Lucene search
+L

11039 matches found

Hacker One
Hacker One
•added 2014/07/15 4:03 p.m.•26 views

HackerOne: No option to logout concurrent sessions

Description When I login to Hackerone using two different computers I can easily browse the session concurrently . This means that if an attacker somehow knows password of user by any means he can login using that info and the main user will not get notified. FIX If someone else login to a accoun...

2AI score
SaveExploits0
RedHat Linux
RedHat Linux
•added 2014/07/14 4:25 p.m.•35 views

Moderate: Red Hat Security Advisory: ror40-rubygem-activerecord security update

Updated ror40-rubygem-activerecord packages that fix one security issue are now available for Red Hat Software Collections 1. The Red Hat Security Response Team has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

7.5CVSS5.8AI score0.04181EPSS
SaveExploits0References2
RedHat Linux
RedHat Linux
•added 2014/07/14 4:25 p.m.•13 views

rubygem-activerecord: SQL injection vulnerability in 'range' quoting

It was discovered that Active Record did not properly quote values of the range type attributes when using the PostgreSQL database adapter. A remote attacker could possibly use this flaw to conduct an SQL injection attack against applications using Active Record...

7.5CVSS5.9AI score0.04181EPSS
SaveExploits0References4
RedHat Linux
RedHat Linux
•added 2014/07/14 4:15 p.m.•35 views

Moderate: Red Hat Security Advisory: ruby193-rubygem-activerecord security update

Updated ruby193-rubygem-activerecord packages that fix one security issue are now available for Red Hat Software Collections 1. The Red Hat Security Response Team has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detaile...

7.5CVSS7.2AI score0.04278EPSS
SaveExploits0References2
RedHat Linux
RedHat Linux
•added 2014/07/14 4:15 p.m.•8 views

rubygem-activerecord: SQL injection vulnerability in 'bitstring' quoting

It was discovered that Active Record did not properly quote values of the bitstring type attributes when using the PostgreSQL database adapter. A remote attacker could possibly use this flaw to conduct an SQL injection attack against applications using Active Record...

7.5CVSS7.2AI score0.04278EPSS
SaveExploits0References4
Hacker One
Hacker One
•added 2014/07/10 6:00 a.m.•112 views

HackerOne: Session Hijacking attack (Different Scenario)

Hey I was able to replay a cookie of a current active session and hijack that by replaying the cookie. Now this is different from any conventional vanilla session hijacking because it works even when the user is not logged in. But the condition is that the victim's session must be active at the...

0.6AI score
SaveExploits0
OSV
OSV
•added 2014/07/07 11:01 a.m.•12 views

CVE-2014-3482

SQL injection vulnerability in activerecord/lib/activerecord/connectionadapters/postgresqladapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting...

8.1AI score
SaveExploits0References8
OSV
OSV
•added 2014/07/07 11:01 a.m.•7 views

DEBIAN-CVE-2014-3482

SQL injection vulnerability in activerecord/lib/activerecord/connectionadapters/postgresqladapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting...

7.5CVSS8.4AI score0.04278EPSS
SaveExploits0References1
NVD
NVD
•added 2014/07/07 11:01 a.m.•24 views

CVE-2014-3482

SQL injection vulnerability in activerecord/lib/activerecord/connectionadapters/postgresqladapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting...

7.5CVSS8.2AI score0.04278EPSS
SaveExploits0References8
OSV
OSV
•added 2014/07/07 11:01 a.m.•7 views

DEBIAN-CVE-2014-3483

SQL injection vulnerability in activerecord/lib/activerecord/connectionadapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting...

7.5CVSS8.8AI score0.04181EPSS
SaveExploits0References1
OSV
OSV
•added 2014/07/07 11:01 a.m.•11 views

CVE-2014-3483

SQL injection vulnerability in activerecord/lib/activerecord/connectionadapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting...

8.1AI score
SaveExploits0References7
CVE
CVE
•added 2014/07/07 10:00 a.m.•105 views

CVE-2014-3482

CVE-2014-3482 is a SQL-injection flaw in the PostgreSQL adapter of ActiveRecord (Rails) for Rails 2.x and 3.x before 3.2.19. The root cause is improper bitstring quoting in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb, allowing remote ARBITRARY SQL execution. Public ad...

7.5CVSS8.3AI score0.04278EPSS
SaveExploits0References8Affected Software2
CVE
CVE
•added 2014/07/07 10:00 a.m.•129 views

CVE-2014-3483

CVE-2014-3483 is a SQL injection vulnerability in the PostgreSQL adapter for Active Record (Ruby on Rails). The flaw resides in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb, where improper range quoting allows remote attackers to execute arbitrary SQL commands. Affecte...

7.5CVSS8.2AI score0.04181EPSS
SaveExploits0References7Affected Software1
Debian CVE
Debian CVE
•added 2014/07/07 10:00 a.m.•110 views

CVE-2014-3483

SQL injection vulnerability in activerecord/lib/activerecord/connectionadapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting...

7.5CVSS8.3AI score0.04181EPSS
SaveExploits0
Hacker One
Hacker One
•added 2014/07/02 12:00 a.m.•170 views

Ruby on Rails: Active Record SQL Injection Vulnerability Affecting PostgreSQL

This vulnerability was reported directly to Rails. https://groups.google.com/forum/!msg/rubyonrails-security/wDxePLJGZdI/WP7EasCJTA4J...

7.5CVSS6.3AI score0.04181EPSS
SaveExploits0
RubySec
RubySec
•added 2014/07/02 12:00 a.m.•51 views

CVE-2014-3482 rubygem-activerecord: SQL injection vulnerability in 'bitstring' quoting

SQL injection vulnerability in activerecord/lib/activerecord/connectionadapters/postgresqladapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting. It was...

7.5CVSS8.2AI score0.04278EPSS
SaveExploits0References1Affected Software1
RubySec
RubySec
•added 2014/07/02 12:00 a.m.•39 views

CVE-2014-3483 rubygem-activerecord: SQL injection vulnerability in 'range' quoting

SQL injection vulnerability in activerecord/lib/activerecord/connectionadapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting...

7.5CVSS3.5AI score0.04181EPSS
SaveExploits0References1Affected Software1
Hacker One
Hacker One
•added 2014/07/02 12:00 a.m.•80 views

Ruby on Rails: Active Record SQL Injection Vulnerability Affecting PostgreSQL

This vulnerability was reported directly to Rails. https://groups.google.com/forum/!msg/rubyonrails-security/wDxePLJGZdI/WP7EasCJTA4J...

7.5CVSS6.3AI score0.04278EPSS
SaveExploits0
seebug.org
seebug.org
•added 2014/07/01 12:00 a.m.•30 views

GoAhead WebServer 2.1 - Remote Arbitrary Command Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/5464/info GoAhead WebServer is an Open Source embedded web server which supports Active Server Pages, embedded javascript, and SSL authentication and encryption. It is available for a variety of platforms including...

7.1AI score
SaveExploits0
seebug.org
seebug.org
•added 2014/07/01 12:00 a.m.•25 views

Active News Manager LOGIN.ASP SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/13759/info Active News Manager is prone to an SQL injection vulnerability. This issue affects the 'login.asp' script. Successful exploitation could result in a compromise of the application, disclosure or modification of...

7.1AI score
SaveExploits0
Rows per page
Query Builder