CVE-2014-0177

The am function in lib/hub/commands.rb in hub before 1.12.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary patch file...

PT-2014-2549

Name of the Vulnerable Software and Affected Versions Creme Fraiche gem versions prior to 0.6.1 Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the file name of an email attachment, specifically through the set meta data function in...

CVE-2013-2090: Improper Neutralization of Special Elements used in an OS Command

The setmetadata function in lib/cremefraiche.rb in the Creme Fraiche gem before 0.6.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the file name of an email attachment. NOTE: some of these details are obtained from third party information...

CVE-2014-0177: Undefined Security Weakness

The am function in lib/hub/commands.rb in hub before 1.12.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary patch file...

CVE-2013-4430

Cross-site scripting XSS vulnerability in Mahara before 1.5.12, 1.6.x before 1.6.7, and 1.7.x before 1.7.3 allows remote attackers to inject arbitrary web script or HTML via the Host header to lib/web.php...

CVE-2013-4430

Cross-site scripting XSS vulnerability in Mahara before 1.5.12, 1.6.x before 1.6.7, and 1.7.x before 1.7.3 allows remote attackers to inject arbitrary web script or HTML via the Host header to lib/web.php...

PT-2014-2790

Name of the Vulnerable Software and Affected Versions Mahara versions prior to 1.5.12 Mahara versions 1.6.x prior to 1.6.7 Mahara versions 1.7.x prior to 1.7.3 Description The issue allows remote attackers to inject arbitrary web script or HTML via the Host header to lib/web.php. This is a...

CVE-2013-4430: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Mahara before 1.5.12, 1.6.x before 1.6.7, and 1.7.x before 1.7.3 allows remote attackers to inject arbitrary web script or HTML via the Host header to lib/web.php...

PT-2014-3812

Name of the Vulnerable Software and Affected Versions TORQUE Resource Manager versions 2.5.x through 2.5.13 Description The issue is a stack-based buffer overflow in the lib/Libdis/disrsi .c file, allowing remote attackers to execute arbitrary code via a large count value. Recommendations For...

CVE-2014-0749: Improper Restriction of Operations within the Bounds of a Memory Buffer

Stack-based buffer overflow in lib/Libdis/disrsi.c in Terascale Open-Source Resource and Queue Manager aka TORQUE Resource Manager 2.5.x through 2.5.13 allows remote attackers to execute arbitrary code via a large count value...

PT-2014-4860

Name of the Vulnerable Software and Affected Versions Python versions 3.2 through 3.5 Description A race condition exists in the get masked mode function in Lib/os.py, which can be exploited by local users to bypass intended file permissions. This issue arises when exist ok is set to true and...

CVE-2013-4490

The SSH key upload feature lib/gitlabkeys.rb in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x before 6.2.3, allows remote authenticated users to execute arbitrary commands via shell metacharacters in the public key...

PT-2014-2805

Name of the Vulnerable Software and Affected Versions GitLab versions 5.0 through 5.4.1 GitLab versions 6.x through 6.2.3 gitlab-shell versions prior to 1.7.3 Description The issue allows remote authenticated users to execute arbitrary commands via shell metacharacters in the public key,...

PT-2014-2830

Name of the Vulnerable Software and Affected Versions drupalauth module versions prior to 1.2.2 Description The issue allows remote attackers to authenticate as an arbitrary user via the uid in a cookie. This is due to a flaw in the lib/Auth/Source/External.php file of the drupalauth module for...

CVE-2013-4490: Undefined Security Weakness

The SSH key upload feature lib/gitlabkeys.rb in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x before 6.2.3, allows remote authenticated users to execute arbitrary commands via shell metacharacters in the public key...

CVE-2013-5671: Undefined Security Weakness

lib/dragonfly/imagemagickutils.rb in the fog-dragonfly gem 0.8.2 for Ruby allows remote attackers to execute arbitrary commands via unspecified vectors...

PT-2014-2945

Name of the Vulnerable Software and Affected Versions fog-dragonfly gem version 0.8.2 Description The issue allows remote attackers to execute arbitrary commands via unspecified vectors. This is related to the lib/dragonfly/imagemagickutils.rb file in the fog-dragonfly gem for Ruby. Recommendatio...

CVE-2014-0130

Directory traversal vulnerability in actionpack/lib/abstractcontroller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files...

CVE-2014-0130: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in actionpack/lib/abstractcontroller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files...

PT-2014-3249

Name of the Vulnerable Software and Affected Versions LiveZilla versions prior to 5.1.2.1 Description The issue allows remote attackers to execute arbitrary PHP code via a serialized PHP object in a cookie, specifically through the setCookieValue function in lib/functions.global.inc.php...