CVE-2020-26223

The CVE-2020-26223 issue affects Spree (Ruby on Rails) versions 3.7 and earlier than 3.7.13, 4.0.5, and 4.1.12, where an authorization bypass allows querying the API v2 Order Status endpoint with an empty string as the Order token. The vulnerability is mitigated by patches in 3.7.11, 4.0.4, and 4...

CVE-2020-26223 Authorization bypass in Spree

Spree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and before versions 3.7.13, 4.0.5, and 4.1.12, there is an authorization bypass vulnerability. The perpetrator could query the API v2 Order Status endpoint with an empty string passed as an Ord...

Ruby on Rails: Regular expression denial of service in ActiveRecord's PostgreSQL Money type

Summary Hello team! The regular expressions used in the Money type to convert strings like -$100,000.00 to 100000 have an execution time with a quadratic growth proportional to the length of the string. Causing the denial of service requires very long strings but if the parameter is in a post bod...

GitLab Cross-Site Scripting Vulnerability (CNVD-2021-26074)

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects. A reflective cross-site scripting vulnerability exists in GitLab 10.8 and later, no details of the...

GitLab Cross-Site Scripting Vulnerability (CNVD-2021-26077)

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects. A cross-site scripting vulnerability exists in the CI job log in GitLab. No details of the...

Fedora 33 : 1:rubygem-actionmailer / 1:rubygem-actionpack / etc (2020-4dd34860a3)

Upgrade to Ruby on Rails 6.0.3.3. Fixes CVEs: 1877568 1831529 1852381 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

[SECURITY] Fedora 33 Update: rubygem-rails-6.0.3.3-1.fc33

Ruby on Rails is a full-stack web framework optimized for programmer happin ess and sustainable productivity. It encourages beautiful code by favoring convention over configuration...

Security Bulletin: A vulnerability in Ruby on Rails affects IBM License Metric Tool v9 (CVE-2020-8166).

Summary There is a vulnerability in Ruby On Rails that is used by IBM License Metric Tool. Vulnerability Details CVEID: CVE-2020-8166 DESCRIPTION: Ruby on Rails is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input by authenticitytoken meta tag. By...

Security Bulletin: Vulnerabilities in Ruby on Rails affect IBM License Metric Tool v9.

Summary Vulnerabilities discovered in Ruby on Rails component affect IBM License Metric Tool v9. Vulnerability Details CVEID: CVE-2020-8184 DESCRIPTION: Rack could allow a remote attacker to bypass security restrictions, caused by the lack of validation/integrity check security for cookies. By...

Security Bulletin: A vulnerability in Ruby on Rails affects IBM License Metric Tool v9 (CVE-2020-8164).

Summary There is a vulnerability in Ruby On Rails that is used by IBM License Metric Tool. Vulnerability Details CVEID: CVE-2020-8164 DESCRIPTION: Ruby on Rails could allow a remote attacker to obtain sensitive information, caused by the deserialization of untrusted data. By sending a specially...

Moderate: Red Hat Security Advisory: CloudForms 5.0.8 security, bug fix and enhancement update

An update is now available for CloudForms Management Engine 5.11. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

GitLab Github Project Import Restriction Bypass Vulnerability

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects. A Github project import restriction bypass vulnerability exists in GitLab versions prior to 13.1. A...

Vulnerability fixed in Ruby on Rails

A vulnerability has been fixed in Ruby on Rails. The vulnerability allows an unauthenticated malicious person to execute arbitrary code on the victim's browser. To do this, the malicious party must trick the victim into following a rogue hyper-link to follow. Rails developers have released update...

GitLab Session Fixation Vulnerability

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects. A session fixation vulnerability exists in GitLab versions prior to 13.1.10, 13.2.8, and 13.3.4. Th...

GitLab Server-Side Request Forgery Vulnerability (CNVD-2020-52182)

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects. A server-side request forgery vulnerability exists in GitLab versions prior to 13.1.10, 13.2.8, and...

gettyimages.com Open Redirect vulnerability OBB-1323132

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

PT-2020-6207 · Ruby +3 · Ruby On Rails +3

Name of the Vulnerable Software and Affected Versions: Ruby on Rails versions prior to 5.2.4.4 and 6.0.3.3 Description: The issue is related to a potential Cross-Site Scripting XSS vulnerability in Action View's translation helpers. Views that allow the user to control the default value of the t...

GitLab Elevation of Privilege Vulnerability

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An elevation of privilege vulnerability exists in GitLab,...

Critical: Red Hat Security Advisory: CloudForms 4.7.16 security, bug fix and enhancement update

An update is now available for CloudForms Management Engine 5.10. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

RHEL 7 : CloudForms 4.7.16 (RHSA-2020:3574)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3574 advisory. Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual...