Lucene search
+L

2318 matches found

GitLab Advisory Database
GitLab Advisory Database
•added 2017/10/24 12:00 a.m.•43 views

Improper Input Validation

Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery CSRF protection for requests to applications that rely on this protection, as demonstrated using text/plain...

6.8CVSS7AI score0.0808EPSS
SaveExploits2References20Affected Software1
GitLab Advisory Database
GitLab Advisory Database
•added 2017/10/24 12:00 a.m.•41 views

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Cross-site scripting XSS vulnerability in the striptags helper in actionpack/lib/actioncontroller/vendor/html-scanner/html/node.rb in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a tag with an inval...

4.3CVSS4.2AI score0.02492EPSS
SaveExploits0References17Affected Software1
GitLab Advisory Database
GitLab Advisory Database
•added 2017/10/24 12:00 a.m.•40 views

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Multiple cross-site scripting XSS vulnerabilities in the mailto helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted 1 name or 2 email value...

4.3CVSS5.9AI score0.0235EPSS
SaveExploits1References15Affected Software1
GitLab Advisory Database
GitLab Advisory Database
•added 2017/10/24 12:00 a.m.•41 views

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Multiple cross-site scripting XSS vulnerabilities in the mailto helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted 1 name or 2 email value...

4.3CVSS5.9AI score0.0235EPSS
SaveExploits1References16Affected Software1
GitLab Advisory Database
GitLab Advisory Database
•added 2017/10/24 12:00 a.m.•47 views

Improper Input Validation

Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs...

6.4CVSS7.1AI score0.02207EPSS
SaveExploits0References9Affected Software1
RubySec
RubySec
•added 2017/10/24 12:00 a.m.•30 views

Potential XSS Vulnerability in Ruby on Rails Applications

The cross-site scripting XSS prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does not properly handle mutation of safe buffers, which makes it easier for remote attackers to conduct XSS attacks via crafted strings to an application that uses a...

4.3CVSS5.8AI score0.01962EPSS
SaveExploits0References1Affected Software1
RubySec
RubySec
•added 2017/10/24 12:00 a.m.•27 views

actionpack and activesupport vulnerable to information leaks

A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, leaks information about the complexity of message-digest signature verification in the cookie store, which might allow remote attackers to forge a digest via multiple attempts...

5CVSS6.6AI score0.02232EPSS
SaveExploits1References1Affected Software1
RubySec
RubySec
•added 2017/10/24 12:00 a.m.•65 views

SQL Injection Vulnerability in Ruby on Rails

The Active Record component in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query...

7.5CVSS6.2AI score0.04011EPSS
SaveExploits4References1Affected Software1
RubySec
RubySec
•added 2017/10/24 12:00 a.m.•38 views

XSS vulnerabilities in the mail_to helper in rails/actionpack

Multiple cross-site scripting XSS vulnerabilities in the mailto helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted 1 name or 2 email value...

4.3CVSS5.9AI score0.0235EPSS
SaveExploits1References1Affected Software1
RubySec
RubySec
•added 2017/10/24 12:00 a.m.•70 views

CSRF Protection Bypass in Ruby on Rails

Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery CSRF attacks via forged 1 AJAX or 2 API requests that...

6.8CVSS6.3AI score0.01602EPSS
SaveExploits1References1Affected Software1
RubySec
RubySec
•added 2017/10/24 12:00 a.m.•28 views

Moderate severity vulnerability that affects rails

A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, leaks information about the complexity of message-digest signature verification in the cookie store, which might allow remote attackers to forge a digest via multiple attempts...

5CVSS6.6AI score0.02232EPSS
SaveExploits1References1Affected Software1
RubySec
RubySec
•added 2017/10/24 12:00 a.m.•30 views

XSS Vulnerability in strip_tags helper in rails/actionpack

Cross-site scripting XSS vulnerability in the striptags helper in actionpack/lib/actioncontroller/vendor/html-scanner/html/node.rb in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a tag with an inval...

4.3CVSS6AI score0.02492EPSS
SaveExploits0References1Affected Software1
GitLab Advisory Database
GitLab Advisory Database
•added 2017/10/24 12:00 a.m.•58 views

activerecord vulnerable to SQL Injection

Multiple SQL injection vulnerabilities in the quotetablename method in the ActiveRecord adapters in activerecord/lib/activerecord/connectionadapters/ in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allow remote attackers to execute arbitrary SQL commands via a...

7.5CVSS8.1AI score0.02319EPSS
SaveExploits0References6Affected Software1
GitLab Advisory Database
GitLab Advisory Database
•added 2017/10/24 12:00 a.m.•35 views

Cross site scripting that affects rails

Cross-site scripting XSS vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject arbitrary web script or HTML by placing malformed Unicode strings into a form helper...

4.3CVSS7.8AI score0.03022EPSS
SaveExploits1References4Affected Software1
GitLab Advisory Database
GitLab Advisory Database
•added 2017/10/24 12:00 a.m.•41 views

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Cross-site scripting XSS vulnerability in activesupport/lib/activesupport/coreext/string/outputsafety.rb in Ruby on Rails 2.x before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a malformed Unicode string, related to a...

4.3CVSS4AI score0.02492EPSS
SaveExploits0References16Affected Software1
GitLab Advisory Database
GitLab Advisory Database
•added 2017/10/24 12:00 a.m.•47 views

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The cross-site scripting XSS prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does not properly handle mutation of safe buffers, which makes it easier for remote attackers to conduct XSS attacks via crafted strings to an application that uses a...

4.3CVSS5.8AI score0.01962EPSS
SaveExploits0References12Affected Software1
GitLab Advisory Database
GitLab Advisory Database
•added 2017/10/24 12:00 a.m.•75 views

actionpack allows remote attackers to bypass database-query restrictions, perform NULL checks via crafted request

actionpack/lib/actiondispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended...

4.3CVSS7.2AI score0.03931EPSS
SaveExploits2References8Affected Software1
GitLab Advisory Database
GitLab Advisory Database
•added 2017/10/24 12:00 a.m.•67 views

Active Record contains SQL Injection

SQL injection vulnerability in the Active Record component in Ruby on Rails before 2.3.15, 3.0.x before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in...

7.5CVSS7.7AI score0.04458EPSS
SaveExploits2References6Affected Software1
GitLab Advisory Database
GitLab Advisory Database
•added 2017/10/24 12:00 a.m.•36 views

High severity vulnerability that affects actionpack

actionpack/lib/actionview/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is used, does not properly implement filters associated with the list of available templates, which allows remote attackers to bypass intended access restrictions via an action...

7.5CVSS5.6AI score0.02498EPSS
SaveExploits1References8Affected Software1
GitLab Advisory Database
GitLab Advisory Database
•added 2017/10/24 12:00 a.m.•48 views

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the 1 :limit and 2 :offset parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer...

7.5CVSS8.9AI score0.0303EPSS
SaveExploits1References21Affected Software1
Rows per page
Query Builder