CVSS: 4.3EPSS: 0%CPEs: 163EXPL: 0CVE-2013-1855 – rubygem-actionpack: css_sanitization: XSS vulnerability in sanitize_css
https://notcve.org/view.php?id=CVE-2013-1855
The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle \n (newline) characters, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences. El método sanitize_css en lib/action_controller/vendor/html-scanner/html/sanitizer.rb en el componente Action Pack en Ruby on Rails anterior a v2.3.18, v3.0.x y v3.1.x anterior a v3.1.12, y v3.2.x anterior a v3.2.13, no menaja adecuadamente los caracteres \n (nueva línea), lo que facilita a atacantes remotos llevar a cabo ataques XSS a través de secuencias CSS. A cross-site scripting (XSS) flaw was found in Action Pack. A remote attacker could use this flaw to conduct XSS attacks against users of an application using Action Pack. • http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html http://lists.opensuse.org/opensuse-updates/2013-04/msg00072.html http://lists.opensuse.org/opensuse-updates/2013-04/msg00073.html http://lists.opensuse.org/opensuse-updates/2014-01/msg00013.html http://rhn.redhat.com/errata/RHSA-2013-0698.html http://rhn.redhat.com/errata/RHSA-2014-1863.html http://support.apple.com/kb/HT5784 http:/&# • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 58EXPL: 0CVE-2013-0276 – rubygem-activerecord/rubygem-activemodel: circumvention of attr_protected
https://notcve.org/view.php?id=CVE-2013-0276
ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the attr_protected protection mechanism and modify protected model attributes via a crafted request. ActiveRecord en Ruby on Rails v3.2.x anteriores a v3.2.12, v3.1.x anteriores a v3.1.11, y v2.3.x anteriores a v2.3.17 permite a atacantes remotos evitar el mecanismo de protección "attr_protected" y modificar el modelo de atributos protegidos a través de una petición hecha a mano. • http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html http://lists.opensuse.org/opensuse-updates/2013-03/msg00048.html http://rhn.redhat.com/errata/RHSA-2013-0686.html http://secunia.com/advisories/52112 http://secunia.com/advisories/52774 http://support.apple.com/kb/HT5784 http://weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-been-released http://www.debian.org/security/2013/dsa-2620 http://www.openwall.com/l • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.4EPSS: 0%CPEs: 4EXPL: 0CVE-2013-0155 – rubygem-activerecord: Unsafe Query Generation Risk in Ruby on Rails
https://notcve.org/view.php?id=CVE-2013-0155
Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660 and CVE-2012-2694. Ruby on Rails v3.0.x anteior a v3.0.19, v3.1.x anteior a v3.1.10, y v3.2.x anteior a v3.2.11 no considera adecuadamente las diferencias en el manejo de parámetros entre el componente Active Record y la implementación JSON, lo que permite a atacantes remotos evitar las restricciones de peticiones a base de datos y realizar chequeos NULL o provocar un WHERE a través de una consulta manipulada. Como se ha demostrado mdiante determinados valires "[nil]". Relacionado con los CVE-2012-2660 y CVE-2012-2694. • http://ics-cert.us-cert.gov/advisories/ICSA-13-036-01A http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html http://lists.opensuse.org/opensuse-updates/2013-12/msg00079.html http://lists.opensuse.org/opensuse-updates/2013-12/msg00081.html http://lists.opensuse.org/opensuse-updates/2013-12/msg00082.html http://lists.opensuse.org/opensuse-updates/2014-01/msg00003.html http://rhn.redhat.com/errata/RHSA-2013-0154.html http://rhn.redhat.com/errata/RHSA-2013-0155. • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 97%CPEs: 6EXPL: 4CVE-2013-0156 – Ruby on Rails - Known Secret Session Cookie Remote Code Execution
https://notcve.org/view.php?id=CVE-2013-0156
active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion. active_support/core_ext/hash/conversions.rb en Ruby on Rails anterior a v2.3.15, v3.0.x anterior a v3.0.19, v3.1.x anterior a v3.1.10, y v3.2.x anterior a v3.2.11 no restringe adecuadamente el "casting" de las variables de tipo cadena, lo que permite a atacantes remotos llevar a cabo ataques de inyección de objetos y la ejecución de código arbitrario o provocar una denegación de servicio (consumo de memoria y CPU) involucrando a referencias de entidades XML anidadas, aprovechando el soporte de Action Pack para lso tipos de conversion (1) YAML o (2) Symbol. • https://www.exploit-db.com/exploits/27527 https://www.exploit-db.com/exploits/24019 https://github.com/heroku/heroku-CVE-2013-0156 https://github.com/R3dKn33-zz/CVE-2013-0156 http://ics-cert.us-cert.gov/advisories/ICSA-13-036-01A http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html http://rhn.redhat.com/errata/RHSA-2013-0153.html http://rhn.redhat.com/errata/RHSA-2013-0154.html http://rhn.redhat.com/errata/RHSA-2013-0155.html http://we • CWE-20: Improper Input Validation CWE-502: Deserialization of Untrusted Data •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 2CVE-2012-6497
https://notcve.org/view.php?id=CVE-2012-6497
The Authlogic gem for Ruby on Rails, when used with certain versions before 3.2.10, makes potentially unsafe find_by_id method calls, which might allow remote attackers to conduct CVE-2012-6496 SQL injection attacks via a crafted parameter in environments that have a known secret_token value, as demonstrated by a value contained in secret_token.rb in an open-source product. La gema Authlogic para Ruby on Rails, cuando se utiliza con algunas versiones antes de v3.2.10, hace llamadas al método find_by_id potencialmente inseguras que podría permitir a atacantes remotos realizar ataques de inyección SQL CVE-2012-6496 a través de un parámetro modificado en ambientes que han conocido un valor secret_token, como lo demuestra un valor contenido en secret_token.rb en un producto de código abierto. • http://blog.phusion.nl/2013/01/03/rails-sql-injection-vulnerability-hold-your-horses-here-are-the-facts http://openwall.com/lists/oss-security/2013/01/03/12 http://phenoelit.org/blog/archives/2012/12/21/let_me_github_that_for_you/index.html http://www.securityfocus.com/bid/57084 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •