9465 matches found
CVE-2013-1855
The CVE-2013-1855 entry concerns a cross-site scripting flaw in Rails’ Action Pack sanitize_css in lib/action_controller/vendor/html-scanner/html/sanitizer.rb. The issue arises from improper handling of newline characters in CSS token sequences, enabling remote XSS via crafted CSS. Affected Rails...
PT-2013-3433 · Ruby +1 · Ruby On Rails +1
Name of the Vulnerable Software and Affected Versions: Ruby on Rails versions prior to 2.3.18 Ruby on Rails versions 3.0.x through 3.1.11 Ruby on Rails versions 3.2.x through 3.2.12 Description: The issue arises from the sanitize css method in the Action Pack component, which fails to properly...
XSS vulnerability in sanitize_css in Action Pack
Carefully crafted text can bypass the sanitization provided in the sanitizecss method in Action Pack...
XML Parsing Vulnerability affecting JRuby users
The ActiveSupport XML parsing functionality supports multiple pluggable backends. One backend supported for JRuby users is ActiveSupport::XmlMiniJDOM which makes use of the javax.xml.parsers.DocumentBuilder class. In some JVM configurations the default settings of that class can allow an attacker...
CVE-2013-1857 rubygem-actionpack: sanitize_protocol: XSS Vulnerability in the helper of Ruby on Rails
'The sanitize helper in lib/actioncontroller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded : colon characters in URLs, which makes it easier for remote...
DSquare Exploit Pack: D2SEC_APACHE_RAVE
Name| d2secapacherave ---|--- CVE| CVE-2013-1814 Exploit Pack| D2ExploitPack Description| d2secapacherave.py Notes|...
Microsoft SharePoint Server Privilege Elevation Vulnerabilities (2780176)
This host is missing a critical security update according to Microsoft Bulletin MS13-024. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...
Microsoft Visio Remote Code Execution Vulnerability (2801261)
This host is missing a critical security update according to Microsoft Bulletin MS13-023. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...
Microsoft Filter Pack Remote Code Execution Vulnerability (2801261)
This host is missing a critical security update according to Microsoft Bulletin MS13-023. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...
Microsoft Filter Pack Remote Code Execution Vulnerability (2801261)
This host is missing a critical security update according to Microsoft Bulletin MS13-023. OpenVAS Vulnerability Test $Id: secpodfilterpackms13-023.nasl 5365 2017-02-20 13:46:09Z cfi $ Microsoft Filter Pack Remote Code Execution Vulnerability 2801261 Authors: Antu Sanadi Copyright: Copyright c 201...
MS13-025: Vulnerability in Microsoft OneNote could allow information disclosure: March 12, 2013
Resolves a vulnerability in Microsoft OneNote that could allow information disclosure. This security update was released on March 12, 2013.INTRODUCTIONMicrosoft has released security bulletin MS13-025. To view the complete security bulletin, visit one of the following Microsoft websites: Home...
openSUSE: Security Advisory for ruby (openSUSE-SU-2013:0280-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
SuSE Update for ruby openSUSE-SU-2013:0278-1 (ruby)
Check for the Version of ruby OpenVAS Vulnerability Test $Id: gbsuse201302781.nasl 8542 2018-01-26 06:57:28Z teissa $ SuSE Update for ruby openSUSE-SU-2013:0278-1 ruby Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is fre...
rubygem-actionpack: Unsafe query generation (a different flaw than CVE-2012-2660)
actionpack/lib/actiondispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended...
Microsoft Windows XP Professionnel Service Pack 2 & 3 Insecure Library Load
An insecure library loading vulnerability has been identified in Microsoft Windows XP Professionnel Service Pack 2. The application uses a fixed path to look for specific files or libraries. This path includes directories that may not be trusted or under user control. By placing a custom version ...
Immunity Canvas: LINUX_PTRACE_SETREGS
Name| linuxptracesetregs ---|--- CVE| CVE-2013-0871 Exploit Pack| CANVAS Description| linuxptracesetregs local root Notes| Repeatability: Infinite Notes: Vulnerable kernels = 3.5 64-bit only. Tested on: - Ubuntu 12.10 64bit - Ubuntu 12.04 64bit - Debian 6 64bit Besides running the module inside...
Photodex ProShow Producer 5.0.3297 - '.pxs' Memory Corruption
!/usr/bin/python Exploit Title: Photodex ProShow Producer v5.0.3297 .pxs Memory Corruption Vulnerability Version: = 5.0.3297 Date: 2013-02-14 Author: Julien Ahrens @MrTuxracer Homepage: http://www.inshell.net Software Link: http://www.photodex.com Tested on: Windows XP SP3 Professional German...
Immunity Canvas: ACROBAT_XFA
Name| acrobatxfa ---|--- CVE| CVE-2013-0640 Exploit Pack| CANVAS Description| Adobe Acrobat Reader XFA =10.X Notes| CVE Name: CVE-2013-0640 VENDOR: Adobe VersionsAffected: 10.X and below Repeatability: CVE Url: https://vulners.com/cve/CVE-2013-0640 CERT Advisory: None CVSS: 9.3...
