rubygem-rails -- session-fixation vulnerability

Rails core team reports: The rails core team has released ruby on rails 1.2.6 to address a bug in the fix for session fixation attacks CVE-2007-5380. The CVE Identifier for this new issue is CVE-2007-6077...

CVE-2007-6077

The session fixation protection mechanism in cgiprocess.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookieonly attribute from the DEFAULTSESSIONOPTIONS constant, which effectively causes cookieonly to be applied only to the first instantiation of CgiRequest, which allows remote...

CVE-2007-6077

The session fixation protection mechanism in cgiprocess.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookieonly attribute from the DEFAULTSESSIONOPTIONS constant, which effectively causes cookieonly to be applied only to the first instantiation of CgiRequest, which allows remote...

Session fixation

The session fixation protection mechanism in cgiprocess.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookieonly attribute from the DEFAULTSESSIONOPTIONS constant, which effectively causes cookieonly to be applied only to the first instantiation of CgiRequest, which allows remote...

CVE-2007-6077

The session fixation protection mechanism in cgiprocess.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookieonly attribute from the DEFAULTSESSIONOPTIONS constant, which effectively causes cookieonly to be applied only to the first instantiation of CgiRequest, which allows remote...

DEBIAN-CVE-2007-6077

The session fixation protection mechanism in cgiprocess.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookieonly attribute from the DEFAULTSESSIONOPTIONS constant, which effectively causes cookieonly to be applied only to the first instantiation of CgiRequest, which allows remote...

CVE-2007-6077

The session fixation protection mechanism in cgiprocess.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookieonly attribute from the DEFAULTSESSIONOPTIONS constant, which effectively causes cookieonly to be applied only to the first instantiation of CgiRequest, which allows remote...

CVE-2007-6077

The CVE-2007-6077 issue affects Ruby on Rails (Rails 1.2.4) in the session handling code: the session fixation protection in cgi_process.rb removes the :cookie_only attribute from DEFAULT_SESSION_OPTIONS, causing cookie_only to apply only to the first CgiRequest instance. This enables remote atta...

CVE-2007-6077

The session fixation protection mechanism in cgiprocess.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookieonly attribute from the DEFAULTSESSIONOPTIONS constant, which effectively causes cookieonly to be applied only to the first instantiation of CgiRequest, which allows remote...

Session fixation

Adobe ColdFusion 8 and MX 7 allows remote attackers to hijack sessions via unspecified vectors that trigger establishment of a session to a ColdFusion application in which the 1 CFID or 2 CFTOKEN cookies have empty values, possibly due to a session fixation vulnerability...

CVE-2007-5905

Adobe ColdFusion 8 and MX 7 allows remote attackers to hijack sessions via unspecified vectors that trigger establishment of a session to a ColdFusion application in which the 1 CFID or 2 CFTOKEN cookies have empty values, possibly due to a session fixation vulnerability...

GLSA-200711-17 : Ruby on Rails: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200711-17 Ruby on Rails: Multiple vulnerabilities candlerb found that ActiveResource, when processing responses using the Hash.fromxml function, does not properly sanitize filenames CVE-2007-5380. The session management...

[ GLSA 200711-17 ] Ruby on Rails: Multiple vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200711-17 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - -...

Ruby on Rails: Multiple vulnerabilities

Background Ruby on Rails is a free web framework used to develop database-driven web applications. Description candlerb found that ActiveResource, when processing responses using the Hash.fromxml function, does not properly sanitize filenames CVE-2007-5380. The session management functionality...

Session fixation

Pioneers formerly gnocatan before 0.11.3 allows remote attackers to cause a denial of service crash by triggering a delete operation while the Session object is still being used, as demonstrated by causing a "Broken pipe" error...

Simple PHP Blog (sphpblog) <= 0.5.1 Multiple Vulnerabilities

Title: Simple PHP Blog sphpblog = 0.5.1 Multiple Vulnerabilities Vendor: http://sourceforge.net/projects/sphpblog/ Advisory: http://acid-root.new.fr/?0:15 Author: DarkFig gmdarkfig at gmail dot com Released on: 2007/10/21 Changelog: ---------- L M H T Summary: Ip Spoofing X X Cross Site Scripting...

Simple PHP Blog (sphpblog) <= 0.5.1 Multiple Vulnerabilities

No description provided by source. Title: Simple PHP Blog sphpblog = 0.5.1 Multiple Vulnerabilities Vendor: http://sourceforge.net/projects/sphpblog/ Advisory: http://acid-root.new.fr/?0:15 Author: DarkFig gmdarkfig at gmail dot com Released on: 2007/10/21 Changelog: ---------- L M H T Summary: I...

Simple PHP Blog多个安全漏洞

Simple PHP Blog是一款基于PHP的网络日记程序。 Simple PHP Blog不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞对应用程序进行各种攻击。 问题包括如下： -IP伪造 -HTML注入 -会话固定 -开放EMAIL RELAY -本地文件包含 -跨站请求伪造 -任意文件上传。 攻击者利用这些问题可破坏受影响的应用程序，以WEB服务进程权限执行任意代码。发送任意恶意邮件，或窃取COOKIE等信息。 Simple PHP Blog Simple PHP Blog 0.5.1 Simple PHP Blog Simple PHP Blog 0.4.8 Simpl...

Simple PHP Blog (sphpblog) <= 0.5.1 Multiple Vulnerabilities

Exploit for unknown platform in category web applications ============================================================ Simple PHP Blog sphpblog = 0.5.1 Multiple Vulnerabilities ============================================================ Title: Simple PHP Blog sphpblog = 0.5.1 Multiple...

Simple PHP Blog (sPHPblog) 0.5.1 - Multiple Vulnerabilities

Simple PHP Blog sPHPblog 0.5.1 - Multiple Vulnerabilities Title: Simple PHP Blog sphpblog Released on: 2007/10/21 Changelog: ---------- L M H T Summary: Ip Spoofing X X Cross Site Scripting X X Session Fixation X X mail CRLF Injection X Local File Inclusion +CSRF X X File Deletion +CSRF X X File...