Debian Security Advisory DSA 3464-1 (rails - security update)

Multiple security issues have been discovered in the Ruby on Rails web application development framework, which may result in denial of service, cross-site scripting, information disclosure or bypass of input validation. OpenVAS Vulnerability Test $Id: deb3464.nasl 6608 2017-07-07 12:05:05Z...

Debian: Security Advisory (DSA-3464-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ruby on Rails: Remote code execution using render :inline

Possible remote code execution vulnerability in Action Pack. There is a possible remote code execution vulnerability in Action Pack. This vulnerability has been assigned the CVE identifier CVE-2016-2098. Versions Affected: 3.2.x, 4.0.x, 4.1.x, 4.2.x Not affected: 5.0+ Fixed Versions: 3.2.22.2,...

Debian DSA-3464-1 : rails - security update

Multiple security issues have been discovered in the Ruby on Rails web application development framework, which may result in denial of service, cross-site scripting, information disclosure or bypass of input validation. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text an...

PT-2016-1513

Name of the Vulnerable Software and Affected Versions Ruby on Rails versions 3.1.x through 3.2.x before 3.2.22.1 Ruby on Rails versions 4.0.x through 4.1.x before 4.1.14.1 Ruby on Rails versions 4.2.x before 4.2.5.1 Ruby on Rails versions 5.x before 5.0.0.beta1.1 Description The issue is related ...

PT-2016-1510

Name of the Vulnerable Software and Affected Versions Action Pack in Ruby on Rails versions 3.2.x through 3.2.22, 4.0.x through 4.1.14, 4.2.x through 4.2.5, and 5.x before 5.0.0.beta1.1 Description The issue is related to the improper restriction of the MIME type cache in the actionpack/lib/actio...

PT-2016-1280 · Ruby +1 · Ruby On Rails +1

Name of the Vulnerable Software and Affected Versions: Ruby on Rails versions prior to 3.2.22.1 Ruby on Rails versions 4.0.x through 4.1.14 Ruby on Rails versions 4.2.x through 4.2.5 Ruby on Rails versions 5.x through 5.0.0.beta1.1 Description: The issue is related to a directory traversal...

DSA-3464-1 rails - security update

Bulletin has no description...

PT-2016-1514

Name of the Vulnerable Software and Affected Versions Ruby on Rails versions prior to 3.2.22.1 Ruby on Rails versions 4.0.x through 4.1.14 Ruby on Rails versions 4.2.x through 4.2.5 Ruby on Rails versions 5.x through 5.0.0.beta1 Description The issue is related to the http basic authenticate with...

Ruby on Rails 'to_json'调用远程拒绝服务漏洞

No description provided by source...

Ruby on Rails rails-html-sanitizer XSS 漏洞

XSS vulnerability in rails-html-sanitizer There is a XSS vulnerability in Rails::Html::FullSanitizer used by Action View's striptags. This vulnerability has been assigned the CVE identifier CVE-2015-7579. Versions Affected: 1.0.2 Not affected: 1.0.0, 1.0.1 Fixed Versions: 1.0.3 Impact Due to the...

Ruby on Rails ActiveModel::Name远程拒绝服务漏洞

No description provided by source...

Ruby On Rails Paperclip跨站脚本漏洞

No description provided by source...

Moderate: Red Hat Security Advisory: CFME 5.4.4 bug fixes, and enhancement update

Updated cfme packages that fix a security issue, several bugs, and add various enhancements are now available for Red Hat CloudForms 3.2. Red Hat Product Security has rated this update as having Moderate Security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed...

Ruby on Rails: http_basic_authenticate_with is suseptible to timing attacks.

Timing attack vulnerability in basic authentication in Action Controller. There is a timing attack vulnerability in the basic authentication support in Action Controller. This vulnerability has been assigned the CVE identifier CVE-2015-7576. Versions Affected: All. Not affected: None. Fixed...

Gentoo Security Advisory GLSA 201412-28

Gentoo Linux Local Security Checks GLSA 201412-28 SPDX-FileCopyrightText: 2015 Eero Volotinen Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...

Ruby on Rails: Nested attributes reject_if proc can be circumvented by providing "_destroy" parameter

Nested attributes rejection proc bypass in Active Record. There is a vulnerability in how the nested attributes feature in Active Record handles updates in combination with destroy flags when destroying records is disabled. This vulnerability has been assigned the CVE identifier CVE-2015-7577...

Ruby on Rails: DoS Attack in Controller Lookup Code

Object leak vulnerability for wildcard controller routes in Action Pack There is an object leak vulnerability for wildcard controllers in Action Pack. This vulnerability has been assigned the CVE identifier CVE-2015-7581. Versions Affected: = 4.0.0 and 5.0.0.beta1 Not affected: 4.0.0, 5.0.0.beta1...

Spree Commerce 'rabl_template.rb' Arbitrary File Read Vulnerability

Spree also known as Spree Commerce is the United States Spree Commerce, Inc. based on Ruby on Rails open source e-commerce solutions. An arbitrary file read vulnerability exists in Spree Commerce. An attacker can exploit this vulnerability to read arbitrary files in the context of an application...

Snorby 'view.html.erb' HTML Injection Vulnerability

Snorby is a set of Ruby on Rails based on the Ruby language open source web application framework for network security monitoring web applications . Snorby suffers from an HTML injection vulnerability that could be exploited by an attacker to cause the browser to execute arbitrary HTML or script...