Ruby on Rails消息Digest验证非固定时间算法漏洞

BUGTRAQ ID: 37427 CVE ID: CVE-2009-3086 Ruby on Rails是一个新的Web应用程序框架，构建在Ruby语言之上。 Ruby on Rails用于验证cookie store中消息digest的代码中存在漏洞。由于使用了非固定的时间算法来验证时间签名，攻击者可以判断伪造的签名在何时为部分正确，反复执行这个过程就可以成功的伪造出digest。 David Heinemeier Hansson Ruby on Rails 2.x 厂商补丁： David Heinemeier Hansson ------------------------...

GLSA-200912-02 : Ruby on Rails: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200912-02 Ruby on Rails: Multiple vulnerabilities The following vulnerabilities were discovered: sameer reported that lib/actioncontroller/cgiprocess.rb removes the :cookieonly attribute from the default session options...

Redmine 0.8.7 UTF-7 Cross Site Scripting

Redmine prior to . Thus it may be possible to create a page with encoded to UTF-7 JavaScript in title and it will be executed in Internet Explorer 7/8 with Auto-Select encoding on Proof-of-Concept: 1. Create new issue with title "+ADw-script+AD4-alert'XSS';+ADw-/script+AD4-" without quotes 2. Ope...

Ruby on Rails: Multiple vulnerabilities

Background Ruby on Rails is a web-application and persistence framework. Description The following vulnerabilities were discovered: sameer reported that lib/actioncontroller/cgiprocess.rb removes the :cookieonly attribute from the default session options CVE-2007-6077, due to an incomplete fix fo...

Redmine <= 0.8.7 UTF-7 XSS Vulnerability

No description provided by source. Redmine = 0.8.7 UTF-7 XSS Vulnerability Discovered by: p0deje http://p0deje.blogspot.com Application: http://www.redmine.org/wiki/redmine/Download SA: - Date: 01.12.2009 Versions affected: = 0.8.7 Vulnerability: Cross-site Scripting Platform: Ruby Ruby On Rails...

Ruby on Rails 'protect_from_forgery'跨站脚本请求伪造漏洞

Bugraq ID: 37322 CVE ID：CVE-2009-4136 Ruby on Rails是一款Web应用程序框架，构建在Ruby语言之上。 Ruby on Rails 'protectfromforgery'存在跨站请求伪造攻击，远程攻击者可以利用漏洞执行部分管理员操作，获得对应用程序的未授权访问或删除部分数据。 Ruby on Rails Ruby on Rails 2.3.5 Ruby on Rails Ruby on Rails 2.3.4 Ruby on Rails Ruby on Rails 2.3.3 Ruby on Rails Ruby on Rails...

CVE-2008-7248

Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery CSRF protection for requests to applications that rely on this protection, as demonstrated using text/plain...

CVE-2008-7248

Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery CSRF protection for requests to applications that rely on this protection, as demonstrated using text/plain...

Cross site request forgery (csrf)

Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery CSRF protection for requests to applications that rely on this protection, as demonstrated using text/plain...

DEBIAN-CVE-2008-7248

Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery CSRF protection for requests to applications that rely on this protection, as demonstrated using text/plain...

CVE-2008-7248

Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery CSRF protection for requests to applications that rely on this protection, as demonstrated using text/plain...

CVE-2008-7248

Affected software / component: Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 in which CSRF protection relies on token verification. Vulnerability / root cause: Rails CSRF protection can be bypassed because tokens are not verified for requests with certain content types (demonstrated with ...

CVE-2008-7248

Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery CSRF protection for requests to applications that rely on this protection, as demonstrated using text/plain...

CVE-2008-7248

Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery CSRF protection for requests to applications that rely on this protection, as demonstrated using text/plain...

PT-2009-2715 · Ruby · Ruby On Rails

Name of the Vulnerable Software and Affected Versions: Ruby on Rails versions 2.1 through 2.1.3 and versions 2.2.x through 2.2.2 Description: The issue allows remote attackers to bypass cross-site request forgery CSRF protection for requests to applications that rely on this protection. This is...

Redmine <= 0.8.6 CSRF Add Admin User Exploit

No description provided by source. / Redmine = 0.8.6 CSRF Add Admin User Exploit Discovered by: p0deje http://p0deje.blogspot.com Application: http://www.redmine.org/wiki/redmine/Download SA: http://www.redmine.org/news/30 Date: 13.11.2009 Versions affected: = 0.8.6 Vulnerability: Cross-site...

Redmine 0.8.6 - Cross-Site Request Forgery (Add Admin)

Redmine 0.8.6 - Cross-Site Request Forgery Add Admin / Redmine...

Redmine <= 0.8.6 CSRF Add Admin User Exploit

Exploit for unknown platform in category web applications ============================================ Redmine input style="display: none" type="checkbox" value="1" name="us...

Ruby on Rails 2.3.5 - protect_from_forgery Cross-Site Request Forgery

Ruby on Rails 2.3.5 - protectfromforgery Cross-Site Request Forgery source: https://www.securityfocus.com/bid/37322/info Ruby on Rails is prone to a cross-site request-forgery vulnerability. Exploiting this issue may allow a remote attacker to perform certain administrative actions, gain...

Ruby on Rails 2.3.5 - 'protect_from_forgery' Cross-Site Request Forgery

source: https://www.securityfocus.com/bid/37322/info Ruby on Rails is prone to a cross-site request-forgery vulnerability. Exploiting this issue may allow a remote attacker to perform certain administrative actions, gain unauthorized access to the affected application, or delete certain data. Oth...