Remote code execution

Arvados is an open source platform for managing, processing, and sharing genomic and other large scientific and biomedical data. A remote code execution RCE vulnerability in the Arvados Workbench allows authenticated attackers to execute arbitrary code via specially crafted JSON payloads. This...

CVE-2022-36006

CVE-2022-36006 affects Arvados Workbench (Ruby on Rails Workbench 1). The vulnerability allows an authenticated attacker to execute arbitrary code via specially crafted JSON payloads, affecting all Arvados versions up to 2.4.1 and fixed in 2.4.2. Affected component is the Workbench 1 app; Workben...

CVE-2022-36006 Authenticated remote code execution due to insecure deserialization (GHSL-2022-063)

Arvados is an open source platform for managing, processing, and sharing genomic and other large scientific and biomedical data. A remote code execution RCE vulnerability in the Arvados Workbench allows authenticated attackers to execute arbitrary code via specially crafted JSON payloads. This...

CVE-2022-36006 Authenticated remote code execution due to insecure deserialization (GHSL-2022-063)

Arvados is an open source platform for managing, processing, and sharing genomic and other large scientific and biomedical data. A remote code execution RCE vulnerability in the Arvados Workbench allows authenticated attackers to execute arbitrary code via specially crafted JSON payloads. This...

PT-2022-23105 · Unknown +1 · Ruby On Rails +1

Name of the Vulnerable Software and Affected Versions: Arvados versions prior to 2.4.2 Description: Arvados is an open source platform for managing, processing, and sharing genomic and other large scientific and biomedical data. A remote code execution vulnerability in the Arvados Workbench allow...

Activerecord update_by_case SQL注入漏洞

Activerecord updatebycase is a Ruby on Rails tool for updating many records with case values from a single database hit. A SQL injection vulnerability exists in Activerecord updatebycase prior to version 0.1.3, which stems from updatebycase using a customized sql string that is not cleaned up...

Remote Code Execution (RCE)

Overview activerecord is a library for databases on Rails. Affected versions of this package are vulnerable to Remote Code Execution RCE. When serialized columns that use YAML the default are deserialized, Rails uses YAML.unsafeload to convert the YAML data in to Ruby objects. If an attacker can...

The vulnerability of the actionpack plugin in the Ruby on Rails software platform allows attackers to execute XSS attacks.

The vulnerability of the actionpack plugin for the Ruby on Rails software platform exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

PT-2022-21161 · Ruby +4 · Ruby On Rails +4

Name of the Vulnerable Software and Affected Versions: Ruby on Rails versions prior to 7.0.3.1 Ruby on Rails versions prior to 6.1.6.1 Ruby on Rails versions prior to 6.0.5.1 Ruby on Rails versions prior to 5.2.8.1 Description: A possible escalation to remote code execution RCE exists when using...

Exploit for Command Injection in Rubyonrails Rails

PoC exploit for CVE-2019-5420, a Ruby deserialization vulnerabil...

CVE-2022-32209

A Cross-site scripting XSS vulnerability exists in ruby on rails. This issue could allow an attacker to inject content into the application, leading to loss of integrity and confidentiality...

CVE-2022-32209

Possible XSS Vulnerability in Rails::Html::SanitizerThere is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.This vulnerability has been assigned the CVE identifier CVE-2022-32209.Versions Affected: ALLNot affected: NONEFixed Versions: v1.4.3 ImpactA possible XS...

Malicious code in ruby-on-rails-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 34c450a4a909b2cff0881264fc0cacab1b54bdb89064e08b2c17d897a4cfc2dd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-M44R-GV6Q-9J9R papercrop does not properly handle crop input

The papercrop gem before 0.3.0 for Ruby on Rails does not properly handle crop input...

papercrop does not properly handle crop input

The papercrop gem before 0.3.0 for Ruby on Rails does not properly handle crop input...

GHSA-RX7J-MW4C-76G9 Authlogic Information Exposure vulnerability

The Authlogic gem for Ruby on Rails prior to version 3.3.0 makes potentially unsafe findbyid method calls, which might allow remote attackers to conduct CVE-2012-6496 SQL injection attacks via a crafted parameter in environments that have a known secrettoken value, as demonstrated by a value...

Authlogic Information Exposure vulnerability

The Authlogic gem for Ruby on Rails prior to version 3.3.0 makes potentially unsafe findbyid method calls, which might allow remote attackers to conduct CVE-2012-6496 SQL injection attacks via a crafted parameter in environments that have a known secrettoken value, as demonstrated by a value...

GHSA-F57C-HX33-HVH8 Active Record component in Ruby on Rails has a data-type injection vulnerability

The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attack...

Active Record component in Ruby on Rails has a data-type injection vulnerability

The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attack...

Ruby On Rails Directory Traversal (CVE-2016-0752)

A directory traversal vulnerability exists in Ruby on Rails. Successful exploitation of this vulnerability could allow an attacker to access arbitrary files on the affected system...