Description

The safe-level feature in Ruby 1.8.7 allows context-dependent attackers to modify strings via the NameError#to_s method when operating on Ruby objects. NOTE: this issue is due to an incomplete fix for CVE-2011-1005.

Remediation

References

CVE-2012-4481

Related Vulnerabilities

Oracle Application Server CVE-2006-0274 Vulnerability (CVE-2006-0274)

Magento CVE-2019-7928 Vulnerability (CVE-2019-7928)

Zope Web Application Server Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-44389)

WordPress Plugin Power Zoomer Arbitrary File Upload (1.2)

TYPO3 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2014-3943)

Severity

Medium

Classification

CVE-2012-4481 CWE-264

Tags

Missing Update Known Vulnerabilities