Ruby on Rails Cross-Site Request Forgery Vulnerability (CNVD-2020-32423)

Ruby on Rails is a set of Rails team based on the Ruby language open source Web application framework. A cross-site request forgery vulnerability exists in Ruby on Rails versions prior to 5.2.5 and 6.0.4, which stems from a WEB application that does not adequately validate that a request is comin...

FreeBSD : Rails -- multiple vulnerabilities (85fca718-99f6-11ea-bf1d-08002728f74c)

Ruby on Rails blog : Hi everyone! Rails 5.2.4.3 and 6.0.3.1 have been released! These releases contain important security fixes, so please upgrade when you can. Both releases contain the following fixes : CVE-2020-8162: Circumvention of file size limits in ActiveStorage CVE-2020-8164: Possible...

Ruby on Rails Remote Code Execution Vulnerability (CNVD-2020-34451)

Ruby on Rails is a set of Rails team based on the Ruby language open source Web application framework. A security vulnerability exists in Ruby on Rails versions prior to 5.0.1. A remote attacker can exploit the vulnerability to execute code...

FreeBSD : Rails -- remote code execution vulnerability (ce6db19b-976e-11ea-93c4-08002728f74c)

Ruby on Rails blog : Due to an unfortunate oversight, Rails 4.2.11.2 has a missing constant error. To address this Rails 4.2.11.3 has been released. The original announcement for CVE-2020-8163 has a follow-up message with an updated patch if you're unable to use the gems. C Tenable Network...

Unnamed Vulnerability in GitLab (CNVD-2021-19415)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab versions 12.6...

Unnamed Vulnerability in GitLab

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab versions 10.8...

GitLab EE/CE Path Traversal Vulnerability

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A path traversal vulnerability exists in GitLab EE/CE,...

Security Bulletin: A vulnerability in Ruby on Rails affects IBM License Metric Tool v9 (CVE-2019-16782).

Summary There is a vulnerability in Ruby On Rails that is used by IBM License Metric Tool. Vulnerability Details CVEID: CVE-2019-16782 DESCRIPTION: Rack could allow a remote attacker to obtain sensitive information, caused by using the same session id for querying the backing session storage...

Security Bulletin: A vulnerability in Ruby on Rails affects IBM License Metric Tool v9 (CVE-2019-16779).

Summary There is a vulnerability in Ruby On Rails that is used by IBM License Metric Tool. Vulnerability Details CVEID: CVE-2019-16779 DESCRIPTION: RubyGem excon could allow a remote attacker to obtain sensitive information, caused by a race condition around persistent connections. By sending a...

GitLab Improper Authorization Vulnerability

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab Community and...

CVE-2020-5267

In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the j or escapejavascript methods may be susceptible to XSS attacks. The issue is fixed in versions 6.0.2.2 and 5.2.4.2...

The Insecurity of WordPress and Apache Struts

Interesting data: A study that analyzed all the vulnerability disclosures between 2010 and 2019 found that around 55% of all the security bugs that have been weaponized and exploited in the wild were for two major application frameworks, namely WordPress and Apache Struts. The Drupal content...

GitLab Denial of Service Vulnerability (CNVD-2020-17381)

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects. A security vulnerability exists in GitLab versions 12.2 through 12.8.1. An attacker can exploit thi...

GitLab Access Control Error Vulnerability (CNVD-2020-19600)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab versions 7.10...

Ruby on Rails Web Console IP Whitelist Bypass RCE Vulnerability

The Web Console tool as used in Ruby on Rails is prone to a remote code execution RCE vulnerability. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

GitLab Access Control Error Vulnerability (CNVD-2020-16706)

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects.GitLab EE is the GitLab Enterprise Edition and GitLab CE is the GitLab Community Edition. An access...

Important: Red Hat Security Advisory: CloudForms 4.7.15 security, bug fix and enhancement update

An update is now available for CloudForms Management Engine 5.10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...

Important: Red Hat Security Advisory: CloudForms 5.0.3 security update

An update is now available for CloudForms Management Engine 5.11. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...

Ruby on Rails: Missing resource identifier encoding may lead to security vulnerabilities

I initially submitted this to the GitHub repository because the ActiveResource repository is not listed in scope. I was redirected here by @rafaelfranca A number of methods in the ActiveResource library, such as ActiveResource::Basefind and ActiveResource::Baseexists? don't URL encode the resourc...

The vulnerability of the MyJob.perform_later function in the Ruby on Rails software platform allows a perpetrator to gain unauthorized access to confidential data.

The vulnerability of the MyJob.performlater function in the Ruby on Rails software platform relates to the restoration of unreliable data structures in memory. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to confidential data...