https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T01:16:49.817715+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certa-2013-avi-687 certa-2013-avi-687 — De multiples vulnérabilités ont été corrigées dans <span class="textit">Puppet</span>. Elles permettent à un attaquant… 2026-10-03T01:16:49.886072+00:00 certa-2013-avi-687 https://cve.radiocsirt.org/vuln/euvd-2026-108651 EUVD-2026-108651 2026-10-03T01:16:49.886118+00:00 EUVD-2026-108651 https://cve.radiocsirt.org/vuln/fkie_cve-2013-6417 fkie_cve-2013-6417 2026-10-03T01:16:49.886134+00:00

actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.

 https://cve.radiocsirt.org/vuln/ghsa-wpw7-wxjm-cw8r GHSA-wpw7-wxjm-cw8r — actionpack allows bypass of database-query restrictions 2026-10-03T01:16:49.886165+00:00

Affected: RubyGems: actionpack

`actionpack/lib/action_dispatch/http/request.rb` in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.

 https://cve.radiocsirt.org/vuln/gsd-2013-6417 gsd-2013-6417 2026-10-03T01:16:49.886191+00:00 gsd-2013-6417 https://cve.radiocsirt.org/vuln/rhsa-2013:1794 RHSA-2013:1794 — Red Hat Security Advisory: ruby193-rubygem-actionpack security update 2026-10-03T01:16:49.886203+00:00

rubygem-actionpack: i18n missing translation XSS rubygem-actionpack: Action View DoS rubygem-actionpack: number_to_currency XSS rubygem-actionpack: unsafe query generation risk (incomplete fix for CVE-2013- 0155)

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2013-6417 Withdrawn: UBUNTU-CVE-2013-6417 2026-10-03T01:16:49.886224+00:00

Withdrawn by the publisher.

Affected: Ubuntu:14.04:LTS: ruby-actionpack-3.2

actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.