The vulnerability of the each_pair function in the strong_parameters.rb software platform for Ruby on Rails allows a hacker to gain access to confidential data.

The vulnerability of the eachpair function in the Ruby on Rails software framework, called strongparameters.rb, is related to the restoration of a unreliable data structure in memory. Exploiting this vulnerability could allow an attacker to gain access to confidential data...

The vulnerability of the `escape_javascript` function in the `javascript_helper.rb` component of the ActionView programming platform for Ruby on Rails allows attackers to compromise data integrity.

The vulnerability of the escapejavascript function in the javascripthelper.rb component of the ActionView programming platform for the Ruby on Rails framework is related to deficiencies in the security measures used to protect web page structures. Exploiting this vulnerability could allow an...

The vulnerabilities of the mem_cache_store.rb and redis_cache_store.rb components of the Ruby on Rails software platform allow attackers to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the memcachestore.rb and rediscachestore.rb components of the Ruby on Rails software framework is related to the restoration of unreliable data structures in memory. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its...

Unspecified Vulnerability in GitLab (CNVD-2021-26103)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab versions after...

Gitlab EE/CE Resource Management Error Vulnerability

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A resource management error vulnerability exists in Gitla...

Activerecord-session_store Vulnerable to Timing Attack

The activerecord-sessionstore aka Active Record Session Store component through 1.1.3 for Ruby on Rails does not use a constant-time approach when delivering information about whether a guessed session ID is valid. Consequently, remote attackers can leverage timing discrepancies to achieve a...

GHSA-CVW2-XJ8R-MJF7 Activerecord-session_store Vulnerable to Timing Attack

The activerecord-sessionstore aka Active Record Session Store component through 1.1.3 for Ruby on Rails does not use a constant-time approach when delivering information about whether a guessed session ID is valid. Consequently, remote attackers can leverage timing discrepancies to achieve a...

activerecord-session_store Timing Attack

The activerecord-sessionstore aka Active Record Session Store component through 1.1.3 for Ruby on Rails does not use a constant-time approach when delivering information about whether a guessed session ID is valid. Consequently, remote attackers can leverage timing discrepancies to achieve a...

CVE-2019-25025

A flaw was found in the activerecord-sessionstore Active Record Session Store component through version 1.1.3 for Ruby on Rails where it does not use a constant time approach when delivering information about whether a guessed session ID is valid. This flaw allows remote attackers to leverage...

CVE-2019-25025

The activerecord-sessionstore aka Active Record Session Store component through 1.1.3 for Ruby on Rails does not use a constant-time approach when delivering information about whether a guessed session ID is valid. Consequently, remote attackers can leverage timing discrepancies to achieve a...

Design/Logic Flaw

The activerecord-sessionstore aka Active Record Session Store component through 1.1.3 for Ruby on Rails does not use a constant-time approach when delivering information about whether a guessed session ID is valid. Consequently, remote attackers can leverage timing discrepancies to achieve a...

UBUNTU-CVE-2019-25025

The activerecord-sessionstore aka Active Record Session Store component through 1.1.3 for Ruby on Rails does not use a constant-time approach when delivering information about whether a guessed session ID is valid. Consequently, remote attackers can leverage timing discrepancies to achieve a...

CVE-2019-25025

The ActiveRecord Session Store (activerecord-session_store) vulnerability CVE-2019-25025 affects Ruby on Rails implementations using versions up to 1.1.3, where the session-id validation does not use constant-time comparison. This enables timing-based leakage to guess valid session IDs, with rela...

CVE-2019-25025

Removed by vendor...

CVE-2019-25025

The activerecord-sessionstore aka Active Record Session Store component through 1.1.3 for Ruby on Rails does not use a constant-time approach when delivering information about whether a guessed session ID is valid. Consequently, remote attackers can leverage timing discrepancies to achieve a...

GitLab Cross-Site Scripting Vulnerability (CNVD-2021-14785)

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects. A stored cross-site scripting vulnerability exists in the epics page of GitLab 11.8 and later. No...

Observable Timing Discrepancy

The activerecord-sessionstore aka Active Record Session Store component for Ruby on Rails does not use a constant-time approach when delivering information about whether a guessed session ID is valid. Consequently, remote attackers can leverage timing discrepancies to achieve a correct guess in a...

GitLab 跨站脚本漏洞

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects. A cross-site scripting vulnerability exists in GitLab versions after 13.7, which stems from the...

Vulnerabilities fixed in Ruby on Rails

Vulnerabilities have been fixed in Ruby on Rails. The vulnerabilities allow a malicious party to cause a denial-of-service cause and redirect a user to a rogue web page. The Ruby on Rails developers have released updates to fix the vulnerabilities. More information can be found on the pages below...

Ruby on Rails: redirect_to(["string"]) remote code execution

For example, redirecttoparams:userinput with a URL of ?userinput=something calls the method somethingurl and tries to redirect the return value of the method. If this call is on an unauthenticated route, it would allow an external user to test if a route name exists by determining if the app 500s...