Design/Logic Flaw

jqueryujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space...

UBUNTU-CVE-2015-1840

jqueryujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space...

DEBIAN-CVE-2015-1840

jqueryujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space...

CVE-2015-1840

CVE-2015-1840 describes a CSRF/XSS-style risk in Rails tooling: jquery_ujs.js and rails.js could cause a CSRF token to be transmitted to a different-domain server when a URL attribute contains a leading space. This bypasses the Same Origin Policy under supported Rails setups (Rails 3.x/4.x with j...

CVE-2015-1840

jqueryujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space...

PT-2015-5464

Name of the Vulnerable Software and Affected Versions jquery-rails versions 3.1.3 and earlier, jquery-rails versions 4.x prior to 4.0.4 jquery-ujs versions 1.0.4 and earlier Description The issue allows remote attackers to bypass the Same Origin Policy and trigger transmission of a CSRF token to ...

RHEL 6 : ipa (RHSA-2015:1462)

Updated ipa packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

RedHat Update for ipa RHSA-2015:1462-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

jquery-ui: XSS vulnerability in jQuery.ui.dialog title option

Cross-site scripting XSS vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option...

jquery-ui: XSS vulnerability in default content in Tooltip widget

Cross-site scripting XSS vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo...

openSUSE Security Update : rubygem-jquery-rails (openSUSE-2015-501)

rubygem-jquery-rails was updated to fix one security issue. This security issue was fixed : - CVE-2015-1840: CSRF Vulnerability in jquery-ujs and jquery-rails bsc934795. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

Python Network Recon Framework: ivre

IVRE Instrument de veille sur les réseaux extérieurs or DRUNK Dynamic Recon of UNKnown networks is a network recon framework, including two modules for passive recon one p0f -based and one Bro -based and one module for active recon mostly Nmap -based, with a bit of ZMap . External programs /...

Fedora Update for rubygem-jquery-rails FEDORA-2015-10258

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 21 Update: rubygem-jquery-rails-3.1.0-3.fc21

This gem provides jQuery and the jQuery-ujs driver for your Rails 3 application...

[SECURITY] Fedora 22 Update: rubygem-jquery-rails-3.1.0-3.fc22

This gem provides jQuery and the jQuery-ujs driver for your Rails 3 application...

Fedora 22 : rubygem-jquery-rails-3.1.0-3.fc22 (2015-10258)

Security fix for CVE-2015-1840 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C...

Fedora Update for rubygem-jquery-rails FEDORA-2015-10144

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 21 : rubygem-jquery-rails-3.1.0-3.fc21 (2015-10144)

Security fix for CVE-2015-1840 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C...

Ruby on Rails jquery-ujs and jquery-rails Security Bypass Vulnerabilities

Ruby on Rails is a set of open source Web application framework based on the Ruby language . jquery-ujs is one of the scripting support files ; jquery-rails is for Rails 4 + applications to provide jQuery and jQuery-ujs driven plug-ins . A security vulnerability exists in Ruby on Rails jquery-ujs...

Drupal jQuery Update Module Open Redirect Vulnerability

Drupal is an open source content management framework CMF written in the PHP language, which consists of a content management system CMS and PHP development framework Framework together. An open redirection vulnerability exists in the Drupal jQuery Update module version 7.x-2.x before 7.x-2.6,...