MAL-2024-6384 Malicious code in actioncontroller-parameter-filter (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in actioncontroller-parameter-filter (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

GHSA-VC74-C4M6-9979 TYPO3 Flow Cross-site scripting (XSS) vulnerability

Cross-site scripting XSS vulnerability in the errorAction method in the ActionController base class in TYPO3 Flow formerly FLOW3 1.1.x before 1.1.1 and 2.0.x before 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified input, which is returned in an error message...

TYPO3 Flow Cross-site scripting (XSS) vulnerability

Cross-site scripting XSS vulnerability in the errorAction method in the ActionController base class in TYPO3 Flow formerly FLOW3 1.1.x before 1.1.1 and 2.0.x before 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified input, which is returned in an error message...

Duplicate Advisory: Authentication Bypass by CSRF Weakness

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-26xx-m4q2-xhq8. This link is maintained to preserve external references. Original Description Impact CSRF vulnerability that allows user account takeover. All applications using any version of the frontend...

Ruby on Rails: ActionController::Parameters .each returns an unsafe hash

Rails 5.1.4 The goal of ActionController::Parameters's permit method strong parameters is to prevent accidental trust in the parameters sent by the client. We can therefore not simply create a hash of all the parameters in the params without permitting them first. When we really want to do this...

Cross-site Request Forgery (CSRF)

railsadmin, and several other libraries, are vulnerable to cross-site request forgery CSRF attacks. Non-GET methods in the affect libraries are found to not validate CSRF tokens. It is possible for an attacker to gain access to a site's administrative endpoints that are exposed by the gem. The...

Ruby on Rails XML Processor YAML Deserialization Code Execution

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3...

[oss-security] [CVE-2014-0130] Directory Traversal Vulnerability With Certain Route Configurations

There is a vulnerability in the 'implicit render' functionality in Ruby on Rails. This vulnerability has been assigned the CVE identifier CVE-2014-0130. Versions Affected: All Supported Not affected: None Fixed Versions: 4.1.1, 4.0.5, 3.2.18 Impact ------ The implicit render functionality allows...

Cross site scripting

Cross-site scripting XSS vulnerability in the errorAction method in the ActionController base class in TYPO3 Flow formerly FLOW3 1.1.x before 1.1.1 and 2.0.x before 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified input, which is returned in an error message...

CVE-2013-7082

Cross-site scripting XSS vulnerability in the errorAction method in the ActionController base class in TYPO3 Flow formerly FLOW3 1.1.x before 1.1.1 and 2.0.x before 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified input, which is returned in an error message...

UBUNTU-CVE-2013-7082

Cross-site scripting XSS vulnerability in the errorAction method in the ActionController base class in TYPO3 Flow formerly FLOW3 1.1.x before 1.1.1 and 2.0.x before 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified input, which is returned in an error message...

CVE-2013-7082

Cross-site scripting XSS vulnerability in the errorAction method in the ActionController base class in TYPO3 Flow formerly FLOW3 1.1.x before 1.1.1 and 2.0.x before 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified input, which is returned in an error message...

TYPO3 Extbase ActionController类跨站脚本漏洞

TYPO3是一款基于PHP4/PHP5+MYsql的内容管理系统。 TYPO3 Extbase ActionController类中的errorAction方法不正确校验错误消息，允许远程攻击者利用漏洞构建恶意URI，诱使用户解析，当恶意数据被查看时可获取敏感信息或者劫持用户会话。 0 TYPO3 4.5.0 TYPO3 4.5.31 TYPO3 4.7.0 TYPO3 4.7.16 TYPO3 6.0.0 TYPO3 6.0.11 TYPO3 6.1.0 TYPO3 6.1.6 TYPO3 6.2 厂商补丁： TYPO3 ----- TYPO3 4.5.32, 4.7.17,...

Ruby on Rails JSON Processor YAML Deserialization Code Execution

Exploit for multiple platform in category remote exploits This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core...

Ruby on Rails - JSON Processor YAML Deserialization Code Execution (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'Ruby on Rails JSON Processor YAML...

Ruby On Rails XML Processor YAML Deserialization Code Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'Ruby on Rails XML Processor YAML...

Ruby on Rails http_authentication.rb Nil凭据绕过认证漏洞

BUGTRAQ ID: 35579 Ruby on Rails是一个新的Web应用程序框架，构建在Ruby语言之上。 Ruby on Rails的actionpack/lib/actioncontroller/httpauthentication.rb文件中的 validatedigestresponse函数在处理nil凭据时存在错误，如果没有找到用户返回的是nil，而正确的行为是返回 false。远程攻击者发送空的认证凭据就可以绕过HTTP认证获得非授权访问。 David Heinemeier Hansson Ruby on Rails 2.3.2 厂商补丁： David...