Oracle Linux 8 : pcs (ELSA-2023-3082)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-3082 advisory. 0.10.15-4.0.1.el88.1 - Replace HAM-logo.png with a generic one 0.10.15-4.el88.1 - Fix displaying differences between configuration checkpoints in pcs...

Rocky Linux 9 : pcs (RLSA-2023:2652)

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:2652 advisory. - It was discovered that an update for PCS package in RHBA-2023:2151 erratum released as part of Red Hat Enterprise Linux 9.2 failed to include the fix...

Cameleon CMS 2.7.4 - Persistent Stored XSS in Post Title Vulnerability

Exploit Title: Authenticated Persistent XSS in Cameleon CMS 2.7.4 Google Dork: intext:"Camaleon CMS is a free and open-source tool and a fexible content management system CMS based on Ruby on Rails" Exploit Author: Yasin Gergin Vendor Homepage: http://camaleon.tuzitio.com Software Link:...

AlmaLinux 8 : pcs (ALSA-2023:3082)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:3082 advisory. - A DoS vulnerability exists in Rack v3.0.4.2, v2.2.6.3, v2.1.4.3 and v2.0.9.3 within in the Multipart MIME parsing code in which could allow an attacker ...

Rocky Linux 8 : pcs (RLSA-2023:3082)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:3082 advisory. - A DoS vulnerability exists in Rack v3.0.4.2, v2.2.6.3, v2.1.4.3 and v2.0.9.3 within in the Multipart MIME parsing code in which could allow an attacke...

RHEL 9 : pcs (RHSA-2023:1981)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1981 advisory. The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fixes: rubygem-rack: Denial ...

Cross-site Scripting (XSS)

Overview pay is a package for processing payments in Ruby on Rails apps Affected versions of this package are vulnerable to Cross-site Scripting XSS via the back parameter on a Stripe payment page. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” ...

CVE-2023-30614

Pay is a payments engine for Ruby on Rails 6.0 and higher. In versions prior to 6.3.2 a payments info page of Pay is susceptible to reflected Cross-site scripting. An attacker could create a working URL that renders a javascript link to a user on a Rails application that integrates Pay. This URL...

Cross site scripting

Pay is a payments engine for Ruby on Rails 6.0 and higher. In versions prior to 6.3.2 a payments info page of Pay is susceptible to reflected Cross-site scripting. An attacker could create a working URL that renders a javascript link to a user on a Rails application that integrates Pay. This URL...

CVE-2023-30614 Improper Neutralization of Script-Related HTML Tags in a Web Page in pay

Pay is a payments engine for Ruby on Rails 6.0 and higher. In versions prior to 6.3.2 a payments info page of Pay is susceptible to reflected Cross-site scripting. An attacker could create a working URL that renders a javascript link to a user on a Rails application that integrates Pay. This URL...

CVE-2023-30614 Improper Neutralization of Script-Related HTML Tags in a Web Page in pay

Pay is a payments engine for Ruby on Rails 6.0 and higher. In versions prior to 6.3.2 a payments info page of Pay is susceptible to reflected Cross-site scripting. An attacker could create a working URL that renders a javascript link to a user on a Rails application that integrates Pay. This URL...

CVE-2023-30614 Improper Neutralization of Script-Related HTML Tags in a Web Page in pay

Pay is a payments engine for Ruby on Rails 6.0 and higher. In versions prior to 6.3.2 a payments info page of Pay is susceptible to reflected Cross-site scripting. An attacker could create a working URL that renders a javascript link to a user on a Rails application that integrates Pay. This URL...

CVE-2023-30614

CVE-2023-30614 affects the Pay payments engine for Ruby on Rails (versions

CVE-2023-30614

Pay is a payments engine for Ruby on Rails 6.0 and higher. In versions prior to 6.3.2 a payments info page of Pay is susceptible to reflected Cross-site scripting. An attacker could create a working URL that renders a javascript link to a user on a Rails application that integrates Pay. This URL...

CVE-2023-30614: Improper Neutralization of Input During Web Page Generation

Pay is a payments engine for Ruby on Rails 6.0 and higher. In versions prior to 6.3.2 a payments info page of Pay is susceptible to reflected Cross-site scripting. An attacker could create a working URL that renders a javascript link to a user on a Rails application that integrates Pay. This URL...

[SECURITY] Fedora 37 Update: rubygem-rails-7.0.4.3-1.fc37

Ruby on Rails is a full-stack web framework optimized for programmer happiness and sustainable productivity. It encourages beautiful code by favoring convention over configuration...

Internet Bug Bounty: ReDoS( Ruby, Time)

A ReDoS vulnerability was discovered in the Time gem 0.1.0 and 0.2.1 and Time library of Ruby 2.7.7, which mishandles invalid strings with specific characters, causing an increase in execution time for parsing strings to Time objects. The vulnerability was assigned the CVE identifier...

[SECURITY] Fedora 38 Update: rubygem-rails-7.0.4.3-1.fc38

Ruby on Rails is a full-stack web framework optimized for programmer happiness and sustainable productivity. It encourages beautiful code by favoring convention over configuration...

Malwarebytes: Rails Debug Mode Enabled On ( https://44.208.145.207/testrail/files.md5 )

Summary: A Ruby on Rails web application running in development mode was identified on a Malwarebytes server. The application exposed sensitive system information, including details about middleware components and application root paths, which should not be accessible in a production environment...

SUSE CVE-2006-4112

Unspecified vulnerability in the "dependency resolution mechanism" in Ruby on Rails 1.1.0 through 1.1.5 allows remote attackers to execute arbitrary Ruby code via a URL that is not properly handled in the routing code, which leads to a denial of service application hang or "data loss," a differen...