Debian: Security Advisory (DSA-1638-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Gentoo Security Advisory GLSA 200510-05 (ruby)

The remote host is missing updates announced in advisory GLSA 200510-05. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Chilkat XML ActiveX Remote Arbitrary File Creation/Execution Exploit

No description provided by source. ----------------------------------------------------------------------------- Chilkat XML ActiveX Remote Arbitrary File Creation/Execution url: www.chilkatsoft.com File: ChilkatUtil.dll = 3.0.3.0 CLSID: 5022FAE8-B780-4B78-B8DC-1AF1145A4F42 ProgID:...

Code injection

A certain Debian patch for OpenSSH before 4.3p2-9etch3 on etch; before 4.6p1-1 on sid and lenny; and on other distributions such as SUSE uses functions that are not async-signal-safe in the signal handler for login timeouts, which allows remote attackers to cause a denial of service connection sl...

cpanel-lfi.txt

Fantastico In all Version Cpanel 11.x First Create directory Let the name /includes/ and upload Shell.php in /includes/ Then rename it to enclicensingservers.php :::xploit:::: http://xxx.com:2082/frontend/x/fantastico/includes/xml.php?fantasticopath=/home/user Discoverd By : joker1 for info :...

Cpanel <= 11.x (Fantastico) LFI Vulnerability (sec bypass)

Exploit for unknown platform in category web applications ========================================================== Cpanel First Create directory Let the name /includes/ and upload Shell.php in /includes/ Then rename it to enclicensingservers.php :::xploit::::...

FreeBSD Ports: ruby, ruby_static

The remote host is missing an update to the system as announced in the referenced advisory. VID 1daea60a-4719-11da-b5c6-0004614cc33d OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

FreeBSD : ruby -- multiple vulnerabilities in safe level (c329712a-6b5b-11dd-9d79-001fc61c2a55)

The official ruby site reports : Several vulnerabilities in safe level have been discovereds:. - untracevar is permitted at safe level 4; - $PROGRAMNAME may be modified at safe level 4; - insecure methods may be called at safe level 1-3; - syslog operations are permitted at safe level 4; - dl...

CVE-2008-3657

The dl module in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not check "taintness" of inputs, which allows context-dependent attackers to bypass safe levels and execute dangerous functions by accessing a library using DL.dlopen...

Design/Logic Flaw

The dl module in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not check "taintness" of inputs, which allows context-dependent attackers to bypass safe levels and execute dangerous functions by accessing a library using DL.dlopen...

CVE-2008-3657

CVE-2008-3657 is a confirmed issue in the Ruby DL module where inputs are not tainted, allowing context-dependent attackers to bypass safe levels and call dangerous functions via DL.dlopen. Affected are Ruby 1.8.5 and older, 1.8.6 up to -p286, 1.8.7 up to -p71, and 1.9 up to r18423. Connected adv...

CVE-2008-3655

CVE-2008-3655 affects Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423. It does not properly restrict access to critical variables and methods at various safe levels, allowing context‑dependent attackers to bypass access restrictions via (1) untrac...

CVE-2008-3655: Undefined Security Weakness

Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not properly restrict access to critical variables and methods at various safe levels, which allows context-dependent attackers to bypass intended access restrictions via 1 untracevar, 2...

CVE-2008-3657

The dl module in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not check "taintness" of inputs, which allows context-dependent attackers to bypass safe levels and execute dangerous functions by accessing a library using DL.dlopen...

Security fix for the ALT Linux 5 package ruby version 1.8.7-alt6

Aug. 12, 2008 Kirill A. Shutemov 1.8.7-alt6 - 1.8.7.72 + Multiple vulnerabilities + Several vulnerabilities in safe level + untracevar is permitted at safe level 4 + $PROGRAMNAME may be modified at safe level 4 + insecure methods may be called at safe level 1-3 + syslog operations are permitted a...

Ruby 1.9 - Safe Level Multiple Function Restriction Bypass

source: https://www.securityfocus.com/bid/30644/info Ruby is prone to multiple vulnerabilities that can be leveraged to bypass security restrictions or cause a denial of service: - Multiple security-bypass vulnerabilities occur because of errors in the 'safe level' restriction implementation...

ruby -- multiple vulnerabilities in safe level

The official ruby site reports: Several vulnerabilities in safe level have been discovereds:. untracevar is permitted at safe level 4; $PROGRAMNAME may be modified at safe level 4; insecure methods may be called at safe level 1-3; syslog operations are permitted at safe level 4; dl doesn't check...

Ruby missing "taintness" checks in dl module

The dl module in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not check "taintness" of inputs, which allows context-dependent attackers to bypass safe levels and execute dangerous functions by accessing a library using DL.dlopen...

Ruby multiple insufficient safe mode restrictions

Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not properly restrict access to critical variables and methods at various safe levels, which allows context-dependent attackers to bypass intended access restrictions via 1 untracevar, 2...

Preliminary validation of my thoughts--about 3 6 0 safe guard of self-protection-vulnerability warning-the black bar safety net

About 3 6 0 security guards（3 6 0 safe of self-preservation, I see a lot of advertising, but have not been to research. Today was evacuated carefully looked at because it is doubts it. The program in the kernel just hung up two Hook（KiSystemService, the KeUserModeCallback, then how is it possible...