CVSS: 4.3EPSS: 0%CPEs: 47EXPL: 0CVE-2011-2197
https://notcve.org/view.php?id=CVE-2011-2197
The cross-site scripting (XSS) prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does not properly handle mutation of safe buffers, which makes it easier for remote attackers to conduct XSS attacks via crafted strings to an application that uses a problematic string method, as demonstrated by the sub method. La característica de prevención de secuencias de comandos en sitios cruzados (XSS) de Ruby en Rails v2.x anterior a v2.3.12, v3.0.x anterior a v3.0.8, y v3.1.x anterior a v3.1.0.rc2 no maneja adecuadamente la mutación de búfers seguros, esto facilita a los atacantes remotos provocar ataques XSS a través de cadenas manipuladas de una aplicación que usa un método de cadena problemático, como se ha demostrado con el sub-método. • http://groups.google.com/group/rubyonrails-security/msg/663b600d4471e0d4?dmode=source&output=gplain http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062514.html http://lists.fedoraproject.org/pipermail/package-announce/2011-June/062090.html http://openwall.com/lists/oss-security/2011/06/09/2 http://openwall.com/lists/oss-security/2011/06/13/9 http://secunia.com/advisories/44789 http://weblog.rubyonrails.org/2011/6/8/potential-xss-vulnerability-in-ruby-on-rails-applications • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 30EXPL: 0CVE-2011-0446
https://notcve.org/view.php?id=CVE-2011-0446
Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en la ayuda mail_to en Ruby on Rails en versiones anteriores a v2.3.11, y v3.x anterior a v3.0.4, cuando se usa la codificación Javascript permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro manipulado a (1) nombre y (2)email . • http://groups.google.com/group/rubyonrails-security/msg/365b8a23b76a6b4a?dmode=source&output=gplain http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055074.html http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html http://secunia.com/advisories/43274 http://secunia.com/advisories/43666 http://www.debian.org/security/2011/dsa-2247 http://www.securityfocus.com/bid/46291 http:/& • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 55EXPL: 0CVE-2009-4214
https://notcve.org/view.php?id=CVE-2009-4214
Cross-site scripting (XSS) vulnerability in the strip_tags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tokenizer and actionpack/lib/action_controller/vendor/html-scanner/html/node.rb. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Ruby on Rails anterior v2.2.s, y v2.3.x anterior v2.3.5, permite a atacantes remotos inyectar código Web o HTML a su lección a través de vectores que incluyen caracteres ASCII no imprimibles, relacionado con HTML::Tokenizer y actionpack/lib/action_controller/vendor/html-scanner/html/node.rb. • http://github.com/rails/rails/commit/bfe032858077bb2946abe25e95e485ba6da86bd5 http://groups.google.com/group/rubyonrails-security/browse_thread/thread/4d4f71f2aef4c0ab?pli=1 http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html http://secunia.com/advisories/37446 http://secunia.com/advisories/38915 http://support.apple.com/kb/HT4077 http://weblog.rubyonrails.org/2009/11/30/ruby-on-rails-2-3-5-released • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 14EXPL: 0CVE-2009-3009
https://notcve.org/view.php?id=CVE-2009-3009
Cross-site scripting (XSS) vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject arbitrary web script or HTML by placing malformed Unicode strings into a form helper. Vulnerabilidad de ejecución secuencias de comandos en sitios cruzados (XSS) en Roby en Rails v2.x anterior 2.2.3, y v2.3.x anterior v2.3.4, permite a atacantes remotos inyectar código web o HTML a su elección colocando cadenas malformadas Unicode en un formulario de ayuda. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=545063 http://groups.google.com/group/rubyonrails-security/msg/7f57cd7794e1d1b4?dmode=source http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html http://secunia.com/advisories/36600 http://secunia.com/advisories/36717 http://securitytracker.com/id?1022824 http://support.apple.com/kb/HT4077 http://weblog.rubyonrails.org/2009/9/4/xss-vulnerability • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 51EXPL: 5CVE-2008-4094
https://notcve.org/view.php?id=CVE-2008-4094
Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) :limit and (2) :offset parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer. "Múltiples vulnerabilidades de inyección SQL en Ruby on Rails anterior a versión 2.1.1, permiten a los atacantes remotos ejecutar comandos SQL arbitrarios por medio de los parámetros (1): limit y (2): offset, relacionados con ActiveRecord, ActiveSupport, ActiveResource, ActionPack y ActionMailer. • http://blog.innerewut.de/2008/6/16/why-you-should-upgrade-to-rails-2-1 http://gist.github.com/8946 http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.html http://rails.lighthouseapp.com/projects/8994/tickets/288 http://rails.lighthouseapp.com/projects/8994/tickets/964 http://secunia.com/advisories/31875 http://secunia.com/advisories/31909 http://secunia.com/advisories/31910 http://www.openwall.com/lists/oss-security/2008/09/13/2 http://www.openwall& • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •