Description

Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) :limit and (2) :offset parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer.

Remediation

References

CVE-2008-4094

Related Vulnerabilities

Oracle Database Server CVE-2023-22077 Vulnerability (CVE-2023-22077)

jQuery PrettyPhoto Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2015-9478)

ASP.NET MVC Improper Input Validation Vulnerability (CVE-2017-0256)

Envoy Proxy CVE-2019-18802 Vulnerability (CVE-2019-18802)

e107 Deserialization of Untrusted Data Vulnerability (CVE-2016-10753)

Severity

High

Classification

CVE-2008-4094 CWE-138

Tags

Missing Update Known Vulnerabilities