Most recent entries from all

certa-2013-avi-133 — De multiples vulnérabilités ont été corrigées dans Ruby on Rails . Elles permettent à un at…

certa-2013-avi-133

EUVD-2026-104606

fkie_cve-2013-0276

ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the attr_protected protection mechanism and modify protected model attributes via a crafted request.

GHSA-gr44-7grc-37vq — ActiveRecord vulnerable to modification of protected model attributes

Affected: RubyGems: activerecord

ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the `attr_protected` protection mechanism and modify protected model attributes via a crafted request.

gsd-2013-0276

RHSA-2013:0582 — Red Hat Security Advisory: Red Hat OpenShift Enterprise 1.1.1 update

rubygem-actionpack: Unsafe query generation rubygem-activerecord: SQL injection when processing nested query paramaters rubygem-actionpack: Unsafe query generation (a different flaw than CVE-2012-2660) rubygem-activerecord: SQL injection when processing nested query paramaters (a different flaw than CVE-2012-2661) rubygem-actionpack: DoS vulnerability in authenticate_or_request_with_http_digest rubygem-actionpack: potential XSS vulnerability in select_tag prompt rubygem-actionpack: potential XSS vulnerability rubygem-actionpack: XSS Vulnerability in strip_tags 1.9.3: Possibility to bypass Ruby's $SAFE (level 4) semantics ruby: safe level bypass via name_err_mesg_to_str() ruby: unintentional file creation caused by inserting an illegal NUL character ruby: Murmur hash-flooding DoS flaw in ruby 1.9 (oCERT-2012-001) rubygem-activerecord: Unsafe Query Generation Risk in Ruby on Rails rubygem-ruby_parser: incorrect temporary file usage rubygem-activerecord/rubygem-activemodel: circumvention of attr_protected

Withdrawn: UBUNTU-CVE-2013-0276

Withdrawn by the publisher.

Affected: Ubuntu:14.04:LTS: ruby-activerecord-3.2