CVSS: 7.5EPSS: 0%CPEs: 13EXPL: 0CVE-2011-0448 – Gentoo Linux Security Advisory 201412-28
https://notcve.org/view.php?id=CVE-2011-0448
21 Feb 2011 — Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit function specify integer values, which makes it easier for remote attackers to conduct SQL injection attacks via a non-numeric argument. Ruby on Rails v3.0.x anteriores a v3.0.4 no garantiza que los argumentos de la función de especificar los valores límite de número entero, lo que facilita a los atacantes remotos para realizar ataques de inyección SQL a través de un argumento no numérico. Multiple vulnerabilities were found in Rub... • http://groups.google.com/group/rubyonrails-security/msg/4e19864cf6ad40ad?dmode=source&output=gplain • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 0%CPEs: 30EXPL: 0CVE-2011-0446 – Gentoo Linux Security Advisory 201412-28
https://notcve.org/view.php?id=CVE-2011-0446
14 Feb 2011 — Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en la ayuda mail_to en Ruby on Rails en versiones anteriores a v2.3.11, y v3.x anterior a v3.0.4, cuando se usa la codificación Javascript permite a atacantes remotos... • http://groups.google.com/group/rubyonrails-security/msg/365b8a23b76a6b4a?dmode=source&output=gplain • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 24EXPL: 0CVE-2011-0447 – Gentoo Linux Security Advisory 201412-28
https://notcve.org/view.php?id=CVE-2011-0447
14 Feb 2011 — Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged (1) AJAX or (2) API requests that leverage "combinations of browser plugins and HTTP redirects," a related issue to CVE-2011-0696. Ruby on Rails v2.1.x, v2.2.x, and v2.3.x anteriores a v2.3.11,y v3.x anteriores a v3.0.4 no valida correctamente las ... • http://groups.google.com/group/rubyonrails-security/msg/c22ea1668c0d181c?dmode=source&output=gplain • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2010-3933 – Gentoo Linux Security Advisory 201412-28
https://notcve.org/view.php?id=CVE-2010-3933
27 Oct 2010 — Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs. Ruby on Rails v2.3.9 y v3.0.0 no controla correctamente los atributos anidados, lo cual permite a atacantes remotos modificar registros a su elección, cambiando los nombres de los parámetros por formularios de entrada. Multiple vulnerabilities were found in Ruby on Rails, the worst of which allowing for execution of arbitrary... • http://secunia.com/advisories/41930 • CWE-20: Improper Input Validation •
CVSS: 6.8EPSS: 19%CPEs: 5EXPL: 2CVE-2008-7248 – Ruby on Rails 2.3.5 - 'protect_from_forgery' Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2008-7248
16 Dec 2009 — Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery (CSRF) protection for requests to applications that rely on this protection, as demonstrated using text/plain. Ruby on Rails v2.1 anteriores a v2.1.3 y v2.2.x anteriores a v2.2.2 no verifica los token en peticiones con ciertos tipos de contenido, lo que permite a atacantes remotos evitar la protección contra la falsificación ... • https://www.exploit-db.com/exploits/33402 • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 0%CPEs: 55EXPL: 0CVE-2009-4214
https://notcve.org/view.php?id=CVE-2009-4214
07 Dec 2009 — Cross-site scripting (XSS) vulnerability in the strip_tags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tokenizer and actionpack/lib/action_controller/vendor/html-scanner/html/node.rb. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Ruby on Rails anterior v2.2.s, y v2.3.x anterior v2.3.5, permite a atacantes remotos inyectar código Web o... • http://github.com/rails/rails/commit/bfe032858077bb2946abe25e95e485ba6da86bd5 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 8EXPL: 0CVE-2009-3086
https://notcve.org/view.php?id=CVE-2009-3086
08 Sep 2009 — A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, leaks information about the complexity of message-digest signature verification in the cookie store, which might allow remote attackers to forge a digest via multiple attempts. Un determinado algoritmo de Ruby on Rails v2.1.0 hasta v2.2.2 y v2.3.x antes de v2.3.4, filtra información de la complejidad de la verificación de firmas Hash en el almacen de cookies, lo que podría permitir crear una firma Hash a atacantes remotos a tr... • http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 14EXPL: 0CVE-2009-3009
https://notcve.org/view.php?id=CVE-2009-3009
08 Sep 2009 — Cross-site scripting (XSS) vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject arbitrary web script or HTML by placing malformed Unicode strings into a form helper. Vulnerabilidad de ejecución secuencias de comandos en sitios cruzados (XSS) en Roby en Rails v2.x anterior 2.2.3, y v2.3.x anterior v2.3.4, permite a atacantes remotos inyectar código web o HTML a su elección colocando cadenas malformadas Unicode en un formulario de ayuda. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=545063 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 49EXPL: 0CVE-2008-5189
https://notcve.org/view.php?id=CVE-2008-5189
21 Nov 2008 — CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL to the redirect_to function. Vulnerabilidad de inyección CRLF en Ruby on Rails anteriores a v2.0.5, permite a atacantes remotos inyectar cabeceras HTTP de su elección y llevar a cabo ataques de división de respuesta HTTP mediante una URL manipulada a la función redirect_to. • http://github.com/rails/rails/commit/7282ed863ca7e6f928bae9162c9a63a98775a19d • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.5EPSS: 0%CPEs: 51EXPL: 5CVE-2008-4094
https://notcve.org/view.php?id=CVE-2008-4094
30 Sep 2008 — Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) :limit and (2) :offset parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer. "Múltiples vulnerabilidades de inyección SQL en Ruby on Rails anterior a versión 2.1.1, permiten a los atacantes remotos ejecutar comandos SQL arbitrarios por medio de los parámetros (1): limit y (2): offset, relacionados con ActiveRecord, ActiveSupport... • http://blog.innerewut.de/2008/6/16/why-you-should-upgrade-to-rails-2-1 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •