GHSA-6JVM-3J5H-79F6 paperclip Cross-site Scripting vulnerability

The thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type value during media-type validation, which allows remote attackers to upload HTML documents and conduct cross-site scripting XSS attacks via a spoofed value, as demonstrated by image/jpeg...

RubyGems Paperclip Excessive Logging Content Spoofing Vulnerability

RubyGems Paperclip is a plugin for extending ActiveRecord ORM model and providing simple file attachment functionality. A content spoofing vulnerability exists in RubyGems Paperclip versions 4.2.2 through 4.3.5. An attacker can exploit this vulnerability to spoof content...

Ruby On Rails Paperclip跨站脚本漏洞

No description provided by source...

Cross site scripting

The thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type value during media-type validation, which allows remote attackers to upload HTML documents and conduct cross-site scripting XSS attacks via a spoofed value, as demonstrated by image/jpeg...

CVE-2015-2963

The thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type value during media-type validation, which allows remote attackers to upload HTML documents and conduct cross-site scripting XSS attacks via a spoofed value, as demonstrated by image/jpeg...

CVE-2015-2963

The thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type value during media-type validation, which allows remote attackers to upload HTML documents and conduct cross-site scripting XSS attacks via a spoofed value, as demonstrated by image/jpeg...

CVE-2015-2963

CVE-2015-2963 affects the thoughtbot Paperclip gem for Ruby pre‑4.2.2. The vulnerability arises because media-type validation does not consider the content-type, allowing remote attackers to upload HTML documents and trigger cross-site scripting (XSS) via spoofed values (e.g., image/jpeg). Impact...

Ruby On Rails Paperclip Cross-Site Scripting Vulnerability

Ruby on Rails Rails is Rails core team development and maintenance of a set of open source Web application framework based on the Ruby language . Paperclip is a Rails upload image plugin . Ruby On Rails Paperclip has a cross-site scripting vulnerability. This vulnerability allows an attacker to...

RubyGems Paperclip Input Validation Vulnerability

RubyGems Paperclip is a file attachment management library for Active Record. RubyGems Paperclip fails to adequately filter user-submitted input, allowing remote attackers to manipulate pages and spoof content...

FreeBSD : rubygem-paperclip -- validation bypass vulnerability (0f154810-16e4-11e5-a1cf-002590263bf5)

Jon Yurek reports : Thanks to MORI Shingo of DeNA Co., Ltd. for reporting this. There is an issue where if an HTML file is uploaded with a .html extension, but the content type is listed as being image/jpeg, this will bypass a validation checking for images. But it will also pass the spoof check,...

Ruby on Rails library Paperclip vulnerable to cross-site scripting

Overview Paperclip provided by thoughtbot is a library to upload files in Ruby on Rails. Paperclip contains a persistent cross-site scripting vulnerability CWE-79. MORI Shingo of DeNA Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security...

JVN#83881261: Ruby on Rails library Paperclip vulnerable to cross-site scripting

Paperclip provided by thoughtbot is a library to upload files in Ruby on Rails. Paperclip contains a persistent cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Update to the latest version according to t...

rubygem-paperclip -- validation bypass vulnerability

Jon Yurek reports: Thanks to MORI Shingo of DeNA Co., Ltd. for reporting this. There is an issue where if an HTML file is uploaded with a .html extension, but the content type is listed as being image/jpeg, this will bypass a validation checking for images. But it will also pass the spoof check,...

Paperclip Gem for Ruby vulnerable to content type spoofing

There is an issue where if an HTML file is uploaded with a .html extension, but the content type is listed as being image/jpeg, this will bypass a validation checking for images. But it will also pass the spoof check, because a file named .html and containing actual HTML passes the spoof check...

HackerOne: PNG compression DoS

ztxt: http://www.libpng.org/pub/png/spec/1.1/PNG-Chunks.htmlC.zTXt "zTXT Documentation" tech: http://www.zlib.net/zlibtech.html "zlib technical details" zlibvuln1: http://www.kb.cert.org/vuls/id/680620 zlibvuln2: http://www.kb.cert.org/vuls/id/238678 PNG compression DoS ---------------------...