4495 matches found
The vulnerability of the Token Authentication logic in the Action Controller component of the actionpack plugin for the Ruby on Rails software framework allows a hacker to cause a service failure due to uncontrolled resource consumption.
The vulnerability of the Token Authentication logic in the Action Controller component of the actionpack plugin for the Ruby on Rails software framework is related to insufficiently strict regular expressions. Exploiting this vulnerability could allow an attacker to cause a service failure...
Insufficient Session Expiration
Overview camaleoncms is a dynamic and advanced content management system based on Ruby on Rails as an alternative to Wordpress. Affected versions of this package are vulnerable to Insufficient Session Expiration when active sessions of the users are not being terminated. Remediation Upgrade...
Cross-site Scripting (XSS)
Overview rails is an opensource MVC web framework. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the autolink function in Rails. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” a malicious script into an otherwi...
CamaleonCMS 代码问题漏洞
Camaleon CMS is a RubyonRails-based advanced dynamic content management system CMS from the Camaleon CMS team. Camaleon CMS has a server-side request forgery vulnerability in versions 2.1.2.0 through 2.6.0, which stems from the product's failure to properly validate user input and can be exploite...
Internet Bug Bounty: The Host Authorization middleware in Action Pack is vulnerable to crafted X-Forwarded-Host values
Title: The Host Authorization middleware in Action Pack is vulnerable to crafted X-Forwarded-Host values Scope: https://github.com/rails/rails Weakness: Open Redirect Severity: Medium Link: https://hackerone.com/reports/1189310 Date: 2021-05-09 06:29:19 +0000 By: @mshtawy CVE IDs: CVE-2021-22942,...
CVE-2011-1497
A cross-site scripting vulnerability flaw was found in the autolink function in Rails before version 3.0.6...
CVE-2011-1497
A cross-site scripting vulnerability flaw was found in the autolink function in Rails before version 3.0.6...
Cross site scripting
A cross-site scripting vulnerability flaw was found in the autolink function in Rails before version 3.0.6...
CVE-2011-1497
A cross-site scripting vulnerability flaw was found in the autolink function in Rails before version 3.0.6...
CVE-2011-1497
CVE-2011-1497 is a cross-site scripting (XSS) vulnerability in the auto_link function of Ruby on Rails, affecting Rails versions before 3.0.6. The flaw is described as an XSS vulnerability in the auto_link routine, implying that user-controlled input could be coerced into HTML output without prop...
CVE-2011-1497
A cross-site scripting vulnerability flaw was found in the autolink function in Rails before version 3.0.6...
Rails 跨站脚本漏洞
Rails is a set of open source web application frameworks based on the Ruby language from the Rails team. A cross-site scripting vulnerability exists in the autolink function in versions prior to Rails 3.0.6. No more information on this vulnerability is available at this time, so stay tuned to CNN...
CVE-2021-22942
A possible open redirect vulnerability in the Host Authorization middleware in Action Pack = 6.0.0 that could allow attackers to redirect users to a malicious website...
Alchemy CMS 6.0.0 Arbitrary File Upload
Exploit Title: AlchemyCMS 2.x to 6.0.0 - Unrestricted File Upload authenticated Date: 01/10/2021 Exploit Author: Abdulrahman https://twitter.com/infosec90 Vendor Homepage: https://alchemy-cms.com Software Link: https://github.com/AlchemyCMS/alchemycms Version: from 2.0 to 6.0.0 Tested on: Linux...
GitLab 安全漏洞
GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug list, and more. A security vulnerability exists in GitLab that arises from...
CVE-2021-39900
Information disclosure from SendEntry in GitLab starting with 10.8 allowed exposure of full URL of artifacts stored in object-storage with a temporary availability via Rails logs...
CVE-2021-39900
Information disclosure from SendEntry in GitLab starting with 10.8 allowed exposure of full URL of artifacts stored in object-storage with a temporary availability via Rails logs...
Information disclosure
Information disclosure from SendEntry in GitLab starting with 10.8 allowed exposure of full URL of artifacts stored in object-storage with a temporary availability via Rails logs...