CVE-2014-7818

Directory traversal vulnerability in actionpack/lib/actiondispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when servestaticassets is enabled, allows remote attackers to determine the existence o...

Directory traversal

Directory traversal vulnerability in actionpack/lib/actiondispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when servestaticassets is enabled, allows remote attackers to determine the existence o...

CVE-2014-7819

CVE-2014-7819 affects Sprockets in Ruby on Rails 3.x/4.x, where server.rb exposes directory traversal via ../ sequences (including double slashes or URL-encoding), allowing remote attackers to infer existence of files outside the application root. Affected versions include 2.0.5–2.12.x (various 2...

CVE-2014-7819

Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3...

CVE-2014-7818

CVE-2014-7818 affects Ruby on Rails Action Pack, with a directory traversal in actionpack/lib/action_dispatch/middleware/static.rb when serve_static_assets is enabled. Affected: Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3. The underlying flaw all...

CVE-2014-7818

Directory traversal vulnerability in actionpack/lib/actiondispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when servestaticassets is enabled, allows remote attackers to determine the existence o...

CVE-2014-7819

Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3...

CVE-2014-7818

Directory traversal vulnerability in actionpack/lib/actiondispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when servestaticassets is enabled, allows remote attackers to determine the existence o...

PT-2014-8291 · Ruby +1 · Ruby On Rails +1

Name of the Vulnerable Software and Affected Versions: Sprockets versions prior to 2.0.5 Sprockets versions 2.1.x prior to 2.1.4 Sprockets versions 2.2.x prior to 2.2.3 Sprockets versions 2.3.x prior to 2.3.3 Sprockets versions 2.4.x prior to 2.4.6 Sprockets versions 2.5.x prior to 2.5.1 Sprocket...

Ruby on Rails: Arbitrary file existence disclosure in Action Pack

This bug was reported directly to the Rails team: https://groups.google.com/forum/!topic/rubyonrails-security/23fiuwb1NBA...

Gitlab 'groups' API security restrictions bypass vulnerability-vulnerability warning-the black bar safety net

Affected system: GitLab GitLab 6. x Description: BUGTRAQ ID: 7 0 8 4 1 GitLab is a use of Ruby on Rails development, Open Source Application, to achieve a self-hosted Git project repository, through a Web interface to access the public or private projects. Gitlab 6.0 and later on the realization ...

CVE-2014-7819 rubygem-sprockets: arbitrary file existence disclosure

Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3...

[SECURITY] [DSA 2982-1] ruby-activerecord-3.2 security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2982-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff July 19, 2014 http://www.debian.org/security/faq -...

Browser Exploitation Framework: BeEF

Browser Exploitation Framework The Browser Exploitation Framework BeEF is a powerful professional security tool. BeEF is pioneering techniques that provide the experienced penetration tester with practical client side attack vectors. Unlike other security frameworks, BeEF focuses on leveraging...

Searching Through Git Commits

gumbler is a script I wrote to search through git commits. Examples from github are discussed below. .gitignore A gitignore file is used to specify files that should not be tracked by git source gitignore. In the default case, gumbler will read the gitignore file for the project and search every...

Moderate: Red Hat Security Advisory: cfme security, bug fix, and enhancement update

Updated cfme packages that fix two security issues, several bugs, and add various enhancements are now available for Red Hat CloudForms 3.1. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed...

Fat Free CRM Cross Site Scripting

Affected software: Fatt Free CRM - URL: http://www.fatfreecrm.com/ Discovered by: Ankit Bharathan Type of vulnerability: XSS Stored Fat Free CRM is an open source Ruby on Rails-based customer relationship management platform. Out of the box it features group collaboration, campaign and lead...

Important: Red Hat Security Advisory: ror40-rubygem-activerecord security update

Updated ror40-rubygem-activerecord packages that fix one security issue are now available for Red Hat Software Collections 1. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Fatt Free CRM Cross Site Scripting

Hello Guys this is Sam , CEO and Chief Security Architect Provensec LLC . Please take note of the following submission. Affected software: Fatt Free CRM - URL: http://www.fatfreecrm.com/ Discovered by: Provensec Website: http://www.provensec.com Type of vulnerability: XSS Stored Fat Free CRM is a...

CVE-2014-3514

activerecord/lib/activerecord/relation/querymethods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows remote attackers to bypass the strong parameters protection mechanism via crafted input to an application that makes createwith calls...