FreeBSD : ruby -- UTF-7 encoding XSS vulnerability in WEBrick (34e0316a-aa91-11df-8c2e-001517289bf8)

The official ruby site reports : WEBrick have had a cross-site scripting vulnerability that allows an attacker to inject arbitrary script or HTML via a crafted URI. This does not affect user agents that strictly implement HTTP/1.1, however, some user agents do not. %NASLMINLEVEL 70300 C Tenable...

ruby -- UTF-7 encoding XSS vulnerability in WEBrick

The official ruby site reports: WEBrick have had a cross-site scripting vulnerability that allows an attacker to inject arbitrary script or HTML via a crafted URI. This does not affect user agents that strictly implement HTTP/1.1, however, some user agents do not...

Fedora 12 : ruby-1.8.6.383-6.fc12 (2010-0530)

A security vulnerability is found on WEBrick module in Ruby currently shipped on Fedora 12 that WEBrick lets attackers to inject malicious escape sequences to its logs, making it possible for dangerous control characters to be executed on a victim's terminal emulator. This issue has now been tagg...

Fedora 11 : ruby-1.8.6.383-6.fc11 (2010-0533)

A security vulnerability is found on WEBrick module in Ruby currently shipped on Fedora 11 that WEBrick lets attackers to inject malicious escape sequences to its logs, making it possible for dangerous control characters to be executed on a victim's terminal emulator. This issue has now been tagg...

CVE-2010-0541

Cross-site scripting XSS vulnerability in the WEBrick HTTP server in Ruby in Apple Mac OS X 10.5.8, and 10.6 before 10.6.4, allows remote attackers to inject arbitrary web script or HTML via a crafted URI that triggers a UTF-7 error page...

Cross site scripting

Cross-site scripting XSS vulnerability in the WEBrick HTTP server in Ruby in Apple Mac OS X 10.5.8, and 10.6 before 10.6.4, allows remote attackers to inject arbitrary web script or HTML via a crafted URI that triggers a UTF-7 error page...

CVE-2010-0541

CVE-2010-0541 : A cross-site scripting (XSS) vulnerability in the WEBrick HTTP server of Ruby on Apple Mac OS X 10.5.8 and 10.6 before 10.6.4 allows remote attackers to inject arbitrary script/HTML via a crafted URI that triggers a UTF-7 error page. The connected documents confirm the existence a...

CVE-2010-0541

Cross-site scripting XSS vulnerability in the WEBrick HTTP server in Ruby in Apple Mac OS X 10.5.8, and 10.6 before 10.6.4, allows remote attackers to inject arbitrary web script or HTML via a crafted URI that triggers a UTF-7 error page...

CVE-2010-0541

Cross-site scripting XSS vulnerability in the WEBrick HTTP server in Ruby in Apple Mac OS X 10.5.8, and 10.6 before 10.6.4, allows remote attackers to inject arbitrary web script or HTML via a crafted URI that triggers a UTF-7 error page...

CVE-2010-0541 Ruby WEBrick javascript injection flaw

Cross-site scripting XSS vulnerability in the WEBrick HTTP server in Ruby in Apple Mac OS X 10.5.8, and 10.6 before 10.6.4, allows remote attackers to inject arbitrary web script or HTML via a crafted URI that triggers a UTF-7 error page...

GLSA-201001-09 : Ruby: Terminal Control Character Injection

The remote host is affected by the vulnerability described in GLSA-201001-09 Ruby: Terminal Control Character Injection Giovanni Pellerano, Alessandro Tanasi and Francesco Ongaro reported that WEBrick does not filter terminal control characters, for instance when handling HTTP logs. Impact : A...

Mandriva Update for ruby MDVSA-2010:017 (ruby)

Check for the Version of ruby OpenVAS Vulnerability Test Mandriva Update for ruby MDVSA-2010:017 ruby Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the ter...

Gentoo Security Advisory GLSA 201001-09 (ruby)

The remote host is missing updates announced in advisory GLSA 201001-09. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2010 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Mandriva Linux Security Advisory : ruby (MDVSA-2010:017)

A vulnerability has been found and corrected in ruby : WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel 248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev writes data to a log file without sanitizing non-printable characters, which might allow remote attackers t...

Ruby: Terminal Control Character Injection

Background Ruby is an interpreted scripting language for quick and easy object-oriented programming. It comes bundled with a HTTP server "WEBrick". Description Giovanni Pellerano, Alessandro Tanasi and Francesco Ongaro reported that WEBrick does not filter terminal control characters, for instanc...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation. WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel 248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev writes data to a log file without sanitizing non-printable characters, whi...

Design/Logic Flaw

WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel 248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrar...

CVE-2009-4492

CVE-2009-4492 affects WEBrick in Ruby: WEBrick 1.3.1 on Ruby 1.8.6–patchlevel 383, 1.8.7–patchlevel 248, 1.8.8dev, 1.9.1–patchlevel 376, and 1.9.2dev logs non‑printable characters and may allow a remote attacker to modify a window title or possibly execute commands/overwrite files via an HTTP esc...

CVE-2009-4492

WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel 248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrar...

CVE-2009-4492

WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel 248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrar...