Ruby will_paginate Gem跨站脚本漏洞

CVE ID:CVE-2013-6459 Ruby是跨平台、面向对象的动态类型编程语言。willpaginate是一个分页插件，提供将搜索结果进行分页显示的功能。 willpaginate gem for Ruby存在跨站脚本漏洞。远程攻击者可通过与生成的分页链接相关的输入利用该漏洞注入任意Web脚本或HTML。 0 willpaginate gem for Ruby 3.x 厂商补丁： Ruby ----- 厂商已经发布了升级补丁以修复此安全问题，补丁获取链接： https://github.com/mislav/willpaginate/releases/tag/v3.0.5...

CVE-2013-2119

Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service prevent application start or gain privileges by pre-creating a temporary "config" file in a directory with a predictable name in /tmp/ before it is used by the gem...

UBUNTU-CVE-2013-2119

Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service prevent application start or gain privileges by pre-creating a temporary "config" file in a directory with a predictable name in /tmp/ before it is used by the gem...

flukso4r Gem for Ruby /lib/flukso/R.rb任意命令执行漏洞

flukso4r Gem for Ruby是一款Flukso API库。 flukso4r Gem for Ruby /lib/flukso/R.rb不正确过滤用户提交的输入，允许远程攻击者利用漏洞提交特意输入，并以应用程序上下文执行。 0 flukso4r Gem for Ruby 0.3.8 目前没有详细解决方案提供： http://rubygems.org/gems/flukso4r...

CVE-2013-2119

Phusion Passenger gem vulnerability (CVE-2013-2119) affects Phusion Passenger for Ruby, specifically the gem versions before 3.0.21 and 4.0.x before 4.0.5. The issue arises from insecure handling of temporary directories/files in /tmp, where a local attacker can pre-create a predictable temporary...

CVE-2013-6459

Cross-site scripting XSS vulnerability in the willpaginate gem before 3.0.5 for Ruby allows remote attackers to inject arbitrary web script or HTML via vectors involving generated pagination links...

DEBIAN-CVE-2013-6459

Cross-site scripting XSS vulnerability in the willpaginate gem before 3.0.5 for Ruby allows remote attackers to inject arbitrary web script or HTML via vectors involving generated pagination links...

UBUNTU-CVE-2013-6459

Cross-site scripting XSS vulnerability in the willpaginate gem before 3.0.5 for Ruby allows remote attackers to inject arbitrary web script or HTML via vectors involving generated pagination links...

CVE-2013-6459

The CVE-2013-6459 entry concerns the will_paginate gem for Ruby, vulnerable before version 3.0.5 to Cross-site Scripting (XSS) via generated pagination links. Public references confirm the issue and link to the fixed release (3.0.5) from the gem’s release notes. In practice, an attacker could ind...

DSA-2830-1 ruby-i18n - cross-site scripting

Bulletin has no description...

paratrooper-pingdom Gem for Ruby /lib/paratrooper-pingdom.rb API Login Credentials Local Disclosure

paratrooper-pingdom Gem for Ruby contains a flaw in /lib/paratrooper-pingdom.rb. The issue is triggered when the script exposes API login credentials, allowing a local attacker to gain access to the API key, username, and password for the API login by monitoring the process tree...

Fat Free CRM Gem for Ruby contains multiple cross-site request forgery (CSRF) vulnerabilities

Fat Free CRM contains a flaw as the application is missing the protectfromforgery statement, therefore HTTP requests to app/controllers/applicationcontroller.rb do not require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions. By tricking a user in...

Fat Free CRM Gem for Ruby allows remote attackers to obtain sensitive informations

Fat Free CRM contains a flaw in user controllers that is triggered as JSON requests are rendered with a full JSON object. This may allow a remote attacker to gain access to potentially sensitive information e.g. other users password hashes...

Fat Free CRM Gem for Ruby allows remote attackers to inject or manipulate SQL queries

Fat Free CRM contains a flaw that may allow carrying out an SQL injection attack. The issue is due to the app/controllers/homecontroller.rb script not properly sanitizing user-supplied input to the 'state' parameter or input passed via comments and emails. This may allow a remote attacker to inje...

Fedora 19 : rubygem-i18n-0.6.1-4.fc19 (2013-23062)

Fix cross-site scripting flaw in exception handling CVE-2013-4492. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Design/Logic Flaw

The message function in lib/webbynode/notify.rb in the Webbynode gem 1.0.5.3 and earlier for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a growlnotify message...

CVE-2013-7086

The CVE concerns the Webbynode Ruby gem. The affected component is the notify.rb in the Webbynode gem (version 1.0.5.3 and earlier). The root cause is improper handling of growlnotify messages, allowing context-dependent attackers to inject and execute arbitrary shell commands via metacharacters ...

CVE-2013-7086

The message function in lib/webbynode/notify.rb in the Webbynode gem 1.0.5.3 and earlier for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a growlnotify message...

rubygems: Two security fixes in v1.8.23

RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers to modify a gem during installation via a man-in-the-middle attack...

Webbynode Ruby Gems命令注入漏洞

Bugtraq ID:64289 CVE ID:CVE-2013-7086 Ruby Gem Webbynode是一款让用户部署应用至Webbynode平台的工具。 Ruby Gem Webbynode没有正确过滤通过growlnotify命令所提交的消息，如果消息中包含shell元字符，可以应用程序上下文执行任意命令。 0 Ruby Gem Webbynode 1.0.5.3 目前厂商暂无提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://rubygems.org/gems/webbynode...