Skip to content
OpenAdvisories

Archive

29 August 2011

Vulnerabilities first published on this day (UTC), newest first.

← July 2011 2011 / August /29 September 2011 →
  1. 113
  2. 2 
  3. 331
  4. 411
  5. 59
  6. 6 
  7. 7 
  8. 8 
  9. 923
  10. 1047
  11. 1117
  12. 1211
  13. 13 
  14. 14 
  15. 1513
  16. 164
  17. 17 
  18. 1830
  19. 1912
  20. 20 
  21. 21 
  22. 22 
  23. 2313
  24. 247
  25. 259
  26. 26 
  27. 27 
  28. 28 
  29. 2937
  30. 30 
  31. 317
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Medium —
    CVE-2011-3187 Public exploit

    actionpack Improper Input Validation vulnerability

    The to_s method in actionpack/lib/action_dispatch/middleware/remote_ip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header in requests from IP addresses on a Class C network, which might allow remote attackers to inject arbitrary text into …

    rails actionpack Debian RubyGems
  • Medium —
    CVE-2011-3186

    actionpack CRLF injection vulnerability

    CRLF injection vulnerability in actionpack/lib/action_controller/response.rb in Ruby on Rails 2.3.x before 2.3.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the Content-Type header.

    rails actionpack Debian RubyGems
  • Medium —
    CVE-2011-2931

    actionpack Cross-site Scripting vulnerability

    Cross-site scripting (XSS) vulnerability in the strip_tags helper in actionpack/lib/action_controller/vendor/html-scanner/html/node.rb in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary …

    rails actionpack Debian RubyGems
  • Medium —
    CVE-2011-2929

    actionpack Improper Input Validation vulnerability

    The template selection functionality in actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.10 and 3.1.x before 3.1.0.rc6 does not properly handle glob characters, which allows remote attackers to render arbitrary views via a cra…

    actionpack RubyGems
  • Medium —
    CVE-2011-2932

    activesupport Cross-site Scripting vulnerability

    Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails 2.x before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML vi…

    rails activesupport Debian RubyGems