SQL Injection

Ruby on Rails contains a flaw related to the way ActiveRecord handles parameters in conjunction with the way Rack parses query parameters. This issue may allow an attacker to inject arbitrary IS NULL clauses in to application SQL queries. This may also allow an attacker to have the SQL query chec...

CVE-2012-2661: Improper Neutralization of Special Elements used in an SQL Command

The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query...

PT-2012-4188

Name of the Vulnerable Software and Affected Versions Ruby on Rails versions prior to 2.3.15 Ruby on Rails versions 3.0.x through 3.0.14 Ruby on Rails versions 3.1.x through 3.1.6 Ruby on Rails versions 3.2.x through 3.2.6 Description The Active Record component in Ruby on Rails does not properly...

CVE-2012-2660: Undefined Security Weakness

actionpack/lib/actiondispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended...

PT-2012-4165

Name of the Vulnerable Software and Affected Versions Ruby on Rails versions prior to 2.3.16 Ruby on Rails versions 3.0.x through 3.0.12 Ruby on Rails versions 3.1.x through 3.1.4 Ruby on Rails versions 3.2.x through 3.2.3 Description The issue allows remote attackers to bypass intended...

CVE-2012-2694: Undefined Security Weakness

actionpack/lib/actiondispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended...

PT-2012-4187

Name of the Vulnerable Software and Affected Versions Ruby on Rails versions 3.0.0 through 3.0.13 Ruby on Rails versions 3.1.0 through 3.1.5 Ruby on Rails versions 3.2.0 through 3.2.5 Description The issue arises from improper consideration of differences in parameter handling between the Active...

PT-2012-4166

Name of the Vulnerable Software and Affected Versions Ruby on Rails versions 3.0.x through 3.0.12 Ruby on Rails versions 3.1.x through 3.1.4 Ruby on Rails versions 3.2.x through 3.2.3 Description The issue is related to the Active Record component, which does not properly handle the passing of...

CVE-2012-2695: Improper Neutralization of Special Elements used in an SQL Command

The Active Record component in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query...

Ruby on Rails嵌套参数SQL注入漏洞

CVE ID: CVE-2012-2694,CVE-2012-2695 Ruby on Rails简称RoR或Rails，是一个使用Ruby语言写的开源Web应用框架，它是严格按照MVC结构开发的。 Ruby on Rails 3.2.6、3.1.6、3.0.14之前版本在SQL查询中使用了没有正确验证的输入，这些输入是通过嵌套查询参数传递到Active Record接口的，通过注入SQL代码操作SQL查询。在使用ActionPack时参数解析Rack的方式中也存在漏洞，可允许插入"IS NULL"到SQL查询。 0 Ruby on Rails 3.2.x Ruby on Rails...

SQL Injection Vulnerability in Ruby on Rails

CVE-2012-2661 Ruby on Rails是一款Web应用程序框架，构建在Ruby语言之上 存在一个SQL注入漏洞，问题存在于Active Record处理嵌套查询参数，攻击者可以使用特制请求注入SQL语句。 受影响代码直接把请求参数传递给ActiveRecord类的where方法，如Post.where:id = params:id.all。攻击者可以提交请求使params:id返回特制哈希使WHERE子句使用某些值查询任意表 Impacted code directly passes request params to the where method of an...

Debian: Security Advisory (DSA-2466-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian Security Advisory DSA 2466-1 (rails)

The remote host is missing an update to rails announced via advisory DSA 2466-1. OpenVAS Vulnerability Test $Id: deb24661.nasl 6612 2017-07-07 12:08:03Z cfischer $ Description: Auto-generated from advisory DSA 2466-1 rails Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft Inc...

CVE-2012-2661 rubygem-activerecord: SQL injection when processing nested query paramaters

The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query...

CVE-2012-2660 rubygem-actionpack: Unsafe query generation

actionpack/lib/actiondispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended...

[SECURITY] [DSA 2466-1] rails security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2466-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst May 09, 2012 http://www.debian.org/security/faq -...

[SECURITY] [DSA 2466-1] rails security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2466-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst May 09, 2012 http://www.debian.org/security/faq -...

DSA-2466-1 rails - cross site scripting

Bulletin has no description...

Fedora Update for rubygem-rails FEDORA-2011-11386

Check for the Version of rubygem-rails OpenVAS Vulnerability Test Fedora Update for rubygem-rails FEDORA-2011-11386 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

Fedora Update for rubygem-rails FEDORA-2011-11386

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...