CVE-2012-2695

The CVE-2012-2695 entry affects Ruby on Rails Active Record prior to versions 3.0.14, 3.1.x prior to 3.1.6, and 3.2.x prior to 3.2.6. The issue arises from how request data is passed to where() calls in ActiveRecord, enabling SQL injection via nested query parameters due to improper handling of n...

CVE-2012-2694

CVE-2012-2694 is a Ruby on Rails Active Record/parameter handling weakness where Rails versions 3.0.x before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 fail to align Active Record and Rack parameter handling, enabling remote attackers to bypass query restrictions and perform NULL checks v...