Lucene search
GoogleOSV:CVE-2018-16477HistoryNov 30, 2018 - 7:29 p.m.
CVE-2018-16477
2018-11-3019:29:00
Google
osv.dev
4
A bypass vulnerability in Active Storage >= 5.2.0 for Google Cloud Storage and Disk services allow an attacker to modify the content-disposition and content-type parameters which can be used in with HTML files and have them executed inline. Additionally, if combined with other techniques such as cookie bombing and specially crafted AppCache manifests, an attacker can gain access to private signed URLs within a specific storage path. This vulnerability has been fixed in version 5.2.1.1.
Related
cvelist
cvelist
CVE-2018-16477
2018-11-30 19:00:00
hackerone
hackerone
osv
osv
Exposure of Sensitive Information to an Unauthorized Actor in activestorage
2018-12-05 17:17:02
veracode
veracode
Cross-Site Scripting (XSS)
2018-11-28 02:22:01
ubuntucve
ubuntucve
CVE-2018-16477
2018-11-30 00:00:00
nvd
nvd
CVE-2018-16477
2018-11-30 19:29:00
openvas
openvas
Fedora Update for rubygem-activestorage FEDORA-2019-307ebe924c
2019-05-07 00:00:00
cve
cve
CVE-2018-16477
2018-11-30 19:29:00
github
github
Exposure of Sensitive Information to an Unauthorized Actor in activestorage
2018-12-05 17:17:02
fedora
fedora
[SECURITY] Fedora 29 Update: rubygem-activestorage-5.2.1-3.fc29
2019-02-26 03:07:15
prion
prion
Design/Logic Flaw
2018-11-30 19:29:00
gitlab
gitlab
Exposure of Sensitive Information to an Unauthorized Actor
2018-11-30 00:00:00
debiancve
debiancve
CVE-2018-16477
2018-11-30 19:29:00
rubygems
rubygems
Bypass vulnerability in Active Storage
2018-11-26 21:00:00