CVE-2021-39900

Information disclosure from SendEntry in GitLab starting with 10.8 allowed exposure of full URL of artifacts stored in object-storage with a temporary availability via Rails logs...

CVE-2021-39900

Removed by vendor...

GitLab 日志信息泄露漏洞

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An information disclosure vulnerability exists in GitLab...

GitLab 代码问题漏洞

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A code issue vulnerability exists in GitLab CE/EE, which...

GitLab Enterprise Edition 安全特征问题漏洞

GitLab Enterprise Edition is a content management system GitLab is a self-hosted Git version control system project repository application developed by GitLab, Inc. using Ruby on Rails. The program can be used to access the project's file content, commit history, bug list, etc.. A security...

GitLab 访问控制错误漏洞

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug list, and more. An access control error vulnerability exists in GitLab tha...

[SECURITY] [DLA 2763-1] ruby-kaminari security update

Debian LTS Advisory DLA-2763-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany September 22, 2021 https://wiki.debian.org/LTS Package : ruby-kaminari Version : 0.17.0-3+deb9u1 CVE ID : CVE-2020-11082 Debian Bug : 961847 A security vulnerability has been found in...

The vulnerability of the regular expression processor in the Mime-type parser of the ActionDispatch framework in the Ruby programming platform of Ruby on Rails, related to an uncontrolled resource consumption, allows attackers to cause service failures.

The vulnerability of the regular expression processor in the Mime-type parser of the ActionDispatch framework in the Ruby programming platform’s Ruby on Rails framework is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service...

The vulnerability in the intermediate software of the Host Authorization framework of the actionpack ruby gem in the Ruby on Rails software platform arises from insufficient input validation. This allows attackers to access sensitive data and compromise its integrity.

The vulnerability in the Host Authorization framework of the actionpack ruby gem in the Ruby on Rails software platform relates to the conversion of strings in config.hosts without a starting point, into regular expressions without encapsulation. Exploiting this vulnerability can allow an attacke...

Github Clearance 输入验证错误漏洞

Github Clearance is using email and password for Rails authentication. An input validation error vulnerability exists in clearance, which stems from the fact that if the value used for returnto contains multiple leading slashes //////example.com, the user ends up being redirected to an external...

CVE-2021-39197

bettererrors is an open source replacement for the standard Rails error page with more information rich error pages. It is also usable outside of Rails in any Rack app as Rack middleware. bettererrors prior to 2.8.0 did not implement CSRF protection for its internal requests. It also did not...

Cross site request forgery (csrf)

bettererrors is an open source replacement for the standard Rails error page with more information rich error pages. It is also usable outside of Rails in any Rack app as Rack middleware. bettererrors prior to 2.8.0 did not implement CSRF protection for its internal requests. It also did not...

CVE-2021-39197 Cross-Site Request Forgery in better_errors

bettererrors is an open source replacement for the standard Rails error page with more information rich error pages. It is also usable outside of Rails in any Rack app as Rack middleware. bettererrors prior to 2.8.0 did not implement CSRF protection for its internal requests. It also did not...

CVE-2021-39197

CVE-2021-39197 affects the Ruby gem better_errors. It describes that versions prior to 2.8.0 did not implement CSRF protection for internal requests and did not enforce the correct Content-Type header, allowing cross-origin (CORS) attacks in applications with better_errors enabled. The issue is l...

GitLab Information Disclosure Vulnerability (CNVD-2022-23495)

GitLab is a self-hosted, Git version control system project repository application developed in Ruby on Rails by GitLab, Inc. GitLab is vulnerable to an information disclosure vulnerability caused by an unrestricted instance of the application's "/user.keys" route that disables public visibility...

Exploit for Command Injection in Rubyonrails Rails

CVE-2019-5420 A vulnerability can allow an attacker to guess t...

Exploit for Command Injection in Rubyonrails Rails

CVE-2019-5420 A vulnerability can allow an attacker to guess t...

Ruby on Rails: Content Security Policy is only active for HTML responses but not for image/svg+xml

A vulnerability was discovered in Rails where the Content Security Policy CSP was only applied to HTML responses and not to image/svg+xml responses. This allowed an attacker to execute malicious JavaScript code by uploading a malicious SVG file and sending a link to the victim...

Open Redirect

Overview clearance is an authentication app for rails. Affected versions of this package are vulnerable to Open Redirect. The vulnerability can be possible when users are able to set the value of session:returnto. If the value used for returnto contains multiple leading slashes /////example.com t...

Vulnerability fixed in Ruby on Rails

A vulnerability has been fixed in Ruby on Rails. The vulnerability allows a malicious person to use an Open Redirect attack to send the visitor with a custom link to a malicious website. send. Ruby on Rails has released updates to fix the vulnerability. fix. For more information, see:...