Search Results (Refine Search)
- Keyword (text search): cpe:2.3:a:rubyonrails:rails:2.3.13:*:*:*:*:*:*:*
- CPE Name Search: true
Vuln ID | Summary | CVSS Severity |
---|---|---|
CVE-2013-0277 |
ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML. Published: February 12, 2013; 8:55:05 PM -0500 |
V3.x:(not available) V2.0: 10.0 HIGH |
CVE-2013-0276 |
ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the attr_protected protection mechanism and modify protected model attributes via a crafted request. Published: February 12, 2013; 8:55:05 PM -0500 |
V3.x:(not available) V2.0: 4.3 MEDIUM |
CVE-2013-0333 |
lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156. Published: January 30, 2013; 7:00:08 AM -0500 |
V3.x:(not available) V2.0: 7.5 HIGH |
CVE-2012-6497 |
The Authlogic gem for Ruby on Rails, when used with certain versions before 3.2.10, makes potentially unsafe find_by_id method calls, which might allow remote attackers to conduct CVE-2012-6496 SQL injection attacks via a crafted parameter in environments that have a known secret_token value, as demonstrated by a value contained in secret_token.rb in an open-source product. Published: January 03, 2013; 11:46:02 PM -0500 |
V3.x:(not available) V2.0: 5.0 MEDIUM |