CVE

Id
48360  
CVE No.
CVE-2011-0448  
Status
Candidate  
Description
Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit function specify integer values, which makes it easier for remote attackers to conduct SQL injection attacks via a non-numeric argument.  
Phase
Assigned (20110113)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
525175 48360 CVE-2011-0448 MLIST:[rubyonrails-security] 20110209 Potential SQL Injection in Rails 3.0.x  View
525176 48360 CVE-2011-0448 URL:http://groups.google.com/group/rubyonrails-security/msg/4e19864cf6ad40ad?dmode=source&output=gplain  View
525177 48360 CVE-2011-0448 CONFIRM:http://weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4  View
525178 48360 CVE-2011-0448 FEDORA:FEDORA-2011-4358  View
525179 48360 CVE-2011-0448 URL:http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html  View
525180 48360 CVE-2011-0448 SECTRACK:1025063  View
525181 48360 CVE-2011-0448 URL:http://securitytracker.com/id?1025063  View
525182 48360 CVE-2011-0448 SECUNIA:43278  View
525183 48360 CVE-2011-0448 URL:http://secunia.com/advisories/43278  View
525184 48360 CVE-2011-0448 VUPEN:ADV-2011-0877  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
30665 JVNDB-2011-000013 F-Secure アンチウイルス Linux ゲートウェイにおける認証不備の脆弱性 F-Secure Corporation が提供する F-Secure アンチウイルス Linux ゲートウェイには、認証不備の脆弱性が存在します。 CVE-2011-0453 48360 5 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-000013.html  View