David Hansson » Ruby On Rails : Security Vulnerabilities, CVEs, CVSS score >= 5
Session fixation vulnerability in Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers to hijack web sessions via unspecified vectors related to "URL-based sessions."
Max CVSS
6.8
EPSS Score
2.81%
Published
2007-10-19
Updated
2011-03-08
Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.from_xml (Hash#from_xml) method, which uses XmlSimple (XML::Simple) unsafely, as demonstrated by reading passwords from the Pidgin (Gaim) .purple/accounts.xml file.
Max CVSS
5.0
EPSS Score
0.86%
Published
2007-10-19
Updated
2012-10-31
2 vulnerabilities found