151 matches found
[SECURITY] [DSA 2613-1] rails security update
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2613-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst January 29, 2013 http://www.debian.org/security/faq -...
Ruby on Rails JSON Processor YAML Deserialization Code Execution
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3...
Debian DSA-2613-1 : rails - insufficient input validation
Lawrence Pit discovered that Ruby on Rails, a web development framework, is vulnerable to a flaw in the parsing of JSON to YAML. Using a specially crafted payload attackers can trick the backend into decoding a subset of YAML. The vulnerability has been addressed by removing the YAML backend and...
CVE-2013-0333
lib/activesupport/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication v...
CVE-2013-0333
Technical details for CVE-2013-0333 are not publicly available in the supplied documents; monitor for updates.
CVE-2013-0333
lib/activesupport/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication v...
Critical: Red Hat Security Advisory: rubygem-activesupport security update
An updated rubygem-activesupport package that fixes one security issue is now available for Red Hat CloudForms. The Red Hat Security Response Team has rated this update as having critical security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity ratin...
CVE-2013-0333
creationtimestamp| type| source ---|---|--- 2013-01-29 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/24434 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/railsjsonyamlcodeexec.rb 2018-05-29 15:50:33+00:00|...
RHEL 6 : rubygem-activesupport (RHSA-2013:0201)
The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2013:0201 advisory. Ruby on Rails is a modelviewcontroller MVC framework for web application development. Active Support provides support and utility classes used by the...
Critical: Red Hat Security Advisory: rubygem-activesupport security update
An updated rubygem-activesupport package that fixes one security issue is now available for Red Hat OpenShift Enterprise 1.0. The Red Hat Security Response Team has rated this update as having critical security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...
Critical: Red Hat Security Advisory: rubygem-activesupport security update
An updated rubygem-activesupport package that fixes one security issue is now available for Red Hat Subscription Asset Manager. The Red Hat Security Response Team has rated this update as having critical security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detaile...
Debian: Security Advisory (DSA-2613-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Ruby on Rails 3.0 and 2.3 JSON Parser vulnerability
Overview The Ruby on Rails 3.0 and 2.3 JSON parser contain a vulnerability that may result in arbitrary code execution. Description The Ruby on Rails advisory states:There is a vulnerability in the JSON code for Ruby on Rails which allows attackers to bypass authentication systems, inject arbitra...
CVE-2012-0333
Cisco Small Business IP phones (SPA 500 series) with firmware 7.4.9 and earlier are affected by CVE-2012-0333 because Push XML requests do not require authentication, enabling remote attackers to initiate calls via crafted XML (Bug CSCts08768). Affected product: SPA 500 series; root cause: unauth...
CVE-2011-0333
Summary: CVE-2011-0333 is a heap-based buffer overflow in GroupWise Internet Agent (GWIA) related to parsing the TZNAME property in VCALENDAR data. The flaw resides in NgwiCalVTimeZoneBody::ParseSelf within gwwww1.dll on Novell GroupWise 8.0 before HP3, enabling remote code execution via a crafte...
GroupWise Internet Agent < 8.0.2 HP3 Multiple Vulnerabilities
The version of Novell GroupWise Internet Agent running on the remote host is earlier than 8.0.2 HP3. Such versions are potentially affected by multiple issues : - Multiple denial of service issues exist because the application does not adequately verify user-supplied inputs. CVE-2011-2218,...
Secunia Research: Novell GroupWise Internet Agent "TZNAME" Parsing Vulnerability
====================================================================== Secunia Research 27/09/2011 - Novell GroupWise Internet Agent "TZNAME" Parsing Vulnerability - ====================================================================== Table of Contents Affected...
CentOS Update for libpng10 CESA-2009:0333 centos4 i386
Check for the Version of libpng10 OpenVAS Vulnerability Test CentOS Update for libpng10 CESA-2009:0333 centos4 i386 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...
CentOS Update for seamonkey CESA-2010:0333 centos3 i386
Check for the Version of seamonkey OpenVAS Vulnerability Test CentOS Update for seamonkey CESA-2010:0333 centos3 i386 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify ...
CentOS Update for seamonkey CESA-2010:0333 centos3 i386
Check for the Version of seamonkey OpenVAS Vulnerability Test CentOS Update for seamonkey CESA-2010:0333 centos3 i386 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify ...