2482 matches found
PT-2019-7243 · Ruby +1 · Ruby On Rails +2
Name of the Vulnerable Software and Affected Versions: OmniAuth Ruby gem versions 1.9.2 and earlier Description: The request phase of the OmniAuth Ruby gem is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework. This allows accounts to be connected without us...
Important: Red Hat Security Advisory: CloudForms 4.7.3 security, bug fix and enhancement update
An update is now available for CloudForms Management Engine 5.10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...
Action View Component File Disclosure
The vulnerability of the Action View component in the Ruby on Rails software framework is related to errors in handling HTTP headers “Accept” when used in the “render file” handler code. Exploiting this vulnerability allows an attacker to read arbitrary files...
Action View DoS
The vulnerability of the Action View component in the Ruby on Rails software framework is related to errors in processing HTTP headers like “Accept”. Exploiting this vulnerability can allow an attacker to cause service interruptions...
Mail.ru: [geekbrains.ru] CVE-2019-5418 Ruby on Rails File Content Disclosure
Unpatched CVE-2019-3396 in geekbrains.ru...
Exploit for Path Traversal in Rubyonrails Rails
README This README would normally document whatever steps are...
Ruby on Rails: File writing by Directory traversal at actionpack-page_caching and RCE by it
I found a directory traversal in actionpack-pagecaching. Some code may lead to RCE. https://github.com/rails/actionpack-pagecaching/blob/master/lib/actioncontroller/caching/pages.rbL143 ruby def cachefilepath, extension if path.empty? || path = %r\A/+\z name = "/index" else name =...
Mail.ru: Rails application running in development mode
autodiscover.staging.geekbrains.ru was running Ruby on Rails in development mode...
Ruby On Rails File Content Disclosure ('doubletap')
This module uses a path traversal vulnerability in Ruby on Rails versions = "Ruby On Rails File Content Disclosure 'doubletap'", 'Description' = %q This module uses a path traversal vulnerability in Ruby on Rails versions = 'Carter Brainerd ', Metasploit module 'John Hawthorn ' PoC/discovery ,...
Fat Free CRM Code Injection Vulnerability
Fat Free CRM is an open source Ruby on Rails based customer relationship management platform. The platform includes team collaboration , customer management , contact list , customer tracking and other modules . A code injection vulnerability exists in Fat Free CRM version 0.19.0. No detailed...
Immunity Canvas: RAILS_ACCEPT_READFILE
Name| railsacceptreadfile ---|--- CVE| CVE-2019-5418 Exploit Pack| CANVAS Description| Ruby on Rails Arbitrary File Read CVE-2019-5418 Notes| CVE Name: CVE-2019-5418 VENDOR: Rails NOTES: The vulnerability resides in Action View in combination with calls to 'render file:' in a controller. You need...
Immunity Canvas: RAILS_ACTIVESTORAGE_RCE
Name| railsactivestoragerce ---|--- CVE| CVE-2019-5420 Exploit Pack| CANVAS Description| Ruby on Rails Arbitrary Deserialization RCE CVE-2019-5420 Notes| CVE Name: CVE-2019-5420 VENDOR: Rails NOTES: The vulnerability resides in the ActionStorage component of Ruby on Rails due to insufficient...
Ruby on Rails DoubleTap Development Mode secret_key_base Vulnerability
Ruby on Rails versions including 5.2.2.1 and prior are vulnerable to a predicatble secretkeybase in development mode, which could be used to recreated a signed message, such as a serialized object, and gain remote code execution. Recent assessments: wchen-r7 at September 12, 2019 6:07pm UTC...
Ruby on Rails 5.2 "DoubleTap" Directory Traversal
Ruby on Rails 5.2.2 and prior are vulnerable to a directory traversal attack due to the way the HTTP ACCEPT header is parsed, which ends up being a template for Rails to render. Recent assessments: wchen-r7 at September 12, 2019 6:07pm UTC reported: Background Ruby on Rails is a server-side web...
Ruby on Rails Code Execution
The vulnerability of the Ruby on Rails software platform is related to errors in the code of the pseudo-random number generators. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
Exploit for Command Injection in Rubyonrails Rails
CVE-2019-5420 CVE-2019-5420 Ruby on Rails For educational p...
Rails 5.2.1 Arbitrary File Content Disclosure
''' Exploit Title: File Content Disclosure on Rails Date: CVE disclosed 3/16 today's date is 3/20 Exploit Author: NotoriousRebel Vendor Homepage: https://rubyonrails.org/ Software Link: https://github.com/rails/rails Version: Versions Affected: all Fixed Versions: 6.0.0.beta3, 5.2.2.1, 5.1.6.2,...
Rails 5.2.1 - Arbitrary File Content Disclosure
Rails 5.2.1 - Arbitrary File Content Disclosure ''' Exploit Title: File Content Disclosure on Rails Date: CVE disclosed 3/16 today's date is 3/20 Exploit Author: NotoriousRebel Vendor Homepage: https://rubyonrails.org/ Software Link: https://github.com/rails/rails Version: Versions Affected: all...
Rails 5.2.1 - Arbitrary File Content Disclosure
''' Exploit Title: File Content Disclosure on Rails Date: CVE disclosed 3/16 today's date is 3/20 Exploit Author: NotoriousRebel Vendor Homepage: https://rubyonrails.org/ Software Link: https://github.com/rails/rails Version: Versions Affected: all Fixed Versions: 6.0.0.beta3, 5.2.2.1, 5.1.6.2,...