Ruby on Rails 'strip_tags()'跨站脚本执行漏洞

BUGTRAQ ID: 54957 CVE ID: CVE-2012-3465 Ruby on Rails简称RoR或Rails，是一个使用Ruby语言写的开源Web应用框架，它是严格按照MVC结构开发的。 Ruby on Rails 3.0.17之前的3.x版本、3.1.8之前的3.1.x版本、3.2.8之前的3.2.x版本内actionpack/lib/actionview/helpers/sanitizehelper.rb在实现上存在XSS漏洞，可允许远程攻击者通过畸形HTML标记注入任意Web脚本或HTML。 0 Ruby on Rails Ruby on Rails 3.x...

CVE-2012-3465

Cross-site scripting XSS vulnerability in actionpack/lib/actionview/helpers/sanitizehelper.rb in the striptags helper in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via malformed HTML markup...

CVE-2012-3465

Cross-site scripting XSS vulnerability in actionpack/lib/actionview/helpers/sanitizehelper.rb in the striptags helper in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via malformed HTML markup...

CVE-2012-3465

CVE-2012-3465 affects Ruby on Rails (Action Pack) via action_view/sanitize_helper.rb strip_tags. Vulnerable in Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8; malformed HTML markup can allow remote XSS via the strip_tags path. The issue is an XSS in the Rails sanitization flow an...

FreeBSD Ports: rubygem-rails

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2012 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

CVE-2012-3465 rubygem-actionpack: XSS Vulnerability in strip_tags

Cross-site scripting XSS vulnerability in actionpack/lib/actionview/helpers/sanitizehelper.rb in the striptags helper in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via malformed HTML markup...

HP Client Automation code execution

Code execution with radexecd.exe TCP/3465...

ZDI-11-105: Hewlett-Packard Client Automation radexecd.exe Remote Code Execution Vulnerability

ZDI-11-105: Hewlett-Packard Client Automation radexecd.exe Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-105 March 18, 2011 -- CVE ID: CVE-2011-0889 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: Hewlett-Packard -- Affected Products:...

Hewlett-Packard Client Automation radexecd.exe Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of HP Client Automation. Authentication is not required to exploit this vulnerability. The flaw exists within the radexecd.exe component which listens by default on TCP port 3465. When handling a remo...

CVE-2010-3465

The vulnerability CVE-2010-3465 affects XSE Shopping Cart versions 1.5.2.1 and 1.5.3.0. It is described as multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary web script or HTML via the id parameter to Default.aspx and the type parameter to SearchRe...

HP OpenView Client Configuration Manager Radia Notify Code Execution (CVE-2006-5782)

An authentication weakness vulnerability exists in the Radia Notify Daemon component of HP OpenView Client Configuration Manager. The flaw is created by improper handling of user supplied data passed to the affected Radia Notify Daemon on TCP port 3465. By sending a crafted message, the attacker...

Adobe Shockwave Player Multiple Remote Code Execution Vulnerabilities

This host is installed with Adobe Shockwave Player and is prone to Multiple Remote Code Execution Vulnerabilities. OpenVAS Vulnerability Test $Id: gbadobeshockwaveplayermultcodeexevuln.nasl 4865 2016-12-28 16:16:43Z teissa $ Adobe Shockwave Player Multiple Remote Code Execution Vulnerabilities...

Security updates available for Shockwave Player

Security updates available for Shockwave Player Release date: November 3, 2009 Vulnerability identifier: APSB09-16 CVE number: CVE-2009-3244, CVE-2009-3463, CVE-2009-3464, CVE-2009-3465, CVE-2009-3466 Platform: Windows and Macintosh Summary Critical vulnerabilities have been identified in Adobe...

VUPEN Security - Adobe Shockwave Player Multiple Code Execution Vulnerabilities

VUPEN Vulnerability Research - Adobe Shockwave Player Multiple Code Execution Vulnerabilities I. BACKGROUND --------------------- "Over 450 million Internet-enabled desktops have installed Adobe Shockwave Player. These people now have access to some of the best the Web has to offer including...

CVE-2009-3465

CVE-2009-3465 affects Adobe Shockwave Player prior to 11.5.2.602. An invalid pointer vulnerability in processing crafted Shockwave content can allow remote code execution via a web page. Impact is arbitrary code execution with network access and no user interaction required per the referenced adv...

SLES9: Security update for libtiff

The remote host is missing updates to packages that affect the security of your system. One or more of the following packages are affected: libtiff For more information, please visit the referenced security advisories. More details may also be found by searching for keyword 5020045 within the SuS...

SLES9: Security update for libtiff

The remote host is missing updates to packages that affect the security of your system. One or more of the following packages are affected: libtiff For more information, please visit the referenced security advisories. More details may also be found by searching for keyword 5020045 within the SuS...

CVE-2008-3465

CVE-2008-3465 describes a heap overflow in the GDI API used when processing WMF images. The vulnerability arises from parsing a malformed file-size parameter in WMF files, which could allow a remote attacker to cause a denial of service or execute arbitrary code on affected Windows variants. Affe...

Gentoo Security Advisory GLSA 200608-07 (tiff)

The remote host is missing updates announced in advisory GLSA 200608-07. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

ZDI-07-060: HP OpenView Radia Integration Server File System Exposure Vulnerability

ZDI-07-060: HP OpenView Radia Integration Server File System Exposure Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-07-060.html October 23, 2007 -- CVE ID: CVE-2007-5413 -- Affected Vendor: Hewlett-Packard -- Affected Products: HP OpenView Radia Integration Server -- TippingPointT...