess.rb removes the :cookieonly attribute from the default session options...

Redmine 0.8.7 UTF-7 Cross Site Scripting

Redmine prior to . Thus it may be possible to create a page with encoded to UTF-7 JavaScript in title and it will be executed in Internet Explorer 7/8 with Auto-Select encoding on Proof-of-Concept: 1. Create new issue with title "+ADw-script+AD4-alert'XSS';+ADw-/script+AD4-" without quotes 2. Ope...

Ruby on Rails: Multiple vulnerabilities

Background Ruby on Rails is a web-application and persistence framework. Description The following vulnerabilities were discovered: sameer reported that lib/actioncontroller/cgiprocess.rb removes the :cookieonly attribute from the default session options CVE-2007-6077, due to an incomplete fix fo...

Redmine <= 0.8.7 UTF-7 XSS Vulnerability

No description provided by source. Redmine = 0.8.7 UTF-7 XSS Vulnerability Discovered by: p0deje http://p0deje.blogspot.com Application: http://www.redmine.org/wiki/redmine/Download SA: - Date: 01.12.2009 Versions affected: = 0.8.7 Vulnerability: Cross-site Scripting Platform: Ruby Ruby On Rails...

Ruby on Rails 'protect_from_forgery'跨站脚本请求伪造漏洞

Bugraq ID: 37322 CVE ID：CVE-2009-4136 Ruby on Rails是一款Web应用程序框架，构建在Ruby语言之上。 Ruby on Rails 'protectfromforgery'存在跨站请求伪造攻击，远程攻击者可以利用漏洞执行部分管理员操作，获得对应用程序的未授权访问或删除部分数据。 Ruby on Rails Ruby on Rails 2.3.5 Ruby on Rails Ruby on Rails 2.3.4 Ruby on Rails Ruby on Rails 2.3.3 Ruby on Rails Ruby on Rails...