CVE-2017-12187

xorg-x11-server before 1.19.5 was missing length validation in RENDER extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code...

CVE-2017-12187

CVE-2017-12187 affects xorg-x11-server before 1.19.5, where the RENDER extension lacked proper length validation. This weakness can allow a malicious X client to crash the X server or potentially execute arbitrary code. The issue is documented across multiple sources (NVD entry for CVE-2017-12187...

CVE-2017-17868

In Liferay Portal 6.1.0, the tags section has XSS via a Public Render Parameter prp value, as demonstrated by prp564233524tag...

CVE-2017-17868

In Liferay Portal 6.1.0, the tags section has XSS via a Public Render Parameter prp value, as demonstrated by prp564233524tag...

Design/Logic Flaw

In Liferay Portal 6.1.0, the tags section has XSS via a Public Render Parameter prp value, as demonstrated by prp564233524tag...

CVE-2017-17868

In Liferay Portal 6.1.0, the tags section has XSS via a Public Render Parameter prp value, as demonstrated by prp564233524tag...

Liferay Porta tags section cross-site scripting vulnerability

Liferay Portal is a J2EE-based portal solution from Liferay, Inc. The solution uses EJB as well as JMS and other technologies , and can be used as a Web publishing and sharing workspaces , enterprise collaboration platforms , social networks and so on. A cross-site scripting vulnerability exists ...

CVE-2017-17868

In Liferay Portal 6.1.0, the tags section is vulnerable to cross-site scripting via a Public Render Parameter (p_r_p) value (example: p_r_p_564233524_tag). This is caused by improper sanitization of the p_r_p parameter, allowing arbitrary script to be injected through the parameter. The vulnerabi...

CVE-2017-17868

In Liferay Portal 6.1.0, the tags section has XSS via a Public Render Parameter prp value, as demonstrated by prp564233524tag...

DEBIAN-CVE-2017-1000188

nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile resulting in code injection...

nodejs ejs cross-site scripting vulnerability

nodejs ejs is an embedded JavaScript template with flow control, customizable delimiters and escaped output. A cross-site scripting vulnerability exists in the 'ejs.renderFile' function in versions of nodejs ejs prior to 2.5.5. A remote attacker can exploit the vulnerability to inject code...

nodejs ejs remote code execution vulnerability

nodejs ejs is an embedded JavaScript template with flow control, customizable delimiters and escaped output. A remote code execution vulnerability exists in the 'ejs.renderFile' function in versions of nodejs ejs prior to 2.5.3, which stems from weak input validation. A remote attacker could...

CVE-2017-12187

xorg-x11-server before 1.19.5 was missing length validation in RENDER extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code...

GHSA-RPRJ-G6XC-P5GQ Wicked gem contains Path traversal vulnerability

The Wicked gem prior to v1.0.1 allows a remote attacker to traverse directories on the system via a vulnerability in controller/concerns/renderredirect.rb. An attacker can send a specially-crafted URL request containing %2E%2E%2F directory traversal sequences to read arbitrary files on the system...

actionpack Path Traversal vulnerability

Directory traversal vulnerability in actionpack/lib/abstractcontroller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files...

actionview contains Path Traversal vulnerability

There is a possible directory traversal and information leak vulnerability in Action View. This was meant to be fixed on CVE-2016-0752. However the 3.2 patch was not covering all possible scenarios. This vulnerability has been assigned the CVE identifier CVE-2016-2097. Versions Affected: 3.2.x,...

GHSA-78RC-8C29-P45G actionpack allows remote code execution via application's unrestricted use of render method

Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method...

Directory traversal vulnerability in Action View in Ruby on Rails

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing...

actionpack allows remote code execution via application's unrestricted use of render method

Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method...

GHSA-XRR4-P6FQ-HJG7 Directory traversal vulnerability in Action View in Ruby on Rails

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing...