CVE-2024-51499

CVE-2024-51499 (MarkUs) : Affected software is MarkUs web app (Rails) versions before 2.4.8. The root cause is an arbitrary file write vulnerability exposed through the SubmissionsController.update_files method, allowing authenticated users (e.g., students) to write files to arbitrary server path...

PT-2024-34876

Name of the Vulnerable Software and Affected Versions MarkUs versions prior to 2.4.8 Description The issue is related to an arbitrary file write vulnerability in the update/upload/create file methods in Controllers, allowing authenticated instructors to write arbitrary files to any location on th...

CVE-2022-4890

A vulnerability, which was classified as critical, has been found in abhilash1985 PredictApp. This issue affects some unknown processing of the file config/initializers/newframeworkdefaults70.rb of the component Cookie Handler. The manipulation leads to deserialization. The attack may be initiate...

PT-2018-10212

Name of the Vulnerable Software and Affected Versions GamerPolls version 0.4.6 Description An issue was discovered related to the files config/environments/all.js and config/initializers/02 passport.js. An attacker can edit the Passport.js contents of the session cookie to contain the ID number o...

CVE-2018-10966: Use of Hard-coded Credentials

An issue was discovered in GamerPolls 0.4.6, related to config/environments/all.js and config/initializers/02passport.js. An attacker can edit the Passport.js contents of the session cookie to contain the ID number of the account they wish to take over, and re-sign it using the hard coded secret...

CVE-2013-7134: Undefined Security Weakness

Juvia uses the same secret key for all installations, which allows remote attackers to have unspecified impact by leveraging the secret key in app/config/initializers/secrettoken.rb, related to cookies...

CVE-2013-7222

config/initializers/secrettoken.rb in Fat Free CRM before 0.12.1 has a fixed FatFreeCRM::Application.config.secrettoken value, which makes it easier for remote attackers to spoof signed cookies by referring to the key in the source code...

PT-2014-3291

Name of the Vulnerable Software and Affected Versions Fat Free CRM versions prior to 0.12.1 Description The issue makes it easier for remote attackers to spoof signed cookies by referring to the key in the source code. This is due to a fixed FatFreeCRM::Application.config.secret token value in th...