954 matches found
PT-2012-4166
Name of the Vulnerable Software and Affected Versions Ruby on Rails versions 3.0.x through 3.0.12 Ruby on Rails versions 3.1.x through 3.1.4 Ruby on Rails versions 3.2.x through 3.2.3 Description The issue is related to the Active Record component, which does not properly handle the passing of...
CVE-2012-2695: Improper Neutralization of Special Elements used in an SQL Command
The Active Record component in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query...
CVE-2012-2661: Improper Neutralization of Special Elements used in an SQL Command
The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query...
SQL injection vulnerability in Active Record
Due to the way Active Record handles nested query parameters, an attacker can use a specially crafted request to inject some forms of SQL into your application's SQL queries...
http-rfi-spider NSE Script
Crawls webservers in search of RFI remote file inclusion vulnerabilities. It tests every form field it finds and every parameter of a URL containing a query. Script Arguments http-rfi-spider.withinhost only spider URLs within the same host. default: true http-rfi-spider.url the url to start...
rubygem-activerecord -- multiple vulnerabilities
rubygem-activerecord -- multiple vulernabilities Due to the way Active Record interprets parameters in combination with the way that Rack parses query parameters, it is possible for an attacker to issue unexpected database queries with "IS NULL" where clauses. This issue does not let an attacker...
couchdb -- DOM based Cross-Site Scripting via Futon UI
Jan Lehnardt reports: Query parameters passed into the browser-based test suite are not sanitised, and can be used to load external resources. An attacker may execute JavaScript code in the browser, using the context of the remote user...
CVE-2003-1372: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in links.php script in myPHPNuke 1.8.8, and possibly earlier versions, allows remote attackers to inject arbitrary HTML and web script via the 1 ratenum or 2 query parameters...
Authentication flaw
report.cgi in Google Urchin allows remote attackers to bypass authentication and obtain sensitive information web server logs via certain modified query parameters, as demonstrated using the profile, rid, prefs, n, vid, bd, ed, dt, and gtype parameters, a different vulnerability than CVE-2007-511...
CVE-2006-4822
Multiple cross-site scripting XSS vulnerabilities in index.php in eMuSOFT emuCMS 0.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 query or 2 page parameters...
CVE-2006-4822: Undefined Security Weakness
Multiple cross-site scripting XSS vulnerabilities in index.php in eMuSOFT emuCMS 0.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 query or 2 page parameters...
CVE-2005-4394
Cross-site scripting XSS vulnerability in EPiX 3.1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search query parameters...
