Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2012-2695
7.5
HIGHCVSS v2
Published
June 22, 2012
Affected
2 projects
Assigned by
Red Hat
Severity scale
010
Description
The Active Record component in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage improper handling of nested hashes, a related issue to CVE-2012-2661.
rails
RubyGemsRuby on Rails is a full-stack web framework optimized for programmer happiness and sustainable productivity. It encourages beautiful code by favoring convention over configuration.
RubyGemsRuby on Rails is a full-stack web framework optimized for programmer happiness and sustainable productivity. It encourages beautiful code by favoring convention over configuration.= 3.0.0, = 3.0.1, = 3.0.13, = 3.0.12, = 3.0.3, = 3.0.6, = 3.0.2, = 3.0.11, = 3.0.4, = 3.0.7, = 3.0.10, = 3.0.5, = 3.0.8, = 3.0.9, = 3.1.0, = 3.1.5, = 3.1.1, = 3.1.4, = 3.1.2, = 3.1.3, = 3.2.0, = 3.2.1, = 3.2.5, = 3.2.2, = 3.2.3, = 3.2.4NVD
rails/rails
GitHubRuby on Rails
GitHubRuby on Rails= 3.0.0, = 3.0.1, = 3.0.13, = 3.0.12, = 3.0.3, = 3.0.6, = 3.0.2, = 3.0.11, = 3.0.4, = 3.0.7, = 3.0.10, = 3.0.5, = 3.0.8, = 3.0.9, = 3.1.0, = 3.1.5, = 3.1.1, = 3.1.4, = 3.1.2, = 3.1.3, = 3.2.0, = 3.2.1, = 3.2.5, = 3.2.2, = 3.2.3, = 3.2.4NVD