Skip to content
OpenAdvisories

Archive

August 2011

Vulnerabilities first published in this month (UTC), newest first.

← July 2011 2011 / August September 2011 →
  1. 113
  2. 2 
  3. 331
  4. 411
  5. 59
  6. 6 
  7. 7 
  8. 8 
  9. 923
  10. 1047
  11. 1117
  12. 1211
  13. 13 
  14. 14 
  15. 1513
  16. 164
  17. 17 
  18. 1830
  19. 1912
  20. 20 
  21. 21 
  22. 22 
  23. 2313
  24. 247
  25. 259
  26. 26 
  27. 27 
  28. 28 
  29. 2937
  30. 30 
  31. 317
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium —
    CVE-2011-3187 Public exploit

    actionpack Improper Input Validation vulnerability

    The to_s method in actionpack/lib/action_dispatch/middleware/remote_ip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header in requests from IP addresses on a Class C network, which might allow remote attackers to inject arbitrary text into …

    rails actionpack Debian RubyGems
  • Medium —
    CVE-2011-3186

    actionpack CRLF injection vulnerability

    CRLF injection vulnerability in actionpack/lib/action_controller/response.rb in Ruby on Rails 2.3.x before 2.3.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the Content-Type header.

    rails actionpack Debian RubyGems
  • Medium —
    CVE-2011-2931

    actionpack Cross-site Scripting vulnerability

    Cross-site scripting (XSS) vulnerability in the strip_tags helper in actionpack/lib/action_controller/vendor/html-scanner/html/node.rb in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary …

    rails actionpack Debian RubyGems
  • Medium —
    CVE-2011-2929

    actionpack Improper Input Validation vulnerability

    The template selection functionality in actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.10 and 3.1.x before 3.1.0.rc6 does not properly handle glob characters, which allows remote attackers to render arbitrary views via a cra…

    actionpack RubyGems
  • Medium —
    CVE-2011-2932

    activesupport Cross-site Scripting vulnerability

    Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails 2.x before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML vi…

    rails activesupport Debian RubyGems
  • Medium —
    CVE-2011-2481

    Apache Tomcat Allows Replacing of XML Parser

    Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted appl…

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2011-1340

    Plone XSS Vulnerability

    Cross-site scripting (XSS) vulnerability in skins/plone_templates/default_error_message.pt in Plone before 2.5.3 allows remote attackers to inject arbitrary web script or HTML via the type_name parameter to Members/ipa/createObject.

    plone PyPI
  • Medium —
    CVE-2011-2718

    phpMyAdmin Directory Traversal Vulnerability

    Multiple directory traversal vulnerabilities in the relational schema implementation in phpMyAdmin 3.4.x before 3.4.3.2 allow remote authenticated users to include and execute arbitrary local files via directory traversal sequences in an export type field, re…

    phpmyadmin phpmyadmin/phpmyadmin Debian Packagist