Lucene search
RootSSV:60567HistoryJan 10, 2013 - 12:00 a.m.
Ruby on Rails不安全查询生成漏洞
2013-01-1000:00:00
Root
www.seebug.org
24
0.004 Low
EPSS
Percentile
69.6%
BUGTRAQ ID: 57192
CVE(CAN) ID: CVE-2013-0155
Ruby on Rails简称RoR或Rails，是一个使用Ruby语言写的开源Web应用框架，它是严格按照MVC结构开发的。
Ruby on Rails结合JSON参数解析使用Active Record解释参数时，攻击者可以发送带有"IS NULL"的意外数据库查询或清空where语句。
0
Ruby on Rails Ruby on Rails 3.x
Ruby on Rails Ruby on Rails 2.3.x
厂商补丁：
Ruby on Rails
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：
Related
openvas
openvas
Debian Security Advisory DSA 2609-1 (rails - SQL query manipulation)
2013-01-16 00:00:00
Debian: Security Advisory (DSA-2609-1)
2013-01-15 00:00:00
Fedora Update for rubygem-activemodel FEDORA-2013-0686
2013-01-24 00:00:00
nessus
nessus
gitlab
gitlab
Unsafe Query Generation Risk in Ruby on Rails
2013-01-13 00:00:00
Incomplete fix to CVE-2013-0155 (Unsafe Query Generation Risk)
2013-12-06 00:00:00
Unsafe Query Generation Risk
2016-09-07 00:00:00
debian
debian
[SECURITY] [DSA 2609-1] rails security update
2013-01-16 21:17:01
rubygems
rubygems
Incomplete fix to CVE-2013-0155 (Unsafe Query Generation Risk)
2013-12-02 20:00:00
CVE-2013-0155 rubygem-actionpack, rubygem-activerecord: Unsafe Query Generation Risk in Ruby on Rails
2013-01-07 20:00:00
Unsafe Query Generation Risk in Active Record
2016-08-10 21:00:00
prion
prion
Design/Logic Flaw
2013-12-07 00:55:00
Design/Logic Flaw
2013-01-13 22:55:00
Design/Logic Flaw
2016-09-07 19:28:00
ics
ics
debiancve
debiancve
osv
osv
actionpack allows bypass of database-query restrictions
2017-10-24 18:33:36
Active Record allows bypassing of database-query restrictions
2017-10-24 18:33:37
ActiveRecord in Ruby on Rails allows database-query bypass
2017-10-24 18:33:35
cve
cve
github
github
actionpack allows bypass of database-query restrictions
2017-10-24 18:33:36
Moderate severity vulnerability that affects activerecord
2018-08-13 20:49:01
Active Record allows bypassing of database-query restrictions
2017-10-24 18:33:37
fedora
fedora
[SECURITY] Fedora 18 Update: rubygem-activesupport-3.2.8-2.fc18
2013-01-20 03:40:48
[SECURITY] Fedora 16 Update: rubygem-activemodel-3.0.10-2.fc16
2013-01-23 01:34:00
[SECURITY] Fedora 18 Update: rubygem-actionpack-3.2.8-2.fc18
2013-01-20 03:40:48
veracode
veracode
Database Authorization Bypass
2019-01-15 09:01:52
ubuntucve
ubuntucve
freebsd
freebsd
rubygem-rails -- multiple vulnerabilities
2013-01-08 00:00:00
Rails 4 -- Unsafe Query Generation Risk in Active Record
2016-08-11 00:00:00
hackerone
hackerone
redhat
redhat
(RHSA-2013:1794) Important: ruby193-rubygem-actionpack security update
2013-12-05 00:00:00
(RHSA-2014:0008) Important: ruby193-rubygem-actionpack security update
2014-01-06 00:00:00
(RHSA-2013:0154) Critical: Ruby on Rails security update
2013-01-10 20:37:00
suse
suse
ruby on rails to 2.3.16 (important)
2013-02-12 10:10:39
ruby on rails to 2.3.16 (important)
2013-02-12 11:04:29
Security update for Ruby on Rails (important)
2013-04-03 20:06:19
ibm
ibm
gentoo
gentoo
Ruby on Rails: Multiple vulnerabilities
2014-12-14 00:00:00
securityvulns
securityvulns
Apple Mac OS X multiple security vulnerabilities
2013-06-17 00:00:00