11037 matches found
rubygem-activerecord: SQL injection vulnerability in 'range' quoting
It was discovered that Active Record did not properly quote values of the range type attributes when using the PostgreSQL database adapter. A remote attacker could possibly use this flaw to conduct an SQL injection attack against applications using Active Record...
Moderate: Red Hat Security Advisory: ruby193-rubygem-activerecord security update
Updated ruby193-rubygem-activerecord packages that fix one security issue are now available for Red Hat Software Collections 1. The Red Hat Security Response Team has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detaile...
rubygem-activerecord: SQL injection vulnerability in 'bitstring' quoting
It was discovered that Active Record did not properly quote values of the bitstring type attributes when using the PostgreSQL database adapter. A remote attacker could possibly use this flaw to conduct an SQL injection attack against applications using Active Record...
HackerOne: Session Hijacking attack (Different Scenario)
Hey I was able to replay a cookie of a current active session and hijack that by replaying the cookie. Now this is different from any conventional vanilla session hijacking because it works even when the user is not logged in. But the condition is that the victim's session must be active at the...
CVE-2014-3482
SQL injection vulnerability in activerecord/lib/activerecord/connectionadapters/postgresqladapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting...
DEBIAN-CVE-2014-3482
SQL injection vulnerability in activerecord/lib/activerecord/connectionadapters/postgresqladapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting...
CVE-2014-3482
SQL injection vulnerability in activerecord/lib/activerecord/connectionadapters/postgresqladapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting...
DEBIAN-CVE-2014-3483
SQL injection vulnerability in activerecord/lib/activerecord/connectionadapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting...
CVE-2014-3483
SQL injection vulnerability in activerecord/lib/activerecord/connectionadapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting...
CVE-2014-3482
CVE-2014-3482 is a SQL-injection flaw in the PostgreSQL adapter of ActiveRecord (Rails) for Rails 2.x and 3.x before 3.2.19. The root cause is improper bitstring quoting in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb, allowing remote ARBITRARY SQL execution. Public ad...
CVE-2014-3483
CVE-2014-3483 is a SQL injection vulnerability in the PostgreSQL adapter for Active Record (Ruby on Rails). The flaw resides in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb, where improper range quoting allows remote attackers to execute arbitrary SQL commands. Affecte...
CVE-2014-3483
SQL injection vulnerability in activerecord/lib/activerecord/connectionadapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting...
Ruby on Rails: Active Record SQL Injection Vulnerability Affecting PostgreSQL
This vulnerability was reported directly to Rails. https://groups.google.com/forum/!msg/rubyonrails-security/wDxePLJGZdI/WP7EasCJTA4J...
CVE-2014-3482 rubygem-activerecord: SQL injection vulnerability in 'bitstring' quoting
SQL injection vulnerability in activerecord/lib/activerecord/connectionadapters/postgresqladapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting. It was...
Ruby on Rails: Active Record SQL Injection Vulnerability Affecting PostgreSQL
This vulnerability was reported directly to Rails. https://groups.google.com/forum/!msg/rubyonrails-security/wDxePLJGZdI/WP7EasCJTA4J...
CVE-2014-3483 rubygem-activerecord: SQL injection vulnerability in 'range' quoting
SQL injection vulnerability in activerecord/lib/activerecord/connectionadapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting...
GoAhead WebServer 2.1 - Remote Arbitrary Command Execution Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/5464/info GoAhead WebServer is an Open Source embedded web server which supports Active Server Pages, embedded javascript, and SSL authentication and encryption. It is available for a variety of platforms including...
Active Bulletin Board <= 1.1b2 Remote User Pass Change Exploit
No description provided by source...
Active News Manager LOGIN.ASP SQL Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/13759/info Active News Manager is prone to an SQL injection vulnerability. This issue affects the 'login.asp' script. Successful exploitation could result in a compromise of the application, disclosure or modification of...
Active News Manager activeNews_comments.asp articleID Parameter SQL Injection
No description provided by source. source: http://www.securityfocus.com/bid/21167/info Active News Manger is prone to multiple input-validation vulnerabilities, including SQL-injection issues and a cross-site scripting issue, because it fails to sufficiently sanitize user-supplied data. Exploitin...