openSUSE: Security Advisory for openwsman (openSUSE-SU-2019:1111-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OPENSUSE-SU-2019:1111-1 Security update for openwsman

This update for openwsman fixes the following issues: Security issues fixed: - CVE-2019-3816: Fixed a vulnerability in openwsmand deamon which could lead to arbitary file disclosure bsc1122623. - CVE-2019-3833: Fixed a vulnerability in processconnection which could allow an attacker to trigger an...

Security update for openwsman (important)

openSUSE Security Update: Security update for openwsman Announcement ID: openSUSE-SU-2019:1111-1 Rating: important References: 1092206 1122623 Cross-References: CVE-2019-3816 CVE-2019-3833 Affected Products: openSUSE Leap 15.0 An update that fixes two vulnerabilities is now available. Description...

Debian: Security Advisory (DLA-1739-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Rails File Disclosure

File disclosure vulnerability in Rails Action View Vulnerability Type: File Disclosure For the exploit source code contact DSquare Security sales team...

Confluence File Disclosure

File disclosure vulnerability in Confluence widget connector macro Vulnerability Type: File Disclosure For the exploit source code contact DSquare Security sales team...

Immunity Canvas: RAILS_ACTIVESTORAGE_RCE

Name| railsactivestoragerce ---|--- CVE| CVE-2019-5420 Exploit Pack| CANVAS Description| Ruby on Rails Arbitrary Deserialization RCE CVE-2019-5420 Notes| CVE Name: CVE-2019-5420 VENDOR: Rails NOTES: The vulnerability resides in the ActionStorage component of Ruby on Rails due to insufficient...

openSUSE Security Update : git-annex (openSUSE-2019-497)

This update for git-annex to version 6.20180626 fixes the following issues : - CVE-2018-10857: Prevent file content disclosure by refusing to download content that cannot be verified with a hash, from encrypted special remotes and glacier bsc1098062. - CVE-2018-10859: Prevent local gpg encrypted...

openwsman: Disclosure of arbitrary files outside of the registered URIs

Openwsman, versions up to and including 2.6.9, are vulnerable to arbitrary file disclosure because the working directory of openwsmand daemon was set to root directory. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request to openwsman serve...

Rails 5.2.1 - Arbitrary File Content Disclosure Exploit

Exploit for multiple platform in category web applications ''' Exploit Title: File Content Disclosure on Rails Date: CVE disclosed 3/16 today's date is 3/20 Exploit Author: NotoriousRebel Vendor Homepage: https://rubyonrails.org/ Software Link: https://github.com/rails/rails Version: Versions...

SUSE SLED12 / SLES12 Security Update : openwsman (SUSE-SU-2019:0656-1)

This update for openwsman fixes the following issues : Security issues fixed : CVE-2019-3816: Fixed a vulnerability in openwsmand deamon which could lead to arbitary file disclosure bsc1122623. CVE-2019-3833: Fixed a vulnerability in processconnection which could allow an attacker to trigger an...

SUSE SLED15 / SLES15 Security Update : openwsman (SUSE-SU-2019:0654-1)

This update for openwsman fixes the following issues : Security issues fixed : CVE-2019-3816: Fixed a vulnerability in openwsmand deamon which could lead to arbitary file disclosure bsc1122623. CVE-2019-3833: Fixed a vulnerability in processconnection which could allow an attacker to trigger an...

Rails 5.2.1 - Arbitrary File Content Disclosure

''' Exploit Title: File Content Disclosure on Rails Date: CVE disclosed 3/16 today's date is 3/20 Exploit Author: NotoriousRebel Vendor Homepage: https://rubyonrails.org/ Software Link: https://github.com/rails/rails Version: Versions Affected: all Fixed Versions: 6.0.0.beta3, 5.2.2.1, 5.1.6.2,...

SUSE-SU-2019:0656-1 Security update for openwsman

This update for openwsman fixes the following issues: Security issues fixed: - CVE-2019-3816: Fixed a vulnerability in openwsmand deamon which could lead to arbitary file disclosure bsc1122623. - CVE-2019-3833: Fixed a vulnerability in processconnection which could allow an attacker to trigger an...

SUSE-SU-2019:0654-1 Security update for openwsman

This update for openwsman fixes the following issues: Security issues fixed: - CVE-2019-3816: Fixed a vulnerability in openwsmand deamon which could lead to arbitary file disclosure bsc1122623. - CVE-2019-3833: Fixed a vulnerability in processconnection which could allow an attacker to trigger an...

SUSE SLES11 Security Update : openwsman (SUSE-SU-2019:13981-1)

This update for openwsman fixes the following issues : Security issues fixed : CVE-2019-3816: Fixed a vulnerability in openwsmand deamon which could lead to arbitary file disclosure bsc1122623. CVE-2019-3833: Fixed a vulnerability in processconnection which could allow an attacker to trigger an...

Exploit for Path Traversal in Rubyonrails Rails

CVE-2019-5418 Test case Run : sh $ rails s PoC :...

SUSE-SU-2019:13981-1 Security update for openwsman

This update for openwsman fixes the following issues: Security issues fixed: - CVE-2019-3816: Fixed a vulnerability in openwsmand deamon which could lead to arbitary file disclosure bsc1122623. - CVE-2019-3833: Fixed a vulnerability in processconnection which could allow an attacker to trigger an...

CVE-2019-9843

In DiffPlug Spotless before 1.20.0 library and Maven plugin and before 3.20.0 Gradle plugin, the XML parser would resolve external entities over both HTTP and HTTPS and didn't respect the resolveExternalEntities setting. For example, this allows disclosure of file contents to a MITM attacker if a...

AZL-37151 CVE-2019-3816 affecting package openwsman for versions less than 2.6.8-13

Openwsman, versions up to and including 2.6.9, are vulnerable to arbitrary file disclosure because the working directory of openwsmand daemon was set to root directory. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request to openwsman serve...