Description

Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit function specify integer values, which makes it easier for remote attackers to conduct SQL injection attacks via a non-numeric argument.

Remediation

References

CVE-2011-0448

Related Vulnerabilities

WordPress Plugin Creative Contact Form-The Best WordPress Contact Form Builder Arbitrary File Upload (0.9.7)

WordPress 3.9.x Multiple Vulnerabilities (3.9 - 3.9.13)

TYPO3 Insertion of Sensitive Information into Log File Vulnerability (CVE-2022-31047)

WordPress Plugin Forminator-Contact Form, Payment Form & Custom Form Builder Multiple Vulnerabilities (1.29.3)

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2013-4573)

Severity

High

Classification

CVE-2011-0448 CWE-138

Tags

Missing Update Known Vulnerabilities