Unnamed Vulnerability in GitLab

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab versions 10.8...

GitLab EE/CE Path Traversal Vulnerability

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A path traversal vulnerability exists in GitLab EE/CE,...

Security Bulletin: A vulnerability in Ruby on Rails affects IBM License Metric Tool v9 (CVE-2019-16782).

Summary There is a vulnerability in Ruby On Rails that is used by IBM License Metric Tool. Vulnerability Details CVEID: CVE-2019-16782 DESCRIPTION: Rack could allow a remote attacker to obtain sensitive information, caused by using the same session id for querying the backing session storage...

Security Bulletin: A vulnerability in Ruby on Rails affects IBM License Metric Tool v9 (CVE-2019-16779).

Summary There is a vulnerability in Ruby On Rails that is used by IBM License Metric Tool. Vulnerability Details CVEID: CVE-2019-16779 DESCRIPTION: RubyGem excon could allow a remote attacker to obtain sensitive information, caused by a race condition around persistent connections. By sending a...

GitLab Improper Authorization Vulnerability

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab Community and...

CVE-2020-5267

In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the j or escapejavascript methods may be susceptible to XSS attacks. The issue is fixed in versions 6.0.2.2 and 5.2.4.2...

The Insecurity of WordPress and Apache Struts

Interesting data: A study that analyzed all the vulnerability disclosures between 2010 and 2019 found that around 55% of all the security bugs that have been weaponized and exploited in the wild were for two major application frameworks, namely WordPress and Apache Struts. The Drupal content...

GitLab Denial of Service Vulnerability (CNVD-2020-17381)

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects. A security vulnerability exists in GitLab versions 12.2 through 12.8.1. An attacker can exploit thi...

GitLab Access Control Error Vulnerability (CNVD-2020-19600)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab versions 7.10...

Ruby on Rails Web Console IP Whitelist Bypass RCE Vulnerability

The Web Console tool as used in Ruby on Rails is prone to a remote code execution RCE vulnerability. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

GitLab Access Control Error Vulnerability (CNVD-2020-16706)

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects.GitLab EE is the GitLab Enterprise Edition and GitLab CE is the GitLab Community Edition. An access...

Important: Red Hat Security Advisory: CloudForms 4.7.15 security, bug fix and enhancement update

An update is now available for CloudForms Management Engine 5.10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...

Important: Red Hat Security Advisory: CloudForms 5.0.3 security update

An update is now available for CloudForms Management Engine 5.11. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...

Ruby on Rails: Missing resource identifier encoding may lead to security vulnerabilities

I initially submitted this to the GitHub repository because the ActiveResource repository is not listed in scope. I was redirected here by @rafaelfranca A number of methods in the ActiveResource library, such as ActiveResource::Basefind and ActiveResource::Baseexists? don't URL encode the resourc...

MyJob perform later Unauthorized Access

The vulnerability of the MyJob.performlater function in the Ruby on Rails software platform relates to the restoration of unreliable data structures in memory. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to confidential data...

GitLab EE Denial of Service Vulnerability

GitLab is a Ruby on Rails developed, self-hosted, Git version control system project repository application from GitLab, Inc. The program can be used to access the project's file contents, commit history, bug list , etc. Git is a free, open source distributed version control system. A security...

Ruby on Rails: ActiveStorage direct upload fails to sign content-length header for S3 service

When a user makes a direct upload using ActiveStorage, the browser makes a request to the DirectUploadsController containing the directupload parameters filename, contenttype, bytesize, and checksum. These are used to generate a presigned url that is then passed back to the browser, allowing the...

Input validation

The papercrop gem before 0.3.0 for Ruby on Rails does not properly handle crop input...

CVE-2015-2784

The papercrop gem before 0.3.0 for Ruby on Rails does not properly handle crop input...

CVE-2015-2784

The CVE-2015-2784 entry concerns the papercrop gem for Ruby on Rails. Affected software is the papercrop gem before version 0.3.0; the root cause is improper handling of crop input. Impacted systems may face security issues due to unvalidated or mishandled crop data, with public sources indicatin...