Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 50

Export CSV
CVE-2012-1099

rubygem-actionpack: XSS in the 'select' helper

Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_options_helper.rb in the select helper in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving certain generation of OPTION elements within SELECT elements.

CVSS 2.0 · 4.3 Medium EPSS 2.4% KEV · Not listed
Vendors
Rubyonrails
Products
Rails Ruby On Rails
CVE-2012-2660

rubygem-actionpack: Unsafe query generation

actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2694.

CVSS 2.0 · 6.4 Medium EPSS 4.5% KEV · Not listed
Vendors
Cloudforms Cloudengine Redhat Rhel Sam and 1 more
Products
1 Openshift 1.1 and 2 more
CVE-2012-2661

rubygem-activerecord: SQL injection when processing nested query paramaters

The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage unintended recursion, a related issue to CVE-2012-2695.

CVSS 2.0 · 5.0 Medium EPSS 4.0% KEV · Not listed
Vendors
Cloudforms Cloudengine Redhat Rhel Sam and 1 more
Products
1 Openshift 1.1 and 2 more
CVE-2012-2694

rubygem-actionpack: Unsafe query generation (a different flaw than CVE-2012-2660)

actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain "['xyz', nil]" values, a related issue to CVE-2012-2660.

CVSS 2.0 · 4.3 Medium EPSS 3.9% KEV · Not listed
Vendors
Cloudforms Cloudengine Redhat Rhel Sam and 1 more
Products
1 Openshift 1.1 and 2 more
CVE-2012-2695

rubygem-activerecord: SQL injection when processing nested query paramaters (a different flaw than CVE-2012-2661)

The Active Record component in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage improper handling of nested hashes, a related issue to CVE-2012-2661.

CVSS 2.0 · 7.5 High EPSS 2.9% KEV · Not listed
Vendors
Cloudforms Cloudengine Redhat Rhel Sam and 1 more
Products
1 Openshift 1.1 and 2 more
CVE-2012-3424

rubygem-actionpack: DoS vulnerability in authenticate_or_request_with_http_digest

The decode_credentials method in actionpack/lib/action_controller/metal/http_authentication.rb in Ruby on Rails 3.x before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7 converts Digest Authentication strings to symbols, which allows remote attackers to cause a denial of service by leveraging access to an application that uses a with_http_digest helper method, as demonstrated by the authenticate_or_request_with_http_digest method.

CVSS 2.0 · 5.0 Medium EPSS 1.9% KEV · Not listed
Vendors
Cloudforms Cloudengine Redhat Rhel Sam and 1 more
Products
1 Openshift 1.1 and 2 more
CVE-2012-3463

rubygem-actionpack: potential XSS vulnerability in select_tag prompt

Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_tag_helper.rb in Ruby on Rails 3.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via the prompt field to the select_tag helper.

CVSS 2.0 · 4.3 Medium EPSS 1.3% KEV · Not listed
Vendors
Cloudforms Cloudengine Redhat Rhel Sam and 1 more
Products
1 Openshift 1.1 and 2 more
CVE-2012-3464

rubygem-actionpack: potential XSS vulnerability

Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a ' (quote) character.

CVSS 2.0 · 4.3 Medium EPSS 2.6% KEV · Not listed
Vendors
Cloudforms Cloudengine Redhat Rhel Sam and 1 more
Products
1 Openshift 1.1 and 2 more
CVE-2012-3465

rubygem-actionpack: XSS Vulnerability in strip_tags

Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/sanitize_helper.rb in the strip_tags helper in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via malformed HTML markup.

CVSS 2.0 · 4.3 Medium EPSS 2.0% KEV · Not listed
Vendors
Cloudforms Cloudengine Redhat Rhel Sam and 1 more
Products
1 Openshift 1.1 and 2 more
CVE-2012-6496

rubygem-activerecord: find_by_* SQL Injection

SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain find_by_ method calls.

CVSS 2.0 · 7.5 High EPSS 4.6% KEV · Not listed
Vendors
Cloudforms Cloudengine Redhat Rhel Sam and 1 more
Products
1 Openshift 1.1 and 2 more