Lucene search

K
RubyonrailsRails2.3.3

22 matches found

CVE
CVE
added 2013/01/30 12:0 p.m.129 views

CVE-2013-0333

lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication vi...

7.5CVSS10AI score0.91935EPSS
CVE
CVE
added 2013/03/19 10:55 p.m.114 views

CVE-2013-1854

The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by converting hash keys to symbols, which allows remote attackers to cause a denial of service via crafted input to a where method.

5CVSS6.3AI score0.01795EPSS
CVE
CVE
added 2014/02/20 3:27 p.m.114 views

CVE-2014-0081

Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the (1) format, (2) negative_format, or (3) u...

4.3CVSS5.9AI score0.00885EPSS
CVE
CVE
added 2013/02/13 1:55 a.m.113 views

CVE-2013-0277

ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML.

10CVSS7.5AI score0.07162EPSS
CVE
CVE
added 2013/03/19 10:55 p.m.111 views

CVE-2013-1855

The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle \n (newline) characters, which makes it easier for remote attackers to ...

4.3CVSS5.5AI score0.00536EPSS
CVE
CVE
added 2012/08/10 10:34 a.m.109 views

CVE-2012-3464

Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a ' (quote) character.

4.3CVSS5.3AI score0.00333EPSS
CVE
CVE
added 2011/02/14 9:0 p.m.105 views

CVE-2011-0446

Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.

4.3CVSS5.4AI score0.0067EPSS
CVE
CVE
added 2009/09/08 6:30 p.m.104 views

CVE-2009-3086

A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, leaks information about the complexity of message-digest signature verification in the cookie store, which might allow remote attackers to forge a digest via multiple attempts.

5CVSS9AI score0.00556EPSS
CVE
CVE
added 2013/03/19 10:55 p.m.100 views

CVE-2013-1857

The sanitize helper in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded : (colon) characters in URLs, which makes it easier for remote atta...

4.3CVSS5.4AI score0.00625EPSS
CVE
CVE
added 2013/02/13 1:55 a.m.99 views

CVE-2013-0276

ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the attr_protected protection mechanism and modify protected model attributes via a crafted request.

4.3CVSS6.2AI score0.01439EPSS
CVE
CVE
added 2012/08/10 10:34 a.m.98 views

CVE-2012-3465

Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/sanitize_helper.rb in the strip_tags helper in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via malformed HTML markup.

4.3CVSS5.5AI score0.00333EPSS
CVE
CVE
added 2009/09/08 6:30 p.m.97 views

CVE-2009-3009

Cross-site scripting (XSS) vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject arbitrary web script or HTML by placing malformed Unicode strings into a form helper.

4.3CVSS7.6AI score0.01632EPSS
CVE
CVE
added 2011/08/29 6:55 p.m.97 views

CVE-2011-2930

Multiple SQL injection vulnerabilities in the quote_table_name method in the ActiveRecord adapters in activerecord/lib/active_record/connection_adapters/ in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allow remote attackers to execute arbitrary SQL commands via a cr...

7.5CVSS8.2AI score0.00955EPSS
CVE
CVE
added 2011/06/30 3:55 p.m.94 views

CVE-2011-2197

The cross-site scripting (XSS) prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does not properly handle mutation of safe buffers, which makes it easier for remote attackers to conduct XSS attacks via crafted strings to an application that uses a...

4.3CVSS5AI score0.00442EPSS
CVE
CVE
added 2011/08/29 6:55 p.m.94 views

CVE-2011-2931

Cross-site scripting (XSS) vulnerability in the strip_tags helper in actionpack/lib/action_controller/vendor/html-scanner/html/node.rb in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a tag with an inv...

4.3CVSS5.3AI score0.00813EPSS
CVE
CVE
added 2011/02/14 9:0 p.m.89 views

CVE-2011-0447

Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged (1) AJAX or (2) API requests that l...

6.8CVSS6.6AI score0.0275EPSS
CVE
CVE
added 2011/08/29 6:55 p.m.89 views

CVE-2011-2932

Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails 2.x before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a malformed Unicode string, related to...

4.3CVSS5.4AI score0.00813EPSS
CVE
CVE
added 2009/12/07 5:30 p.m.88 views

CVE-2009-4214

Cross-site scripting (XSS) vulnerability in the strip_tags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tokenizer and actionpack/lib/action_control...

4.3CVSS7.8AI score0.01632EPSS
CVE
CVE
added 2011/08/29 6:55 p.m.82 views

CVE-2011-3186

CRLF injection vulnerability in actionpack/lib/action_controller/response.rb in Ruby on Rails 2.3.x before 2.3.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the Content-Type header.

4.3CVSS6.7AI score0.00814EPSS
CVE
CVE
added 2011/11/28 11:55 a.m.77 views

CVE-2011-4319

Cross-site scripting (XSS) vulnerability in the i18n translations helper method in Ruby on Rails 3.0.x before 3.0.11 and 3.1.x before 3.1.2, and the rails_xss plugin in Ruby on Rails 2.3.x, allows remote attackers to inject arbitrary web script or HTML via vectors related to a translations string w...

4.3CVSS5.4AI score0.00607EPSS
CVE
CVE
added 2014/07/07 11:1 a.m.72 views

CVE-2014-3482

SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting.

7.5CVSS8.3AI score0.01435EPSS
CVE
CVE
added 2013/04/22 3:27 a.m.58 views

CVE-2013-3221

The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attacks ...

6.4CVSS6.6AI score0.00483EPSS