OOME from EAP 6 http management console

It was discovered that sending requests containing large headers to the Web Console produced a Java OutOfMemoryError in the HTTP management interface. An attacker could use this flaw to cause a denial of service...

EAP: CSRF vulnerability in EAP & WildFly Web Console

It was discovered that when uploading a file using a multipart/form-data submission to the EAP Web Console, the Console was vulnerable to Cross-Site Request Forgery CSRF. This meant that an attacker could use the flaw together with a forgery attack to make changes to an authenticated instance...

EAP: CSRF vulnerability in EAP & WildFly Web Console

It was discovered that when uploading a file using a multipart/form-data submission to the EAP Web Console, the Console was vulnerable to Cross-Site Request Forgery CSRF. This meant that an attacker could use the flaw together with a forgery attack to make changes to an authenticated instance...

用友某二级域名未授权访问导致命令执行

简要描述： 未授权访问 详细说明： JBOOS的配置的web-console未设置权限访问 导致命令执行漏洞 漏洞证明： http://shenpi.yonyou.com/web-console/...

CVE-2015-3224

request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelistedips protection mechanism via a crafted request...

CVE-2015-3224

CVE-2015-3224 affects Ruby on Rails Web Console (Web Console) prior to 2.1.3 when used with Rails 3.x/4.x. The root cause is improper restriction of X-Forwarded-For headers, allowing remote bypass of the whitelisted_ips protection via a crafted request. Exploitation is demonstrated in public advi...

CVE-2015-3224

request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelistedips protection mechanism via a crafted request...

PT-2015-6103

Name of the Vulnerable Software and Affected Versions Web Console versions prior to 2.1.3 Ruby on Rails versions 3.x and 4.x Description The issue allows remote attackers to bypass the whitelisted ips protection mechanism via a crafted request. This is due to the improper restriction of...

Unspecified Vulnerability in Oracle Virtualization Sun Ray Software Component

Oracle Virtualization Sun Ray Software is a suite of software from Oracle that provides a rich virtual desktop experience for Sun Ray clients, PCs and portables. A security vulnerability exists in the Web Console subcomponent of the Sun Ray Software component of Oracle Virtualization versions pri...

Trend Micro Threat Intelligence Manager Web Console Detection

Binary data trendmicrotimdetect.nbin...

CVE-2015-4727

Unspecified vulnerability in Oracle Virtualization Sun Ray Software before 5.4.4 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Web Console...

Buffer overflow

Unspecified vulnerability in Oracle Virtualization Sun Ray Software before 5.4.4 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Web Console...

CVE-2015-4727

Unspecified vulnerability in Oracle Virtualization Sun Ray Software before 5.4.4 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Web Console...

CVE-2015-4727

CVE-2015-4727 affects Oracle Virtualization Sun Ray Software Web Console. The CNVD entry specifies an unspecified vulnerability in Sun Ray Software Web Console prior to version 5.4.4, allowing a remote attacker to read, update, insert, or delete data and potentially cause a denial of service. Aff...

Fedora Update for rubygem-web-console FEDORA-2015-10128

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 22 : rubygem-web-console-2.1.3-1.fc22 (2015-10128)

Security fix for CVE-2015-3224. Please note that since the security fix was not really backportable, I opted in for rebase. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and...

Web Console Remote Code Execution Vulnerability

Web Console is a set of Web-based applications for executing shell commands on a server. A security vulnerability exists in Web Console that could be exploited by a remote attacker to submit a special request to execute arbitrary code...

FreeBSD : rubygem-rails -- multiple vulnerabilities (eb8a8978-8dd5-49ce-87f4-49667b2166dd)

Ruby on Rails blog : Rails 3.2.22, 4.1.11 and 4.2.2 have been released, along with web console and jquery-rails plugins and Rack 1.5.4 and 1.6.2. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML...

Ruby on Rails Web Console (v2) Whitelist Bypass Code Execution

This module exploits an IP whitelist bypass vulnerability in the developer web console included with Ruby on Rails 4.0.x and 4.1.x. This module will also achieve code execution on Rails 4.2.x if the attack is launched from a whitelisted IP range. Module Options msf use...

IP whitelist bypass in Web Console

Specially crafted remote requests can spoof their origin, bypassing the IP whitelist, in any environment where Web Console is enabled development and test, by default. Users whose application is only accessible from localhost as is the default behaviour in Rails 4.2 are not affected, unless a loc...