Skip to content
OpenAdvisories

Archive

22 June 2012

Vulnerabilities first published on this day (UTC), newest first.

← May 2012 2012 / June /22 July 2012 →
  1. 13
  2. 22
  3. 3 
  4. 422
  5. 526
  6. 6 
  7. 717
  8. 812
  9. 912
  10. 10 
  11. 112
  12. 1224
  13. 1332
  14. 1416
  15. 156
  16. 1630
  17. 1713
  18. 181
  19. 1914
  20. 2020
  21. 2137
  22. 2211
  23. 23 
  24. 24 
  25. 257
  26. 263
  27. 2763
  28. 28 
  29. 2926
  30. 306
All Critical High Medium Low Exploited only Public exploit

11 results · Feed

  • Medium —
    CVE-2012-2660

    Action Pack contains database-query restrictions bypass

    actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows rem…

    actionpack RubyGems
  • High —
    CVE-2012-2695

    activerecord vulnerable to SQL Injection

    The Active Record component in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL inj…

    activerecord RubyGems
  • Medium —
    CVE-2012-2694

    actionpack allows remote attackers to bypass database-query restrictions, perform NULL checks via crafted request

    actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows rem…

    actionpack RubyGems
  • Medium —
    CVE-2012-2661 Public exploit

    Active Record vulnerable to SQL Injection via nested query parameters

    The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain S…

    activerecord RubyGems
  • Unscored —
    CVE-2012-0191

    The web container in IBM Lotus Expeditor 6.1.x and 6.2.x before 6.2 FP5+Security Pack does not properly perform access …

  • Unscored —
    CVE-2012-0304

    Symantec LiveUpdate Administrator before 2.3.1 uses weak permissions (Everyone: Full Control) for the installation dire…

  • Unscored —
    CVE-2012-0186

    Directory traversal vulnerability in the Eclipse Help component in IBM Lotus Expeditor 6.1.x and 6.2.x before 6.2 FP5+S…

  • Unscored —
    CVE-2012-0187

    Untrusted search path vulnerability in IBM Lotus Expeditor 6.1.x and 6.2.x before 6.2 FP5+Security Pack allows local us…

  • Unscored —
    CVE-2012-2172 Public exploit

    Cross-site scripting (XSS) vulnerability in SoftwareRegistration.do in the Storage Manager Profiler in IBM System Stora…

  • Unscored —
    CVE-2012-2171 Public exploit

    SQL injection vulnerability in ModuleServlet.do in the Storage Manager Profiler in IBM System Storage DS Storage Manage…

  • Unscored —
    CVE-2012-2179 Public exploit

    libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a tempora…