openSUSE 10 Security Update : rubygem-actionpack (rubygem-actionpack-4754)

Malicious users could specify their session-ID in the URL and could gain access to an authenticated session that way CVE-2007-5380. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update...

FreeBSD : rubygem-rails -- session-fixation vulnerability (30acb8ae-9d46-11dc-9114-001c2514716c)

Rails core team reports : The rails core team has released ruby on rails 1.2.6 to address a bug in the fix for session fixation attacks CVE-2007-5380. The CVE Identifier for this new issue is CVE-2007-6077. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package chec...

FreeBSD : rubygem-rails -- JSON XSS vulnerability (44fb0302-9d38-11dc-9114-001c2514716c)

Rails core team reports : All users of Rails 1.2.4 or earlier are advised to upgrade to 1.2.5, though it isn't strictly necessary if you aren't working with JSON. For more information the JSON vulnerability, see CVE-2007-3227. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

openSUSE 10 Security Update : rubygem-activesupport (rubygem-activesupport-4568)

A cross site scripting XSS bug allowed attackers to execute JavaScript code in the context of other websites CVE-2007-3227. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update...

openSUSE 10 Security Update : rubygem-activesupport (rubygem-activesupport-4565)

A cross site scripting XSS bug allowed attackers to execute JavaScript code in the context of other websites CVE-2007-3227. Specially crafted requests could crash an application when processing XML data CVE-2007-5379. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...