Skip to content
OpenAdvisories
Unscored DSA-2597-1 2 CVEs

rails - input validation error

Published Jan 4, 2013 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 6.0 rails 2.3.5-1.2+squeeze4

Vulnerabilities 2

  • High —
    CVE-2012-6496

    Active Record contains SQL Injection

    SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic…

    rails activerecord Debian RubyGems
  • Medium —
    CVE-2012-6497

    Authlogic Information Exposure vulnerability

    The Authlogic gem for Ruby on Rails, when used with certain versions before 3.2.10, makes potentially unsafe find_by_id method calls, which might allow remote attackers to conduct CVE-2012-6496 SQL injection attacks via a crafted parameter in environments tha…

    rails authlogic Debian RubyGems