CVE-2013-0156

The Ruby on Rails framework (specifically active_support/core_ext/hash/conversions.rb ) is vulnerable to object-injection and denial of service (via nested XML entity references) in versions before 2.3.15 , 3.0.x before 3.0.19 , 3.1.x before 3.1.10 , and 3.2.x before 3.2.11 . The root cause is th...

CVE-2009-2422

Ruby on Rails before 2.3.3 contains a vulnerability in the http_authentication.rb example for digest authentication: authenticate_or_request_with_http_digest returns nil instead of false when the user does not exist, enabling context-dependent attackers to bypass authentication for applications d...