Taiwan GPS Satellite Positioning Passenger Web Design 1.0 SQL Injection

Exploit Title : Taiwan GPS Satellite Positioning Passenger Web Design 1.0 SQL Injection Author Discovered By : KingSkrupellos Date : 30/12/2018 Owner of the Script E-Mail : [email protected] Tested On : Windows Exploit Risk : Medium Version Information : 1.0 Vulnerability Type : CWE-89 Improper...

RHEL 6 : rubygem-passenger (RHSA-2013:1136)

Updated rubygem-passenger packages that fix two security issues are now available for Red Hat OpenShift Enterprise 1.2.2. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...

GHSA-QW8W-2XCP-XG59 Insecure use of temporary files in Phusion passenger

Phusion Passenger 4.0.37 allows local users to write to certain files and directories via a symlink attack on 1 controlprocess.pid or a 2 generation- file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1831...

Insecure use of temporary files in Phusion passenger

Phusion Passenger 4.0.37 allows local users to write to certain files and directories via a symlink attack on 1 controlprocess.pid or a 2 generation- file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1831...

GHSA-C7J7-P5JQ-26FF Insecure use of temporary files in passenger

Phusion Passenger before 4.0.38 allows local users to write to certain files and directories via a symlink attack on 1. controlprocess.pid or 2. a generation- file...

Insecure use of temporary files in passenger

Phusion Passenger before 4.0.38 allows local users to write to certain files and directories via a symlink attack on 1. controlprocess.pid or 2. a generation- file...

GHSA-FXWV-953P-7QPF Phusion Passenger allows remote attackers to spoof headers

agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to applications by using an underscore character instead of a -...

Phusion Passenger allows remote attackers to spoof headers

agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to applications by using an underscore character instead of a -...

Phusion Passenger uses a known /tmp filename

In Phusion Passenger before 5.1.0, a known /tmp filename was used during passenger-install-nginx-module execution, which could allow local attackers to gain the privileges of the passenger user...

GHSA-CQXW-3P7V-P9GR Phusion Passenger uses a known /tmp filename

In Phusion Passenger before 5.1.0, a known /tmp filename was used during passenger-install-nginx-module execution, which could allow local attackers to gain the privileges of the passenger user...

SUSE-SU-2018:2039-1 Security update for rubygem-passenger

This update for rubygem-passenger fixes the following issue: The following security vulnerability was addressed: - CVE-2018-12029: Fixed a file system access race condition in the chown command, which allowed for local privilege escalation and affects the Nginx module bsc1097663...

GLSA-201807-02 : Passenger: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201807-02 Passenger: Multiple Vulnerabilities Multiple vulnerabilities have been discovered in Passenger. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could escalate privileges, execut...

Passenger: Multiple Vulnerabilities

Background Passenger runs and manages your Ruby, Node.js, and Python apps. Description Multiple vulnerabilities have been discovered in Passenger. Please review the CVE identifiers referenced below for details. Impact A remote attacker could escalate privileges, execute arbitrary code, cause a...

Debian: Security Advisory (DLA-1399-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Phusion Passenger SpawningKit Access Control Error Vulnerability

Phusion Passenger is an Apache module from Phusion Netherlands for deploying Ruby on Rails projects on Apache and Nginx web servers.SpawningKit is one of the components. An access control error vulnerability exists in SpawningKit in versions 5.3.x prior to Phusion Passenger 5.3.2. An attacker cou...

Phusion Passenger SpawningKit Information Disclosure Vulnerability

Phusion Passenger is an Apache module from the Dutch company Phusion for deploying Ruby on Rails projects on Apache and Nginx web servers.SpawningKit is one of the components. A security vulnerability exists in SpawningKit in version 5.3.x of Phusion Passenger prior to 5.3.2. An attacker could...

Phusion Passenger nginx module elevation of privilege vulnerability

Phusion Passenger is an Apache module from the Dutch company Phusion for deploying Ruby on Rails projects on Apache and Nginx web servers. nginx module is one of the Nginx server modules. A security vulnerability in the nginx module in Phusion Passenger versions 5.3.2 through 3.x excluding versio...

Multiple Vulnerabilities in Phusion Passenger SpawningKit

Phusion Passenger is an Apache module from Phusion Netherlands for deploying Ruby on Rails projects on Apache and Nginx web servers.SpawningKit is one of the components. A security vulnerability exists in SpawningKit in version 5.3.x of Phusion Passenger prior to 5.3.2. An attacker can exploit th...

Debian DLA-1399-1 : ruby-passenger security update

Two flaws were discovered in ruby-passenger for Ruby Rails and Rack support that allowed attackers to spoof HTTP headers or exploit a race condition which made privilege escalation under certain conditions possible. CVE-2015-7519 Remote attackers could spoof headers passed to applications by usin...

[SECURITY] [DLA 1399-1] ruby-passenger security update

Package : ruby-passenger Version : 4.0.53-1+deb8u1 CVE ID : CVE-2015-7519 CVE-2018-12029 Debian Bug : 864651 Two flaws were discovered in ruby-passenger for Ruby Rails and Rack support that allowed attackers to spoof HTTP headers or exploit a race condition which made privilege escalation under...