2189 matches found
Debian Security Advisory DSA 2301-2 (rails)
The remote host is missing an update to rails announced via advisory DSA 2301-2. OpenVAS Vulnerability Test $Id: deb23012.nasl 6612 2017-07-07 12:08:03Z cfischer $ Description: Auto-generated from advisory DSA 2301-2 rails Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft Inc...
Gitorious Remote Command Execution
Phenoelit Advisory Authors joernchen Phenoelit Group http://www.phenoelit.de Affected Products Gitorious 2.1.1 http://gitorious.org Vendor communication 2012-01-16 Asking vendor for PGP key 2012-01-17 Getting PGP key from vendor 2012-01-17 Sending vulnerability details to vendor 2012-01-19 Vendor...
Fedora 15 : rubygem-actionpack-3.0.5-5.fc15 (2012-0626)
A cross-site scripting XSS flaw was found in the way the 'translate' helper method of the Ruby on Rails performed HTML escaping of interpolated user input, when interpolation in combination with HTML-safe translations were used. This release fixes the bug. Note that Tenable Network Security has...
Fedora 16 : rubygem-actionpack-3.0.10-2.fc16 (2012-0643)
A cross-site scripting XSS flaw was found in the way the 'translate' helper method of the Ruby on Rails performed HTML escaping of interpolated user input, when interpolation in combination with HTML-safe translations were used. This release fixes the bug. Note that Tenable Network Security has...
[SECURITY] [DSA 2301-2] rails regression
------------------------------------------------------------------------- Debian Security Advisory DSA-2392-1 [email protected] http://www.debian.org/security/ January 23, 2012 http://www.debian.org/security/faq - ------------------------------------------------------------------------- Package...
CVE-2011-4319
Cross-site scripting XSS vulnerability in the i18n translations helper method in Ruby on Rails 3.0.x before 3.0.11 and 3.1.x before 3.1.2, and the railsxss plugin in Ruby on Rails 2.3.x, allows remote attackers to inject arbitrary web script or HTML via vectors related to a translations string...
Cross site scripting
Cross-site scripting XSS vulnerability in the i18n translations helper method in Ruby on Rails 3.0.x before 3.0.11 and 3.1.x before 3.1.2, and the railsxss plugin in Ruby on Rails 2.3.x, allows remote attackers to inject arbitrary web script or HTML via vectors related to a translations string...
CVE-2011-4319
Cross-site scripting XSS vulnerability in the i18n translations helper method in Ruby on Rails 3.0.x before 3.0.11 and 3.1.x before 3.1.2, and the railsxss plugin in Ruby on Rails 2.3.x, allows remote attackers to inject arbitrary web script or HTML via vectors related to a translations string...
CVE-2011-4319
CVE-2011-4319 is a cross-site scripting (XSS) vulnerability affecting the i18n translations helper in Ruby on Rails. The issue exists in Rails 3.0.x up to before 3.0.11 and Rails 3.1.x up to before 3.1.2, and in the rails_xss plugin for Rails 2.3.x. An attacker can trigger XSS by supplying a tran...
CVE-2011-4319
Cross-site scripting XSS vulnerability in the i18n translations helper method in Ruby on Rails 3.0.x before 3.0.11 and 3.1.x before 3.1.2, and the railsxss plugin in Ruby on Rails 2.3.x, allows remote attackers to inject arbitrary web script or HTML via vectors related to a translations string...
CVE-2011-4319
Cross-site scripting XSS vulnerability in the i18n translations helper method in Ruby on Rails 3.0.x before 3.0.11 and 3.1.x before 3.1.2, and the railsxss plugin in Ruby on Rails 2.3.x, allows remote attackers to inject arbitrary web script or HTML via vectors related to a translations string...
Ruby on Rails Translate Helper方法跨站脚本执行漏洞
BUGTRAQ ID: 50722 Ruby on Rails简称RoR或Rails，是一个使用Ruby语言写的开源Web应用框架，它是严格按照MVC结构开发的。 Ruby on Rails在Translate Helper方法的实现上存在安全漏洞，远程攻击者可利用此漏洞在受影响站点的用户浏览器中执行任意脚本代码，窃取Cookie身份验证凭证。 Translate Helper方法将翻译字符串以html结尾的名称视为HTML安全，并具有插入机制。这些html字符串可使任意值包含在篡改的输入中，并且不可转义。 Ruby on Rails Ruby on Rails 3.x 临时解决方法：...
CVE-2011-2931
Cross-site scripting XSS vulnerability in the striptags helper in actionpack/lib/actioncontroller/vendor/html-scanner/html/node.rb in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a tag with an inval...
CVE-2011-2930
Multiple SQL injection vulnerabilities in the quotetablename method in the ActiveRecord adapters in activerecord/lib/activerecord/connectionadapters/ in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allow remote attackers to execute arbitrary SQL commands via a...
CVE-2011-2930
Multiple SQL injection vulnerabilities in the quotetablename method in the ActiveRecord adapters in activerecord/lib/activerecord/connectionadapters/ in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allow remote attackers to execute arbitrary SQL commands via a...
CVE-2011-3186
CRLF injection vulnerability in actionpack/lib/actioncontroller/response.rb in Ruby on Rails 2.3.x before 2.3.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the Content-Type header...
DEBIAN-CVE-2011-2932
Cross-site scripting XSS vulnerability in activesupport/lib/activesupport/coreext/string/outputsafety.rb in Ruby on Rails 2.x before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a malformed Unicode string, related to a...
CVE-2011-3186
CRLF injection vulnerability in actionpack/lib/actioncontroller/response.rb in Ruby on Rails 2.3.x before 2.3.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the Content-Type header...
CVE-2011-2929
The template selection functionality in actionpack/lib/actionview/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.10 and 3.1.x before 3.1.0.rc6 does not properly handle glob characters, which allows remote attackers to render arbitrary views via a crafted URL, related to a "filter skipping...
CVE-2011-3187
The tos method in actionpack/lib/actiondispatch/middleware/remoteip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header in requests from IP addresses on a Class C network, which might allow remote attackers to inject arbitrary text into log files or bypass intended address...