CVE-2011-0447

CVE-2011-0447: Ruby on Rails 2.1.x–2.3.x before 2.3.11 and 3.x before 3.0.4 fail to properly validate an X-Requested-With header in HTTP requests, enabling remote attackers to perform CSRF via forged AJAX or API requests that leverage browser plugins and redirects. Affected versions include Rails...

PT-2011-2350

Name of the Vulnerable Software and Affected Versions Ruby on Rails versions 2.1.x through 2.3.x before 2.3.11 Ruby on Rails versions 3.x before 3.0.4 Description The issue makes it easier for remote attackers to conduct cross-site request forgery CSRF attacks via forged AJAX or API requests. Thi...

CVE-2011-0446: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the mailto helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted 1 name or 2 email value...

CVE-2011-0447: Cross-Site Request Forgery (CSRF)

Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery CSRF attacks via forged 1 AJAX or 2 API requests that...

PT-2011-2349

Name of the Vulnerable Software and Affected Versions Ruby on Rails versions 2.3.11 and earlier Ruby on Rails versions 3.0.4 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via a crafted 1 name or 2 email value in the mail to helper when javascript...

Ruby on Rails Security Bypass Vulnerability (Nov 2010)

Ruby on Rails is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:rubyonrails:rails";...

Dradis v2.6 - Tool for sharing information during security testing !

"Dradis is a tool for sharing information during security testing. While plenty of tools exist to help in the different stages of the test, not so many exist to share interesting information captured. When a team of testers is working on the same set of targets, having a common repository of...

Spree e-commerce JSON Hijacking Vulnerabilities - CVE-2010-3978

Dear List, I'm writing on behalf of the Check Point Vulnerability Discovery Team to publish the following vulnerability. Check Point Software Technologies - Vulnerability Discovery Team VDT http://www.checkpoint.com/defense/ Spree e-commerce JSON Hijacking Vulnerabilities CVE-2010-3978 INTRODUCTI...

CVE-2010-3933

Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs...

Design/Logic Flaw

Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs...

CVE-2010-3933

Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs...

CVE-2010-3933

CVE-2010-3933 affects Ruby on Rails 2.3.9 and 3.0.0, where nested attributes are not handled securely. The root cause is improper handling of nested attributes, enabling a remote attacker to modify arbitrary records by altering parameter names for form inputs. Reports in connected sources corrobo...

CVE-2010-3933

Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs...

CVE-2010-3933: Improper Input Validation

Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs...

PT-2010-5174

Name of the Vulnerable Software and Affected Versions Ruby on Rails versions 2.3.9 through 3.0.0 Description The issue allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs, due to improper handling of nested attributes. Recommendations For versio...

Ruby on Rails (RoR) / Ruby Detection (HTTP)

HTTP based detection of Ruby on Rails RoR. In addition this script also tries to detect Ruby itself. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Ruby on Rails CSRF Vulnerability (Feb 2011)

Ruby on Rails is prone to cross-site request forgery CSRF vulnerabilities. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Ruby on Rails 'unicode strings' XSS Vulnerability (Sep 2009)

Ruby on Rails is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Ruby on Rails 'protect_from_forgery' Cross Site Request Forgery Vuln

Exploit for unknown platform in category web applications ============================================================================= Ruby on Rails 'protectfromforgery' Cross Site Request Forgery Vulnerability =============================================================================...

Debian DSA-1887-1 : rails - missing input sanitising

Brian Mastenbrook discovered that rails, the MVC ruby based framework geared for web application development, is prone to cross-site scripting attacks via malformed strings in the form helper. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...