CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 2CVE-2007-3227 – Ruby on Rails 1.2.3 To_JSON - Script Injection
https://notcve.org/view.php?id=CVE-2007-3227
Cross-site scripting (XSS) vulnerability in the to_json (ActiveRecord::Base#to_json) function in Ruby on Rails before edge 9606 allows remote attackers to inject arbitrary web script via the input values. Una vulnerabilidad de tipo cross-site scripting (XSS) en la función to_json (ActiveRecord::Base-to_json) en Ruby on Rails versiones anteriores a edge 9606, permite a atacantes remotos inyectar script web arbitrario por medio de los valores de entrada. • https://www.exploit-db.com/exploits/30089 http://bugs.gentoo.org/show_bug.cgi?id=195315 http://dev.rubyonrails.org/ticket/8371 http://osvdb.org/36378 http://pastie.caboo.se/65550.txt http://secunia.com/advisories/25699 http://secunia.com/advisories/27657 http://secunia.com/advisories/27756 http://security.gentoo.org/glsa/glsa-200711-17.xml http://weblog.rubyonrails.org/2007/10/12/rails-1-2-5-maintenance-release http://weblog.rubyonrails.org/2007/10/5/rails • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 3%CPEs: 5EXPL: 0CVE-2006-4112
https://notcve.org/view.php?id=CVE-2006-4112
Unspecified vulnerability in the "dependency resolution mechanism" in Ruby on Rails 1.1.0 through 1.1.5 allows remote attackers to execute arbitrary Ruby code via a URL that is not properly handled in the routing code, which leads to a denial of service (application hang) or "data loss," a different vulnerability than CVE-2006-4111. Vulnerabilidad no especificada en el "mecanismo de resolución de dependencias" en Ruby on Rails 1.1.0 hasta 1.1.5 permite a un atacante remoto ejecutar código Ruby de su elección a través de una URL que no es manejada correctamente en el código de enrutamiento, lo cual lleva a una denegación de servicio (aplicación colgada) o "perdida de datos", una vulenrabilidad diferente que CVE-2006-4111. • http://secunia.com/advisories/21424 http://secunia.com/advisories/21466 http://secunia.com/advisories/21749 http://securitytracker.com/id?1016673 http://weblog.rubyonrails.org/2006/8/10/rails-1-1-6-backports-and-full-disclosure http://www.gentoo.org/security/en/glsa/glsa-200608-20.xml http://www.kb.cert.org/vuls/id/699540 http://www.novell.com/linux/security/advisories/2006_21_sr.html http://www.securityfocus.com/archive/1/442934/100/0/threaded http://www.secu •
CVSS: 7.5EPSS: 2%CPEs: 33EXPL: 0CVE-2006-4111
https://notcve.org/view.php?id=CVE-2006-4111
Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with "severe" or "serious" impact via a File Upload request with an HTTP header that modifies the LOAD_PATH variable, a different vulnerability than CVE-2006-4112. Ruby on Rails anterior a 1.1.5 permite a un atacante remoto ejecutar código Ruby con un impacto "severo" o "serio" a través de una respuesta File Upload con una cabecera HTTP que modifica la variable LOAD_PATH, una vulnerabilidad diferente que CVE-2006-4112. • http://blog.koehntopp.de/archives/1367-Ruby-On-Rails-Mandatory-Mystery-Patch.html http://secunia.com/advisories/21466 http://secunia.com/advisories/21749 http://securitytracker.com/id?1016673 http://weblog.rubyonrails.org/2006/8/9/rails-1-1-5-mandatory-security-patch-and-other-tidbits http://www.gentoo.org/security/en/glsa/glsa-200608-20.xml http://www.novell.com/linux/security/advisories/2006_21_sr.html http://www.securityfocus.com/bid/19454 http://www.vupen.com/english/ • CWE-94: Improper Control of Generation of Code ('Code Injection') •