CVSS: 4.3EPSS: 0%CPEs: 55EXPL: 0CVE-2009-4214
https://notcve.org/view.php?id=CVE-2009-4214
Cross-site scripting (XSS) vulnerability in the strip_tags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tokenizer and actionpack/lib/action_controller/vendor/html-scanner/html/node.rb. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Ruby on Rails anterior v2.2.s, y v2.3.x anterior v2.3.5, permite a atacantes remotos inyectar código Web o HTML a su lección a través de vectores que incluyen caracteres ASCII no imprimibles, relacionado con HTML::Tokenizer y actionpack/lib/action_controller/vendor/html-scanner/html/node.rb. • http://github.com/rails/rails/commit/bfe032858077bb2946abe25e95e485ba6da86bd5 http://groups.google.com/group/rubyonrails-security/browse_thread/thread/4d4f71f2aef4c0ab?pli=1 http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html http://secunia.com/advisories/37446 http://secunia.com/advisories/38915 http://support.apple.com/kb/HT4077 http://weblog.rubyonrails.org/2009/11/30/ruby-on-rails-2-3-5-released • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 8EXPL: 0CVE-2009-3086
https://notcve.org/view.php?id=CVE-2009-3086
A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, leaks information about the complexity of message-digest signature verification in the cookie store, which might allow remote attackers to forge a digest via multiple attempts. Un determinado algoritmo de Ruby on Rails v2.1.0 hasta v2.2.2 y v2.3.x antes de v2.3.4, filtra información de la complejidad de la verificación de firmas Hash en el almacen de cookies, lo que podría permitir crear una firma Hash a atacantes remotos a través de múltiples intentos. • http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html http://secunia.com/advisories/36600 http://weblog.rubyonrails.org/2009/9/4/timing-weakness-in-ruby-on-rails http://www.debian.org/security/2011/dsa-2260 http://www.securityfocus.com/bid/37427 http://www.vupen.com/english/advisories/2009/2544 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 14EXPL: 0CVE-2009-3009
https://notcve.org/view.php?id=CVE-2009-3009
Cross-site scripting (XSS) vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject arbitrary web script or HTML by placing malformed Unicode strings into a form helper. Vulnerabilidad de ejecución secuencias de comandos en sitios cruzados (XSS) en Roby en Rails v2.x anterior 2.2.3, y v2.3.x anterior v2.3.4, permite a atacantes remotos inyectar código web o HTML a su elección colocando cadenas malformadas Unicode en un formulario de ayuda. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=545063 http://groups.google.com/group/rubyonrails-security/msg/7f57cd7794e1d1b4?dmode=source http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html http://secunia.com/advisories/36600 http://secunia.com/advisories/36717 http://securitytracker.com/id?1022824 http://support.apple.com/kb/HT4077 http://weblog.rubyonrails.org/2009/9/4/xss-vulnerability • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 49EXPL: 0CVE-2008-5189
https://notcve.org/view.php?id=CVE-2008-5189
CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL to the redirect_to function. Vulnerabilidad de inyección CRLF en Ruby on Rails anteriores a v2.0.5, permite a atacantes remotos inyectar cabeceras HTTP de su elección y llevar a cabo ataques de división de respuesta HTTP mediante una URL manipulada a la función redirect_to. • http://github.com/rails/rails/commit/7282ed863ca7e6f928bae9162c9a63a98775a19d http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.html http://weblog.rubyonrails.org/2008/10/19/rails-2-0-5-redirect_to-and-offset-limit-sanitizing http://weblog.rubyonrails.org/2008/10/19/response-splitting-risk http://www.securityfocus.com/bid/32359 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.5EPSS: 0%CPEs: 51EXPL: 5CVE-2008-4094
https://notcve.org/view.php?id=CVE-2008-4094
Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) :limit and (2) :offset parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer. "Múltiples vulnerabilidades de inyección SQL en Ruby on Rails anterior a versión 2.1.1, permiten a los atacantes remotos ejecutar comandos SQL arbitrarios por medio de los parámetros (1): limit y (2): offset, relacionados con ActiveRecord, ActiveSupport, ActiveResource, ActionPack y ActionMailer. • http://blog.innerewut.de/2008/6/16/why-you-should-upgrade-to-rails-2-1 http://gist.github.com/8946 http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.html http://rails.lighthouseapp.com/projects/8994/tickets/288 http://rails.lighthouseapp.com/projects/8994/tickets/964 http://secunia.com/advisories/31875 http://secunia.com/advisories/31909 http://secunia.com/advisories/31910 http://www.openwall.com/lists/oss-security/2008/09/13/2 http://www.openwall& • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •