Camaleon CMS affected by arbitrary file write to RCE (GHSL-2024-182)

An arbitrary file write vulnerability accessible via the upload method of the MediaController allows authenticated users to write arbitrary files to any location on the web server Camaleon CMS is running on depending on the permissions of the underlying filesystem. E.g. This can lead to a delayed...

PT-2024-40451 · Unknown · Camaleon Cms

Name of the Vulnerable Software and Affected Versions: Camaleon CMS affected versions not specified Description: A stored cross-site scripting issue has been found in the image upload functionality of Camaleon CMS. This allows normal registered users to upload SVG images or HTML documents...

CamaleonCMS 注入漏洞

CamaleonCMS is an advanced RubyonRails-based dynamic content management system CMS from the CamaleonCMS team. An injection vulnerability exists in CamaleonCMS version 2.8.0, which stems from the presence of an arbitrary file write vulnerability that allows an authenticated user to write arbitrary...

Decidim 跨站脚本漏洞

Decidim is an open source participatory democracy framework from Decidim, written in Ruby on Rails. A cross-site scripting vulnerability exists in Decidim version 0.27.6 and earlier versions, which stems from a possible cross-site scripting attack on QuillJS, the WYSIWYG editor used...

RHSA-2013:0153 Red Hat Security Advisory: Ruby on Rails security update

Bulletin has no description...

RHSA-2016:0454 Red Hat Security Advisory: ror40 security update

Bulletin has no description...

RHSA-2014:1102 Red Hat Security Advisory: ror40-rubygem-activerecord security update

Bulletin has no description...

Fedora: Security Advisory (FEDORA-2023-28962dd58a)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the Active Storage component in the Ruby on Rails software framework allows unauthorized individuals to access confidential information. This vulnerability enables attackers to obtain sensitive data.

The vulnerability of the Active Storage component in the Ruby on Rails programming framework relates to the sending of Set-Cookie headers along with user session cookies when handling large binary objects. Exploiting this vulnerability can allow attackers to obtain confidential information...

The vulnerability of the `actionpack/lib/action_dispatch/middleware/templates/routes/_table.html.erb` Ruby interpreter allows a hacker to execute cross-site scripting.

The vulnerability of the actionpack/lib/actiondispatch/middleware/templates/routes/table.html.erb Ruby interpreter is related to incorrect handling of input data during web page generation. Exploiting this vulnerability could allow a local attacker to execute cross-site scripting attacks...

The vulnerability of the Ruby on Rails software platform lies in the improper handling of input data during web page generation, which allows attackers to perform cross-site scripting attacks.

The vulnerability of the Ruby on Rails software platform is related to improper handling of input data during the generation of web pages. Exploiting this vulnerability allows an attacker to perform cross-site scripting attacks...

Ruby On Rails JSON Processor YAML Deserialization Scanner

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Ruby on Rails JSON Processor YAML Deserialization Scanner', 'Description' = %q This module attempts to identify Ruby on Rails instances vulnerabl...

Ruby On Rails XML Processor YAML Deserialization Scanner

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Ruby on Rails XML Processor YAML Deserialization Scanner', 'Description' = %q This module attempts to identify Ruby on Rails instances vulnerable...

Ruby on Rails Action View MIME Memory Exhaustion

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Ruby on Rails Action View MIME Memory Exhaustion', 'Description' = %q This module exploits a Denial of Service DoS condition in Action View that...

Ruby on Rails JSON Processor Floating Point Heap Overflow Denial of Service

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Ruby on Rails JSON Processor Floating Point Heap Overflow DoS', 'Description' = %q When Ruby attempts to convert a string representation of a lar...

Ruby On Rails Devise Authentication Password Reset

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rexml/element' class MetasploitModule 'Ruby on Rails Devise Authentication Password Reset', 'Description' = %q The Devise authentication gem for Ruby on Rails i...

Ruby On Rails File Content Disclosure

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Ruby On Rails File Content Disclosure 'doubletap'", 'Description' = %q This module uses a path traversal vulnerability in Ruby on Rails versions ...

ROS-20240823-02

A vulnerability in the Host Authorization Middleware Action Pack component of the Ruby on Rails software platform is related to the creation of "X-Forwarded-Host" headers in combination with certain "authorized host" formats. host." Exploitation of the vulnerability could allow an attacker acting...

Ruby on Rails: Remote Code Execution

Background Ruby on Rails is a free web framework used to develop database-driven web applications. Description Multiple vulnerabilities have been discovered in Ruby on Rails. Please review the CVE identifiers referenced below for details. Impact When serialized columns that use YAML the default a...

GLSA-202408-24 : Ruby on Rails: Remote Code Execution

The remote host is affected by the vulnerability described in GLSA-202408-24 Ruby on Rails: Remote Code Execution Multiple vulnerabilities have been discovered in Ruby on Rails. Please review the CVE identifiers referenced below for details. Tenable has extracted the preceding description block...