4495 matches found
UBUNTU-CVE-2020-5216
In Secure Headers RubyGem secureheaders, a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/overridecontentsecuritypolicydirectives, a newline could be injected leading to limited header injection. Upon seeing a...
CVE-2020-5216
In Secure Headers RubyGem secureheaders, a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/overridecontentsecuritypolicydirectives, a newline could be injected leading to limited header injection. Upon seeing a...
CVE-2020-5216 Limited header injection when using dynamic overrides with user input in RubyGems secure_headers
In Secure Headers RubyGem secureheaders, a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/overridecontentsecuritypolicydirectives, a newline could be injected leading to limited header injection. Upon seeing a...
secure_headers header injection due to newline
If user-supplied input was passed into append/overridecontentsecuritypolicydirectives, a newline could be injected leading to limited header injection. Upon seeing a newline in the header, rails will silently create a new Content-Security-Policy header with the remaining value of the original...
Input validation
The papercrop gem before 0.3.0 for Ruby on Rails does not properly handle crop input...
CVE-2015-2784
The CVE-2015-2784 entry concerns the papercrop gem for Ruby on Rails. Affected software is the papercrop gem before version 0.3.0; the root cause is improper handling of crop input. Impacted systems may face security issues due to unvalidated or mishandled crop data, with public sources indicatin...
openSUSE: Security Advisory for rmt-server (openSUSE-SU-2019:1824-1)
The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
GitLab Information Disclosure Vulnerability (CNVD-2020-01232)
GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An information disclosure vulnerability exists in GitLab,...
Prototype Pollution in handlebars
The bootstrap-wysihtml5-rails gem includes the vendored JavaScript library 'handlebars.js'. Versions 0.3.3.7-0.3.3.8 include handlebars 3.0.2, and versions 0.3.3.5-0.3.3.6 include handlebars 1.3.0. Versions Affected: 0.3.3.5-0.3.3.8 Not affected: 0.3.3.5 Fixed Versions: None Versions of handlebar...
Security Bulletin: Vulnerabilities in Ruby on Rails affect IBM License Metric Tool v9.
Summary Vulnerabilities discovered in Ruby on Rails component affect IBM License Metric Tool v9. Vulnerability Details CVEID: CVE-2019-15587 DESCRIPTION: In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished. CVSS...
VulnCheck KEV: CVE-2016-0752
Directory traversal vulnerability in Action View in Ruby on Rails allows remote attackers to read arbitrary files...
Moderate: Red Hat Security Advisory: CloudForms 5.0.1 security, bug fix and enhancement update
An update is now available for CloudForms Management Engine 5.11. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...
Moderate: Red Hat Bug Fix Advisory: CloudForms 5.0 bug fix and enhancement update
An update is now available for CloudForms Management Engine 5.11. Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a model-view-controller M...
Ruby on Rails: Prevent XSS when passing a parameter directly into link_to
Note: I would say this is perhaps more of a feature request than an actual vulnerability, but Rafael França deleted this from GitHub and asked to submit it here instead In a rails views it's easy to accidentally create an XSS vulnerability by using the following in a template: Doing this exposes...
Open Redirect Payload List
Unvalidated redirects and forwards are possible when a web application accepts untrusted input that could cause the web application to redirect the request to a URL contained within untrusted input. By modifying untrusted URL input to a malicious site, an attacker may successfully launch a phishi...
GitLab Resource Management Error Vulnerability (CNVD-2019-44228)
GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A resource management error vulnerability exists in GitLa...
Exploit for Path Traversal in Rubyonrails Rails
CVE-2019-5418 Another sca...
vulhub
It is an offensive tool for web application security training. The tool is a collection of pre-built vulnerable docker environments, Vulhub, which can be used to test and train web application security skills. The tool is designed to be easy to use, with a simple installation process and a...
