PT-2020-12536 · Puma +4 · Puma +4

🗓️ 22 May 2020 00:00:00Reported by Positive TechnologiesType

Puma versions before 3.12.6 and 4.3.5 are vulnerable to request smuggling via pipelining.

Reporter	Title	Published	Views	Family All 2650
0day.today	Rails 5.2.1 - Arbitrary File Content Disclosure Exploit	24 Mar 201900:00	–	zdt
0day.today	Ruby On Rails DoubleTap Development Mode secret_key_base Remote Code Execution Exploit	2 May 201900:00	–	zdt
0day.today	Django < 3.0 < 2.2 < 1.11 - Account Hijack Vulnerability	24 Dec 201900:00	–	zdt
0day.today	Grafana 7.0.1 - Denial of Service Exploit	7 Jul 202000:00	–	zdt
Positive Technologies	PT-2017-2445 · Ruby +2 · Ruby +2	6 Jan 201700:00	–	ptsecurity
Positive Technologies	PT-2017-4069 · Pivotal +2 · Rabbitmq +2	13 Jun 201700:00	–	ptsecurity
Positive Technologies	PT-2017-4083 · Pivotal +1 · Rabbitmq +1	13 Jun 201700:00	–	ptsecurity
Positive Technologies	PT-2017-4084 · Pivotal +1 · Rabbitmq +1	13 Jun 201700:00	–	ptsecurity
Positive Technologies	PT-2017-4199 · Apache +2 · Apache Zookeeper +2	29 Jan 201700:00	–	ptsecurity
Positive Technologies	PT-2018-10142 · Powerdns +4 · Powerdns Recursor +5	29 Nov 201800:00	–	ptsecurity

Source	Link
github	www.github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/rails_doubletap_file_read.rb
github	www.github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/rails_double_tap.rb
github	www.github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2020-11077.yml
github	www.github.com/mpgn/CVE-2019-5418
github	www.github.com/masahiro331/CVE-2020-8165
github	www.github.com/brompwnie/CVE-2019-5418-Scanner
github	www.github.com/knqyf263/CVE-2019-5420
github	www.github.com/random-robbie/CVE-2019-5418
github	www.github.com/j4k0m/CVE-2019-5420
github	www.github.com/omarkurt/CVE-2019-5418

27 Jul 2024 00:00Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.17.5 - 9.8

CVSS 27.8

CVSS 34.2 - 7.5

EPSS0.99856

SSVC