https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 02:03:07 +0000 https://cve.radiocsirt.org/vuln/certa-2012-avi-409 certa-2012-avi-409 https://cve.radiocsirt.org/vuln/certa-2012-avi-409 https://cve.radiocsirt.org/vuln/euvd-2026-111760 EUVD-2026-111760 https://cve.radiocsirt.org/vuln/euvd-2026-111760 https://cve.radiocsirt.org/vuln/fkie_cve-2012-3424 <p>The decode_credentials method in actionpack/lib/action_controller/metal/http_authentication.rb in Ruby on Rails 3.x before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7 converts Digest Authentication strings to symbols, which allows remote attackers to cause a denial of service by leveraging access to an application that uses a with_http_digest helper method, as demonstrated by the authenticate_or_request_with_http_digest method.</p> <p>The decode_credentials method in actionpack/lib/action_controller/metal/http_authentication.rb in Ruby on Rails 3.x before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7 converts Digest Authentication strings to symbols, which allows remote attackers to cause a denial of service by leveraging access to an application that uses a with_http_digest helper method, as demonstrated by the authenticate_or_request_with_http_digest method.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2012-3424 https://cve.radiocsirt.org/vuln/ghsa-92w9-2pqw-rhjj <p><strong>Affected:</strong> RubyGems: actionpack</p> <p>The `decode_credentials` method in `actionpack/lib/action_controller/metal/http_authentication.rb` in Ruby on Rails before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7 converts Digest Authentication strings to symbols, which allows remote attackers to cause a denial of service by leveraging access to an application that uses a `with_http_digest` helper method, as demonstrated by the `authenticate_or_request_with_http_digest` method.</p> <p><strong>Affected:</strong> RubyGems: actionpack</p> <p>The `decode_credentials` method in `actionpack/lib/action_controller/metal/http_authentication.rb` in Ruby on Rails before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7 converts Digest Authentication strings to symbols, which allows remote attackers to cause a denial of service by leveraging access to an application that uses a `with_http_digest` helper method, as demonstrated by the `authenticate_or_request_with_http_digest` method.</p> https://cve.radiocsirt.org/vuln/ghsa-92w9-2pqw-rhjj https://cve.radiocsirt.org/vuln/gsd-2012-3424 gsd-2012-3424 https://cve.radiocsirt.org/vuln/gsd-2012-3424 https://cve.radiocsirt.org/vuln/rhsa-2012:1542 <p>puppet: Filebucket arbitrary file read puppet: Filebucket denial of service puppet: Filebucket arbitrary code execution rubygem-mail: directory traversal rubygem-mail: arbitrary command execution when using exim or sendmail from commandline rubygem-actionpack: Unsafe query generation rubygem-activerecord: SQL injection when processing nested query paramaters rubygem-actionpack: Unsafe query generation (a different flaw than CVE-2012-2660) rubygem-activerecord: SQL injection when processing nested query paramaters (a different flaw than CVE-2012-2661) rubygem-actionpack: DoS vulnerability in authenticate_or_request_with_http_digest rubygem-actionpack: potential XSS vulnerability in select_tag prompt rubygem-actionpack: potential XSS vulnerability rubygem-actionpack: XSS Vulnerability in strip_tags puppet: authenticated clients allowed to read arbitrary files from the puppet master puppet: authenticated clients allowed to delete arbitrary files on the puppet master puppet: insufficient validation of agent names in CN of SSL certificate requests</p> <p>puppet: Filebucket arbitrary file read puppet: Filebucket denial of service puppet: Filebucket arbitrary code execution rubygem-mail: directory traversal rubygem-mail: arbitrary command execution when using exim or sendmail from commandline rubygem-actionpack: Unsafe query generation rubygem-activerecord: SQL injection when processing nested query paramaters rubygem-actionpack: Unsafe query generation (a different flaw than CVE-2012-2660) rubygem-activerecord: SQL injection when processing nested query paramaters (a different flaw than CVE-2012-2661) rubygem-actionpack: DoS vulnerability in authenticate_or_request_with_http_digest rubygem-actionpack: potential XSS vulnerability in select_tag prompt rubygem-actionpack: potential XSS vulnerability rubygem-actionpack: XSS Vulnerability in strip_tags puppet: authenticated clients allowed to read arbitrary files from the puppet master puppet: authenticated clients allowed to delete arbitrary files on the puppet master puppet: insufficient validation of agent names in CN of SSL certificate requests</p> https://cve.radiocsirt.org/vuln/rhsa-2012:1542