The vulnerability of the nginx web server module in Phusion Passenger, related to the simultaneous use of shared resources and synchronization errors, allows attackers to gain access to confidential data.

The vulnerability of the nginx web server module in Phusion Passenger is related to the simultaneous use of a shared resource and synchronization errors when the passengerinstanceregistrydir configuration is not set strictly enough. Exploiting this vulnerability can allow an attacker to gain acce...

Debian DSA-4415-1 : passenger - security update

An arbitrary file read vulnerability was discovered in passenger, a web application server. A local user allowed to deploy an application to passenger, can take advantage of this flaw by creating a symlink from the REVISION file to an arbitrary file on the system and have its content displayed...

[SECURITY] [DSA 4415-1] passenger security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4415-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso March 24, 2019 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4415-1] passenger security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4415-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso March 24, 2019 https://www.debian.org/security/faq -...

DSA-4415-1 passenger - security update

Bulletin has no description...

Debian: Security Advisory (DSA-4415-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Flaw in Multiple Airline Systems Exposes Passenger Data

Researchers have discovered that multiple airline e-ticketing systems do not encrypt check-in links. The security faux pas could allow bad actors on the same network as the victim to view – and in some cases even change – their flight booking details or boarding passes. Security researchers at...

Flight Booking System Flaw Affected Customers of 141 Airlines Worldwide

Almost half of the fight travelers around the world were found exposed to a critical security vulnerability discovered in online flight ticket booking system that allowed remote hackers to access and modify their travel details and even claim their frequent flyer miles. Israeli network security...

Denial Of Service (DoS) Or Escalation Of Privileges

Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service prevent application start or gain privileges by pre-creating a temporary config file in a directory with a predictable name in /tmp/ before it is used by the gem...

Taiwan GPS Satellite Positioning Passenger Web Design 1.0 SQL Injection

Exploit Title : Taiwan GPS Satellite Positioning Passenger Web Design 1.0 SQL Injection Author Discovered By : KingSkrupellos Date : 30/12/2018 Owner of the Script E-Mail : [email protected] Tested On : Windows Exploit Risk : Medium Version Information : 1.0 Vulnerability Type : CWE-89 Improper...

RHEL 6 : rubygem-passenger (RHSA-2013:1136)

Updated rubygem-passenger packages that fix two security issues are now available for Red Hat OpenShift Enterprise 1.2.2. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...

Insecure use of temporary files in Phusion passenger

Phusion Passenger 4.0.37 allows local users to write to certain files and directories via a symlink attack on 1 controlprocess.pid or a 2 generation- file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1831...

GHSA-QW8W-2XCP-XG59 Insecure use of temporary files in Phusion passenger

Phusion Passenger 4.0.37 allows local users to write to certain files and directories via a symlink attack on 1 controlprocess.pid or a 2 generation- file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1831...

Insecure use of temporary files in passenger

Phusion Passenger before 4.0.38 allows local users to write to certain files and directories via a symlink attack on 1. controlprocess.pid or 2. a generation- file...

GHSA-C7J7-P5JQ-26FF Insecure use of temporary files in passenger

Phusion Passenger before 4.0.38 allows local users to write to certain files and directories via a symlink attack on 1. controlprocess.pid or 2. a generation- file...

Phusion Passenger allows remote attackers to spoof headers

agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to applications by using an underscore character instead of a -...

GHSA-FXWV-953P-7QPF Phusion Passenger allows remote attackers to spoof headers

agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to applications by using an underscore character instead of a -...

Phusion Passenger uses a known /tmp filename

In Phusion Passenger before 5.1.0, a known /tmp filename was used during passenger-install-nginx-module execution, which could allow local attackers to gain the privileges of the passenger user...

GHSA-CQXW-3P7V-P9GR Phusion Passenger uses a known /tmp filename

In Phusion Passenger before 5.1.0, a known /tmp filename was used during passenger-install-nginx-module execution, which could allow local attackers to gain the privileges of the passenger user...

SUSE-SU-2018:2039-1 Security update for rubygem-passenger

This update for rubygem-passenger fixes the following issue: The following security vulnerability was addressed: - CVE-2018-12029: Fixed a file system access race condition in the chown command, which allowed for local privilege escalation and affects the Nginx module bsc1097663...