CVE-2016-4442

The rack-mini-profiler gem before 0.10.1 for Ruby allows remote attackers to obtain sensitive information about allocated strings and objects by leveraging incorrect ordering of security checks...

CVE-2016-4442

The CVE concerns the rack-mini-profiler gem for Ruby, specifically versions before 0.10.1. The underlying issue is an incorrect ordering of security checks that can allow remote attackers to obtain sensitive information about allocated strings and objects. This is confirmed in multiple connected ...

CVE-2017-6604

A vulnerability in the web interface of Cisco Integrated Management Controller IMC Software could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability affects the following Cisco products running Cisco IMC Software: Unified Computing System UCS...

Origin Null Vulnerability

rack-cors is vulnerable to an origin null vulnerability. When an iframe contains html code for its source instead of a URL, a website using rack-cors and allowing file:// does not prevent browsers to send null origins...

Open Redirection

rack-cas is susceptible to open redirection attacks. The vulnerability exists because it does not validate types of POST, PUT, DELETE requests and redirects, allowing an attacker to send a malicious URL link in the request to redirect...

Temporary Lenovo XClarity Administrator (LXCA) credentials may be exposed - Lenovo Support US

No description provided...

CVE-2016-8221

Privilege Escalation in Lenovo XClarity Administrator earlier than 1.2.0, if LXCA is used to manage rack switches or chassis with embedded input/output modules IOMs, certain log files viewable by authenticated users may contain passwords for internal administrative LXCA accounts with temporary...

Privilege escalation

Privilege Escalation in Lenovo XClarity Administrator earlier than 1.2.0, if LXCA is used to manage rack switches or chassis with embedded input/output modules IOMs, certain log files viewable by authenticated users may contain passwords for internal administrative LXCA accounts with temporary...

CVE-2016-8221

Privilege Escalation in Lenovo XClarity Administrator earlier than 1.2.0, if LXCA is used to manage rack switches or chassis with embedded input/output modules IOMs, certain log files viewable by authenticated users may contain passwords for internal administrative LXCA accounts with temporary...

CVE-2016-8221

CVE-2016-8221 relates to Lenovo XClarity Administrator (LXCA) prior to version 1.2.0. When LXCA manages rack switches or chassis with embedded I/O modules, some log files accessible to authenticated users may reveal passwords for internal administrative LXCA accounts that use temporary passwords ...

CVE-2016-8221

Privilege Escalation in Lenovo XClarity Administrator earlier than 1.2.0, if LXCA is used to manage rack switches or chassis with embedded input/output modules IOMs, certain log files viewable by authenticated users may contain passwords for internal administrative LXCA accounts with temporary...

Cross-Site Scripting (XSS)

rack-tracker is vulnerable to cross-site scripting XSS attack. The library is vulnerable to cross-site scripting because the library does not santise escape characters...

Xxe

XML external entity XXE vulnerability in the Hyper Management Module HMM in Huawei E9000 rack servers with software before V100R001C00SPC296 allows remote authenticated users to read arbitrary files or cause a denial of service web service outage via a crafted XML document...

CVE-2016-6898

CVE-2016-6898 affects Huawei E9000 rack servers’ Hyper Management Module (HMM). A XML External Entity (XXE) vulnerability exists in user-supplied XML documents, allowing remote authenticated users to read arbitrary files or cause a web service denial of service. Impact is described as partial con...

Ruby gem rack-mini-profiler Sensitive Information Access Vulnerability

Ruby gem rack-mini-profiler is an integrated client, database and server analysis toolkit for Ruby application development. A sensitive information acquisition vulnerability exists in Ruby gem rack-mini-profiler, which allows remote attackers to obtain sensitive strings and object information by...

Rack-Bug - Debugging Toolbar For Rack Applications Implemented As Middleware

Rack::Bug adds a diagnostics toolbar to Rack apps. When enabled, it injects a floating div allowing exploration of logging, database queries, template rendering times, etc. Features Password-based security IP-based security Rack::Bug instrumentation/reporting is broken up into panels. Panels in...

RubyGems rack-attack 'ActionDispatch' security bypass vulnerability

RubyGems is a Ruby package manager from the RubyGems organization that is used to distribute and manage Ruby packages. rack-attack is one of the middleware used to block abusive requests. A security vulnerability in RubyGems rack-attack allows remote attackers to bypass security restrictions and...

Emerson Network Power® MPH2™ Rack PDU 弱口令

参考链接: https://community.emerson.com/networkpower/support/avocent/power/mph2/m/mediagallery/3093...

Scientific Linux Security Update : pcs on SL7.x x86_64 (20151119)

A flaw was found in a way Rack processed parameters of incoming requests. An attacker could use this flaw to send a crafted request that would cause an application using Rack to crash. CVE-2015-3225 The pcs package has been upgraded to upstream version 0.9.143, which provides a number of bug fixe...

SUSE-SU-2015:2274-1 Security update for rubygem-rack

rubygem-rack was updated to fix one security issue. This security issue was fixed: - CVE-2015-3225: Crafted requests could have caused a SystemStackError leading to Denial of Service bsc934797...