Debian Rails vulnerabilities

CVE-2013-1856 [MEDIUM] CVE-2013-1856: rails - The ActiveSupport::XmlMini_JDOM backend in lib/active_support/xml_mini/jdom.rb i... The ActiveSupport::XmlMini_JDOM backend in lib/active_support/xml_mini/jdom.rb in the Active Support component in Ruby on Rails 3.0.x and 3.1.x before 3.1.12 and 3.2.x before 3.2.13, when JRuby is used, does not properly restrict the capabilities of the XML parser, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption

CVE-2013-4389 [MEDIUM] CVE-2013-4389: rails - Multiple format string vulnerabilities in log_subscriber.rb files in the log sub... Multiple format string vulnerabilities in log_subscriber.rb files in the log subscriber component in Action Mailer in Ruby on Rails 3.x before 3.2.15 allow remote attackers to cause a denial of service via a crafted e-mail address that is improperly handled during construction of a log message. Scope: local bookworm: resolved bullseye: resolved forky: resolved sid: re

CVE-2012-6497 [HIGH] CVE-2012-6497: rails - The Authlogic gem for Ruby on Rails, when used with certain versions before 3.2.... The Authlogic gem for Ruby on Rails, when used with certain versions before 3.2.10, makes potentially unsafe find_by_id method calls, which might allow remote attackers to conduct CVE-2012-6496 SQL injection attacks via a crafted parameter in environments that have a known secret_token value, as demonstrated by a value contained in secret_token.rb in an open-source prod

CVE-2012-6496 [HIGH] CVE-2012-6496: rails - SQL injection vulnerability in the Active Record component in Ruby on Rails befo... SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain find_by_ method calls. Scope: local bookwo

CVE-2012-1099 [MEDIUM] CVE-2012-1099: rails - Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/f... Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_options_helper.rb in the select helper in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving certain generation of OPTION elements within SELECT elements. Scope: local bookwo

CVE-2012-1098 [MEDIUM] CVE-2012-1098: rails - Cross-site scripting (XSS) vulnerability in Ruby on Rails 3.0.x before 3.0.12, 3... Cross-site scripting (XSS) vulnerability in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving a SafeBuffer object that is manipulated through certain methods. Scope: local bookworm: resolved (fixed in 2.3.14) bullseye: resolved (fixed in 2.3.14) forky: reso

CVE-2012-3464 [MEDIUM] CVE-2012-3464: rails - Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/cor... Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a ' (quote) character. Scope: local bookworm: resolved (fixed in 2.3.14.1) bullseye: resolved (

CVE-2012-3463 [MEDIUM] CVE-2012-3463: rails - Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/f... Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_tag_helper.rb in Ruby on Rails 3.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via the prompt field to the select_tag helper. Scope: local bookworm: resolved bullseye: resolved forky: resolved sid: resolved tr

CVE-2012-2661 [MEDIUM] CVE-2012-2661: rails - The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3... The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage unintended recursion, a related issue to CVE-201

CVE-2012-3424 [MEDIUM] CVE-2012-3424: rails - The decode_credentials method in actionpack/lib/action_controller/metal/http_aut... The decode_credentials method in actionpack/lib/action_controller/metal/http_authentication.rb in Ruby on Rails 3.x before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7 converts Digest Authentication strings to symbols, which allows remote attackers to cause a denial of service by leveraging access to an application that uses a with_http_digest helper method, as

CVE-2012-3465 [MEDIUM] CVE-2012-3465: rails - Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/s... Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/sanitize_helper.rb in the strip_tags helper in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via malformed HTML markup. Scope: local bookworm: resolved (fixed in 2.3.14.1) bullseye: resolved (fixed in 2

CVE-2011-2930 [HIGH] CVE-2011-2930: rails - Multiple SQL injection vulnerabilities in the quote_table_name method in the Act... Multiple SQL injection vulnerabilities in the quote_table_name method in the ActiveRecord adapters in activerecord/lib/active_record/connection_adapters/ in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allow remote attackers to execute arbitrary SQL commands via a crafted column name. Scope: local bookworm: resolved (fixed in 2.3.14) bull

CVE-2011-0447 [MEDIUM] CVE-2011-0447: rails - Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does ... Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged (1) AJAX or (2) API requests that leverage "combinations of browser plugins and HTTP redirects," a related

CVE-2011-2932 [MEDIUM] CVE-2011-2932: rails - Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/cor... Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails 2.x before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a malformed Unicode string, related to a "UTF-8 escaping vulnerability." Scope: local bookworm: resolved (fix

CVE-2011-2931 [MEDIUM] CVE-2011-2931: rails - Cross-site scripting (XSS) vulnerability in the strip_tags helper in actionpack/... Cross-site scripting (XSS) vulnerability in the strip_tags helper in actionpack/lib/action_controller/vendor/html-scanner/html/node.rb in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a tag with an invalid name. Scope: local bookworm: resolved (fixed in 2.3.14) bullseye:

CVE-2011-0446 [MEDIUM] CVE-2011-0446: rails - Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Rub... Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value. Scope: local bookworm: resolved (fixed in 2.3.11-0.1) bullseye: resolved (fixed in 2.3.11-0.1) forky: r

CVE-2011-3186 [MEDIUM] CVE-2011-3186: rails - CRLF injection vulnerability in actionpack/lib/action_controller/response.rb in ... CRLF injection vulnerability in actionpack/lib/action_controller/response.rb in Ruby on Rails 2.3.x before 2.3.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the Content-Type header. Scope: local bookworm: resolved (fixed in 2.3.14) bullseye: resolved (fixed in 2.3.14) forky: resolved (fixed in 2.3.14) sid:

CVE-2011-3187 [MEDIUM] CVE-2011-3187: rails - The to_s method in actionpack/lib/action_dispatch/middleware/remote_ip.rb in Rub... The to_s method in actionpack/lib/action_dispatch/middleware/remote_ip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header in requests from IP addresses on a Class C network, which might allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header. Scope: local bookworm: open bullseye: open f

CVE-2011-1497 [MEDIUM] CVE-2011-1497: rails - A cross-site scripting vulnerability flaw was found in the auto_link function in... A cross-site scripting vulnerability flaw was found in the auto_link function in Rails before version 3.0.6. Scope: local bookworm: resolved bullseye: resolved forky: resolved sid: resolved trixie: resolved

CVE-2011-2929 [MEDIUM] CVE-2011-2929: rails - The template selection functionality in actionpack/lib/action_view/template/reso... The template selection functionality in actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.10 and 3.1.x before 3.1.0.rc6 does not properly handle glob characters, which allows remote attackers to render arbitrary views via a crafted URL, related to a "filter skipping vulnerability." Scope: local bookworm: resolved bullseye: resolved fork