2121 matches found
Ruby on Rails Web Console IP Whitelist Bypass RCE Vulnerability
The Web Console tool as used in Ruby on Rails is prone to a remote code execution RCE vulnerability. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...
Important: Red Hat Security Advisory: CloudForms 4.7.15 security, bug fix and enhancement update
An update is now available for CloudForms Management Engine 5.10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...
Important: Red Hat Security Advisory: CloudForms 5.0.3 security update
An update is now available for CloudForms Management Engine 5.11. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...
Ruby on Rails: Missing resource identifier encoding may lead to security vulnerabilities
I initially submitted this to the GitHub repository because the ActiveResource repository is not listed in scope. I was redirected here by @rafaelfranca A number of methods in the ActiveResource library, such as ActiveResource::Basefind and ActiveResource::Baseexists? don't URL encode the resourc...
The vulnerability of the MyJob.perform_later function in the Ruby on Rails software platform allows a perpetrator to gain unauthorized access to confidential data.
The vulnerability of the MyJob.performlater function in the Ruby on Rails software platform relates to the restoration of unreliable data structures in memory. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to confidential data...
GitLab EE Denial of Service Vulnerability
GitLab is a Ruby on Rails developed, self-hosted, Git version control system project repository application from GitLab, Inc. The program can be used to access the project's file contents, commit history, bug list , etc. Git is a free, open source distributed version control system. A security...
Ruby on Rails: ActiveStorage direct upload fails to sign content-length header for S3 service
When a user makes a direct upload using ActiveStorage, the browser makes a request to the DirectUploadsController containing the directupload parameters filename, contenttype, bytesize, and checksum. These are used to generate a presigned url that is then passed back to the browser, allowing the...
Input validation
The papercrop gem before 0.3.0 for Ruby on Rails does not properly handle crop input...
CVE-2015-2784
The CVE-2015-2784 entry concerns the papercrop gem for Ruby on Rails. Affected software is the papercrop gem before version 0.3.0; the root cause is improper handling of crop input. Impacted systems may face security issues due to unvalidated or mishandled crop data, with public sources indicatin...
GitLab Information Disclosure Vulnerability (CNVD-2020-01232)
GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An information disclosure vulnerability exists in GitLab,...
Security Bulletin: Vulnerabilities in Ruby on Rails affect IBM License Metric Tool v9.
Summary Vulnerabilities discovered in Ruby on Rails component affect IBM License Metric Tool v9. Vulnerability Details CVEID: CVE-2019-15587 DESCRIPTION: In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished. CVSS...
VulnCheck KEV: CVE-2016-0752
Directory traversal vulnerability in Action View in Ruby on Rails allows remote attackers to read arbitrary files...
Moderate: Red Hat Security Advisory: CloudForms 5.0.1 security, bug fix and enhancement update
An update is now available for CloudForms Management Engine 5.11. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...
Moderate: Red Hat Bug Fix Advisory: CloudForms 5.0 bug fix and enhancement update
An update is now available for CloudForms Management Engine 5.11. Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a model-view-controller M...
Ruby on Rails: Prevent XSS when passing a parameter directly into link_to
Note: I would say this is perhaps more of a feature request than an actual vulnerability, but Rafael França deleted this from GitHub and asked to submit it here instead In a rails views it's easy to accidentally create an XSS vulnerability by using the following in a template: Doing this exposes...
GitLab Resource Management Error Vulnerability (CNVD-2019-44228)
GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A resource management error vulnerability exists in GitLa...
Exploit for Path Traversal in Rubyonrails Rails
CVE-2019-5418 Another sca...
vulhub
It is an offensive tool for web application security training. The tool is a collection of pre-built vulnerable docker environments, Vulhub, which can be used to test and train web application security skills. The tool is designed to be easy to use, with a simple installation process and a...
