CVE-2019-5418

There is a File Content Disclosure vulnerability in Action View 5.2.2.1, 5.1.6.2, 5.0.7.2, 4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed...

Ruby on Rails 5.2 "DoubleTap" Directory Traversal

Ruby on Rails 5.2.2 and prior are vulnerable to a directory traversal attack due to the way the HTTP ACCEPT header is parsed, which ends up being a template for Rails to render. Recent assessments: wchen-r7 at September 12, 2019 6:07pm UTC reported: Background Ruby on Rails is a server-side web...

CVE-2019-5418

There is a File Content Disclosure vulnerability in Action View 5.2.2.1, 5.1.6.2, 5.0.7.2, 4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system’s filesystem to be exposed. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker...

openSUSE Security Update : git-annex (openSUSE-2019-497)

This update for git-annex to version 6.20180626 fixes the following issues : - CVE-2018-10857: Prevent file content disclosure by refusing to download content that cannot be verified with a hash, from encrypted special remotes and glacier bsc1098062. - CVE-2018-10859: Prevent local gpg encrypted...

Rails 5.2.1 - Arbitrary File Content Disclosure

Rails 5.2.1 - Arbitrary File Content Disclosure ''' Exploit Title: File Content Disclosure on Rails Date: CVE disclosed 3/16 today's date is 3/20 Exploit Author: NotoriousRebel Vendor Homepage: https://rubyonrails.org/ Software Link: https://github.com/rails/rails Version: Versions Affected: all...

Ruby on Rails 'CVE-2019-5418' LFI (Local File Inclusion) Vulnerability

The web application on the remote host is prone to a LFI Local File Inclusion vulnerability if the hosting system is running an outdated version of Ruby on Rails. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by...

Exploit for Path Traversal in Rubyonrails Rails

CVE-2019-5418 - File Content Disclosure on Rails EDIT: th...

Path Traversal in Action View

File Content Disclosure in Action View Impact ------ There is a possible file content disclosure vulnerability in Action View. Specially crafted accept headers in combination with calls to render file: can cause arbitrary files on the target server to be rendered, disclosing the file contents. Th...

PT-2019-1854 · Ruby On Rails +3 · Action View +3

Name of the Vulnerable Software and Affected Versions: Action View versions prior to 5.2.2.1 Action View versions prior to 5.1.6.2 Action View versions prior to 5.0.7.2 Action View versions prior to 4.2.11.1 Action View version 3 Description: There is a File Content Disclosure issue in Action Vie...

Path Traversal in Action View

File Content Disclosure in Action View Impact ------ There is a possible file content disclosure vulnerability in Action View. Specially crafted accept headers in combination with calls to render file: can cause arbitrary files on the target server to be rendered, disclosing the file contents. Th...

Rails -- Action View vulnerabilities

Ruby on Rails blog: Rails 4.2.11.1, 5.0.7.2, 5.1.6.2, 5.2.2.1, and 6.0.0.beta3 have been released! These contain the following important security fixes. It is recommended that users upgrade as soon as possible: CVE-2019-5418 File Content Disclosure in Action View CVE-2019-5419 Denial of Service...

CVE-2018-16539

In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect access checking in temp file handling to disclose contents of files on the system otherwise not readable...

Security update for git-annex (moderate)

This update for git-annex to version 6.20180626 fixes the following issues: - CVE-2018-10857: Prevent file content disclosure by refusing to download content that cannot be verified with a hash, from encrypted special remotes and glacier bsc1098062. - CVE-2018-10859: Prevent local gpg encrypted...

Security update for git-annex (moderate)

This update for git-annex to version 6.20180626 fixes the following issues: - CVE-2018-10857: Prevent file content disclosure by refusing to download content that cannot be verified with a hash, from encrypted special remotes and glacier bsc1098062. - CVE-2018-10859: Prevent local gpg encrypted...

openSUSE Security Update : git-annex (openSUSE-2018-697)

This update for git-annex to version 6.20180626 fixes the following issues : - CVE-2018-10857: Prevent file content disclosure by refusing to download content that cannot be verified with a hash, from encrypted special remotes and glacier bsc1098062. - CVE-2018-10859: Prevent local gpg encrypted...

Adobe Multiple Products - XML Injection File Content Disclosure Exploit

Exploit for multiple platform in category web applications !/bin/bash Source: https://raw.githubusercontent.com/tsluyter/exploits/master/adobexmlinject.sh Exploit Title: Adobe XML Injection file content disclosure Date: 07-04-2017 Exploit Author: Thomas Sluyter Website: https://www.kilala.nl Vend...

Adobe XML Injection File Content Disclosure

!/bin/bash Source: https://raw.githubusercontent.com/tsluyter/exploits/master/adobexmlinject.sh Exploit Title: Adobe XML Injection file content disclosure Date: 07-04-2017 Exploit Author: Thomas Sluyter Website: https://www.kilala.nl Vendor Homepage:...

Adobe (Multiple Products) - XML Injection File Content Disclosure

!/bin/bash Exploit Title: Adobe XML Injection file content disclosure Date: 07-04-2017 Exploit Author: Thomas Sluyter Website: https://www.kilala.nl Vendor Homepage: http://www.adobe.com/support/security/bulletins/apsb10-05.html Version: Multiple Adobe products Tested on: Windows Server 2003,...

Sun i-Runbook 2.5.2 Directory And File Content Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/5209/info Sun i-Runbook is a single point of technical and administration management for Sun production environments. i-Runbook provides a web interface. i-Runbook can be led to disclose the contents of a known resource...

GRAND Flash Album Gallery 0.55 Wordpress Plugin Multiple Vulnerabilities

No description provided by source. Vulnerability ID: HTB22870 Reference: http://www.htbridge.ch/advisory/sqlinjectioningrandflashalbumgalle rywordpressplugin.html Product: GRAND Flash Album Gallery wordpress plugin Vendor: Sergey Pasyuk http://codeasily.com/ Vulnerable Version: 0.55 Vendor...