Moderate: Red Hat Security Advisory: cfme, cfme-appliance, and cfme-gemset security, bug fix, and enhancement update

An update for cfme, cfme-appliance, and cfme-gemset is now available for CloudForms Management Engine 5.7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Cross-site Scripting (XSS)

intercom-rails is vulnerable to cross-site scripting XSS attacks. These attacks are possible through the script tags in intercom settings...

macOS : macOS Server < 5.3 Multiple Vulnerabilities

The version of macOS Server formerly known as Mac OS X Server installed on the remote host is prior to 5.3. It is, therefore, affected by the following vulnerabilities : - A denial of service vulnerability exists in the Apache HTTP server when handling a saturation of partial HTTP requests. An...

Moderate: Red Hat Security Advisory: CFME 5.7.1 bug fixes and enhancement update

Updated cfme packages that fix bugs and add various enhancements are now available for Red Hat CloudForms 4.2. Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments. CloudForms Management Engine is buil...

SUSE-SU-2017:0475-1 Security update for susestudio

This update provides SUSE Studio Runner 1.3.14, which brings fixes for the following issues: - bsc968797: 11 SP3 appliance gets invalid distribution upgrade from SLMS. - bsc947225: Second build of appliance will not register to SLMS, wrong product name. - bsc983404: UEFI boot missing for SLE11 SP...

Imgur: Remote Code Execution on Git.imgur-dev.com

Hi, Imgur Security Team: I just found that your GitHub Enterprise Serverhttps://git.imgur-dev.com/ didn't patch to the latest version2.8.7. And there is a Rails static key leads to RCE vulnerability! You can see the PoC from my screenshots :...

Man In The Middle (mitm)

haml-rails is vulnerable to man-in-the-middle MitM attacks. The gemcutter source is deprecated because HTTP requests are insecure. A malicious user can potentially compromise the source to conduct MitM attacks...

Cross-Site Scripting (XSS)

intercom-rails is vulnerable to cross-site scripting XSS attacks. A malicious user can inject or execute arbitrary script by pre-appending script tags before the arbitrary script in their data...

Denial Of Service (DoS)

apipie-rails is vulnerable to denial of service DoS attacks. A malicious user can pass a malicious url parameter to the server and cause massive memory consumption in it...

Ruby on Rails: CSRF header is sent to external websites when using data-remote forms

Looks like there is a regression in the fix for CVE-2015-1840 H1 report. The origin isn't being checked before adding a CSRF header to data-remote forms. I noticed this when checking out the new rails-ujs repo. Example Rails template: submit Example http://attacker.com app require "sinatra" optio...

Fedora Update for rubygem-rails FEDORA-2016-5760339e76

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Important: Red Hat Security Advisory: CFME 5.6.3 security, bug fix, and enhancement update

An update is now available for Red Hat CloudForms 4.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in...

Fedora 25 : 1:rubygem-actionmailer / 1:rubygem-actionpack / etc (2016-5760339e76)

Update to Rails 5.0.0.1. Enable whole test suite in Railties. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Ruby on Rails Dynamic Render code execution

Added: 11/11/2016 CVE: CVE-2016-0752 BID: 81801 Background Ruby on Rails is a web application framework written in Ruby. Problem A vulnerability in Ruby on Rails allows arbitrary code to be uploaded and executed on the server if the application endpoint users dynamic render paths. Resolution...

Ruby on Rails Dynamic Render code execution

Added: 11/11/2016 CVE: CVE-2016-0752 BID: 81801 Background Ruby on Rails is a web application framework written in Ruby. Problem A vulnerability in Ruby on Rails allows arbitrary code to be uploaded and executed on the server if the application endpoint users dynamic render paths. Resolution...

Ruby on Rails Dynamic Render code execution

Added: 11/11/2016 CVE: CVE-2016-0752 BID: 81801 Background Ruby on Rails is a web application framework written in Ruby. Problem A vulnerability in Ruby on Rails allows arbitrary code to be uploaded and executed on the server if the application endpoint users dynamic render paths. Resolution...

GitLab Directory Traversal Vulnerability

GitLab is a set of open source applications developed using Ruby on Rails to implement a self-hosted Git version control system project repository. GitLab suffers from a directory traversal vulnerability due to the program failing to properly check for symbolic links in user-supplied documents. A...

GitLab unauthorized access vulnerability can lead to remote command execution-vulnerability warning-the black bar safety net

GitLab is a use of Ruby on Rails development, Open Source Application, to achieve a self-hosted Git project repository, through a Web interface to access the public or private projects. 2 0 1 6 years 1 1 months to 3 December, the United States the congregation measured platform HackerOne announce...

Important: Red Hat Security Advisory: CFME 5.6.2.2 security, and bug fix update

An update for cfme is now available for Red Hat CloudForms 4.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

FreeBSD : Rails 4 -- Unsafe Query Generation Risk in Active Record (7e61cf44-6549-11e6-8286-00248c0c745d)

Ruby Security team reports : There is a vulnerability when Active Record is used in conjunction with JSON parameter parsing. This vulnerability has been assigned the CVE identifier CVE-2016-6317. This vulnerability is similar to CVE-2012-2660, CVE-2012-2694 and CVE-2013-0155. %NASLMINLEVEL 70300 ...