2482 matches found
PT-2020-7823
Name of the Vulnerable Software and Affected Versions: papercrop gem versions prior to 0.3.0 Description: The issue arises from improper handling of crop input in the papercrop gem for Ruby on Rails. Recommendations: For versions prior to 0.3.0, update to version 0.3.0 or later to resolve the iss...
CVE-2015-2784: Improper Input Validation
The papercrop gem before 0.3.0 for Ruby on Rails does not properly handle crop input...
GitLab Information Disclosure Vulnerability (CNVD-2020-01232)
GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An information disclosure vulnerability exists in GitLab,...
Security Bulletin: Vulnerabilities in Ruby on Rails affect IBM License Metric Tool v9.
Summary Vulnerabilities discovered in Ruby on Rails component affect IBM License Metric Tool v9. Vulnerability Details CVEID: CVE-2019-15587 DESCRIPTION: In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished. CVSS...
VulnCheck KEV: CVE-2016-0752
Directory traversal vulnerability in Action View in Ruby on Rails allows remote attackers to read arbitrary files...
Moderate: Red Hat Security Advisory: CloudForms 5.0.1 security, bug fix and enhancement update
An update is now available for CloudForms Management Engine 5.11. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...
Moderate: Red Hat Bug Fix Advisory: CloudForms 5.0 bug fix and enhancement update
An update is now available for CloudForms Management Engine 5.11. Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a model-view-controller M...
Ruby on Rails: Prevent XSS when passing a parameter directly into link_to
Note: I would say this is perhaps more of a feature request than an actual vulnerability, but Rafael França deleted this from GitHub and asked to submit it here instead In a rails views it's easy to accidentally create an XSS vulnerability by using the following in a template: Doing this exposes...
GitLab Resource Management Error Vulnerability (CNVD-2019-44228)
GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A resource management error vulnerability exists in GitLa...
Exploit for Path Traversal in Rubyonrails Rails
CVE-2019-5418 Another sca...
vulhub
It is an offensive tool for web application security training. The tool is a collection of pre-built vulnerable docker environments, Vulhub, which can be used to test and train web application security skills. The tool is designed to be easy to use, with a simple installation process and a...
CVE-2010-3299
The encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks...
CVE-2010-3299
The encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks...
DEBIAN-CVE-2010-3299
The encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks...
CVE-2010-3299
The encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks...
Buffer overflow
The encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks...
CVE-2010-3299
CVE-2010-3299 : The initial description indicates a padding oracle vulnerability in the encrypt/decrypt functions of Ruby on Rails 2.3. Connected documentation confirms this CVE and reiterates the padding oracle issue but does not provide specifics on affected versions beyond Rails 2.3, nor detai...
CVE-2010-3299
The encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks...
