https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 01:16:59 +0000 https://cve.radiocsirt.org/vuln/certa-2013-avi-687 certa-2013-avi-687 https://cve.radiocsirt.org/vuln/certa-2013-avi-687 https://cve.radiocsirt.org/vuln/euvd-2026-108651 EUVD-2026-108651 https://cve.radiocsirt.org/vuln/euvd-2026-108651 https://cve.radiocsirt.org/vuln/fkie_cve-2013-6417 <p>actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.</p> <p>actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2013-6417 https://cve.radiocsirt.org/vuln/ghsa-wpw7-wxjm-cw8r <p><strong>Affected:</strong> RubyGems: actionpack</p> <p>`actionpack/lib/action_dispatch/http/request.rb` in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.</p> <p><strong>Affected:</strong> RubyGems: actionpack</p> <p>`actionpack/lib/action_dispatch/http/request.rb` in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.</p> https://cve.radiocsirt.org/vuln/ghsa-wpw7-wxjm-cw8r https://cve.radiocsirt.org/vuln/gsd-2013-6417 gsd-2013-6417 https://cve.radiocsirt.org/vuln/gsd-2013-6417 https://cve.radiocsirt.org/vuln/rhsa-2013:1794 <p>rubygem-actionpack: i18n missing translation XSS rubygem-actionpack: Action View DoS rubygem-actionpack: number_to_currency XSS rubygem-actionpack: unsafe query generation risk (incomplete fix for CVE-2013- 0155)</p> <p>rubygem-actionpack: i18n missing translation XSS rubygem-actionpack: Action View DoS rubygem-actionpack: number_to_currency XSS rubygem-actionpack: unsafe query generation risk (incomplete fix for CVE-2013- 0155)</p> https://cve.radiocsirt.org/vuln/rhsa-2013:1794 https://cve.radiocsirt.org/vuln/ubuntu-cve-2013-6417 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:14.04:LTS: ruby-actionpack-3.2</p> <p>actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:14.04:LTS: ruby-actionpack-3.2</p> <p>actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2013-6417