Search Results (Refine Search)
- CPE Product Version: cpe:/a:rubyonrails:rails:3.0.15
Vuln ID | Summary | CVSS Severity |
---|---|---|
CVE-2013-4389 |
Multiple format string vulnerabilities in log_subscriber.rb files in the log subscriber component in Action Mailer in Ruby on Rails 3.x before 3.2.15 allow remote attackers to cause a denial of service via a crafted e-mail address that is improperly handled during construction of a log message. Published: October 16, 2013; 8:55:03 PM -0400 |
V3.x:(not available) V2.0: 4.3 MEDIUM |
CVE-2012-6497 |
The Authlogic gem for Ruby on Rails, when used with certain versions before 3.2.10, makes potentially unsafe find_by_id method calls, which might allow remote attackers to conduct CVE-2012-6496 SQL injection attacks via a crafted parameter in environments that have a known secret_token value, as demonstrated by a value contained in secret_token.rb in an open-source product. Published: January 03, 2013; 11:46:02 PM -0500 |
V3.x:(not available) V2.0: 5.0 MEDIUM |