CVE-2010-3299

The encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks...

CVE-2010-3299

The encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks...

Buffer overflow

The encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks...

CVE-2010-3299

CVE-2010-3299 : The initial description indicates a padding oracle vulnerability in the encrypt/decrypt functions of Ruby on Rails 2.3. Connected documentation confirms this CVE and reiterates the padding oracle issue but does not provide specifics on affected versions beyond Rails 2.3, nor detai...

CVE-2010-3299

The encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks...

Ruby on Rails: The authenticity_token can be reversed and used to forge valid per_form_csrf_tokens for arbitrary routes

When performcsrftokens is set to true, each form should protected against CSRF with a unique token that is not predictable by an attacker. Theperformcsrftoken is generated using a HMAC SHA-256 using a key that is exposed in a reversed authenticitytoken. The authenticitytoken is a Base64 encoding ...

CVE-2019-5419

There is a possible denial of service vulnerability in Action View Rails 5.2.2.1, 5.1.6.2, 5.0.7.2, 4.2.11.1 where specially crafted accept headers can cause action view to consume 100% cpu and make the server unresponsive...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Redhat Cloudforms

CVE-2018-3760 Rails Asset Pipeline Directory Traversal Vuln...

CVE-2017-2664

CloudForms lacks RBAC controls on certain methods in the rails application portion of CloudForms. An attacker with access could use a variety of methods within the rails applications portion of CloudForms to escalate privileges...

Security Bulletin: A vulnerability in Ruby on Rails affects IBM License Metric Tool v9 (CVE-2019-5419).

Summary There is a vulnerability in Ruby On Rails that is used by IBM License Metric Tool. Vulnerability Details CVEID: CVE-2019-5419 DESCRIPTION: Ruby on Rails Action View module is vulnerable to a denial of service, caused by improper input validation. By sending specially-crafted accept header...

Rails Arbitrary File Content Disclosure

A File disclosure vulnerability has been identified on this Rails Application. This vulnerabilities exists in Action View in rails versions 5.2.2.1, 5.1.6.2, 5.0.7.2, 4.22.11.1 or 6.0.0.beta3 whereby a remote, unauthenticated attacker can read the contents of arbitrary files on the target system...

CVE-2009-2422

The example code for the digest authentication functionality httpauthentication.rb in Ruby on Rails before 2.3.3 defines an authenticateorrequestwithhttpdigest block that returns nil instead of false when the user does not exist, which allows context-dependent attackers to bypass authentication f...

Exploit for Path Traversal in Rubyonrails Rails

Rails 3 PoC of CVE-2019...

Plataformatec Devise Authorization Issues Vulnerability

Plataformatec Devise is a Warden-based Rails authentication solution from Plataformatec, Brazil. An authorization issue vulnerability exists in Plataformatec Devise versions prior to 4.7.1. No detailed vulnerability details are provided at this time...

Moderate: Red Hat Security Advisory: CloudForms 4.7.9 security, bug fix and enhancement update

An update is now available for CloudForms Management Engine 5.10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

GitLab Information Disclosure Vulnerability (CNVD-2019-30783)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab Enterprise and...

GitLab HTML Injection Vulnerability (CNVD-2019-31316)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An HTML injection vulnerability exists in GitLab Enterpri...

SUSE-SU-2019:2182-1 Security update for rubygem-rails-html-sanitizer

This update for rubygem-rails-html-sanitizer fixes the following issues: - CVE-2018-3741: Fixed a XSS vulnerability due to insufficient filtering in scrubattribute bsc1086598...

Moderate: Red Hat Security Advisory: CloudForms 4.7.8 security, bug fix and enhancement update

An update is now available for CloudForms Management Engine 5.10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

cPanel Code Execution Vulnerability (CNVD-2019-26348)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. A code execution vulnerability exists in versions of cPanel prior to 64.0.21. The vulnerability can be exploited by an attacker t...