Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.from_xml (Hash#from_xml) method, which uses XmlSimple (XML::Simple) unsafely, as demonstrated by reading passwords from the Pidgin (Gaim) .purple/accounts.xml file.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Ruby on Rails ActiveResource服务器Hash.from_xml多个安全漏洞
Vulnerability Description
Rails 1.2.4版本之前的版本, 当在Rails上的Ruby运行时, 远程攻击者和ActiveResource服务器可以借助Hash.from_xml (Hash#from_xml)方法,决定任意文件的存在并读取任意XML文件，这会使XmlSimple (XML::Simple)变得不安全,如读取Pidgin (Gaim) .purple/accounts.xml文件的密码。
CVSS Information
N/A
Vulnerability Type
N/A