Immunity Canvas: RAILS_ACTIONPACK_RENDER

Name| railsactionpackrender ---|--- CVE| CVE-2016-2098 Exploit Pack| CANVAS Description| railsactionpackrender Notes| CVE Name: CVE-2016-2098 VENDOR: http://rubyonrails.org Notes: This vulnerability affects ActionPack gem and it allows remote attackers to execute arbitrary Ruby Code due to the...

Gem Miner - External URLs, SD-card access, Suspicious files vulnerabilities

HackApp vulnerability scanner discovered that application Gem Miner published at the 'play' market has multiple vulnerabilities...

rubygem-actionpack: possible object leak and denial of service attack in Action Pack

A flaw was found in the way the Action Pack component performed MIME type lookups. Since queries were cached in a global cache of MIME types, an attacker could use this flaw to grow the cache indefinitely, potentially resulting in a denial of service...

rubygem-actionpack: code injection vulnerability in Action View

A code injection flaw was found in the way Action View component searched for templates for rendering. If an application passed untrusted input to the 'render' method, a remote, unauthenticated attacker could use this flaw to execute arbitrary code...

Nokogiri gem contains a heap-based buffer overflow vulnerability in libxml2

Nokogiri version 1.6.7.2 has been released, pulling in several upstream patches to the vendored libxml2 to address the following CVE: CVE-2015-7499 CVSS v2 Base Score: 5.0 MEDIUM Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3 allows context-dependent...

Devise Gem for Ruby Unauthorized Access Using Remember Me Cookie

Devise version before 3.5.4 uses cookies to implement a "Remember me" functionality. However, it generates the same cookie for all devices. If an attacker manages to steal a remember me cookie and the user does not change the password frequently, the cookie can be used to gain access to the...

Huawei ALE and GEM-703L Joint Photographic Experts Group Processing Unit Denial of Service Vulnerability

The Huawei ALE smartphone and GEM-703L smartphone are smartphones from Huawei, China.Joint Photographic Experts Group Processing Unit JPU is one of the drivers.... A security vulnerability in the JPU driver for the Huawei ALE smartphone and GEM-703L smartphone allows remote attackers to gain syst...

Ruby colorscore gem任意代码执行漏洞

No description provided by source...

americangemsociety.org XSS vulnerability

Vulnerable URL: https://www.americangemsociety.org/site-search?q=%22%3E%3Csvg%2Fonload%3Dprompt%28%2Fxssposed%2F%29%3E Details: Description| Value ---|--- Patched:| Yes, at 22.11.2016 Latest check for patch:| 22.11.2016 10:33 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed...

Ruby colorscore gem arbitrary code execution vulnerability

Ruby is a cross-platform, object-oriented, dynamically-typed programming language developed by Japanese software developer Yukihiro Matsumoto. colorscore gem is one of the libraries used to distinguish colors. A security vulnerability exists in the 'initialize' method of the Histogram class in th...

CVE-2015-7541

The initialize method in the Histogram class in lib/colorscore/histogram.rb in the colorscore gem before 0.0.5 for Ruby allows context-dependent attackers to execute arbitrary code via shell metacharacters in the 1 imagepath, 2 colors, or 3 depth variable...

Design/Logic Flaw

The initialize method in the Histogram class in lib/colorscore/histogram.rb in the colorscore gem before 0.0.5 for Ruby allows context-dependent attackers to execute arbitrary code via shell metacharacters in the 1 imagepath, 2 colors, or 3 depth variable...

CVE-2015-7541

The CVE refers to the colorscore Ruby gem, specifically the Histogram.initialize method in lib/colorscore/histogram.rb, vulnerable before version 0.0.5. The root cause is shell metacharacters in user-supplied input (image_path, colors, or depth) being passed to shell commands, enabling arbitrary ...

CVE-2015-7541

The initialize method in the Histogram class in lib/colorscore/histogram.rb in the colorscore gem before 0.0.5 for Ruby allows context-dependent attackers to execute arbitrary code via shell metacharacters in the 1 imagepath, 2 colors, or 3 depth variable...

CVE-2015-8226

The Joint Photographic Experts Group Processing Unit JPU driver in Huawei ALE smartphones with software before ALE-UL00C00B220 and ALE-TL00C01B220 and GEM-703L smartphones with software before V100R001C233B111 allows remote attackers to cause a denial of service crash via a crafted application wi...

CVE-2015-8225

The Joint Photographic Experts Group Processing Unit JPU driver in Huawei ALE smartphones with software before ALE-UL00C00B220 and ALE-TL00C01B220 and GEM-703L smartphones with software before V100R001C233B111 allows remote attackers to cause a denial of service crash via a crafted application wi...

Design/Logic Flaw

The Joint Photographic Experts Group Processing Unit JPU driver in Huawei ALE smartphones with software before ALE-UL00C00B220 and ALE-TL00C01B220 and GEM-703L smartphones with software before V100R001C233B111 allows remote attackers to cause a denial of service crash via a crafted application wi...

CVE-2015-8225

The Joint Photographic Experts Group Processing Unit JPU driver in Huawei ALE smartphones with software before ALE-UL00C00B220 and ALE-TL00C01B220 and GEM-703L smartphones with software before V100R001C233B111 allows remote attackers to cause a denial of service crash via a crafted application wi...

CVE-2015-8226

The Huawei JPU (Joint Photographic Experts Group Processing Unit) driver in ALE smartphones (before ALE-UL00C00B220 for ALE and before V100R001C233B111 for GEM-703L) is vulnerable to a remote DoS that crashes the device when a crafted application with system or camera permission is run. This vuln...

Scientific Linux Security Update : rubygem-bundler and rubygem-thor on SL7.x (noarch) (20151119)

A flaw was found in the way Bundler handled gems available from multiple sources. An attacker with access to one of the sources could create a malicious gem with the same name, which they could then use to trick a user into installing, potentially resulting in execution of code from the...