2173 matches found
GitLab EE Denial of Service Vulnerability
GitLab is a Ruby on Rails developed, self-hosted, Git version control system project repository application from GitLab, Inc. The program can be used to access the project's file contents, commit history, bug list , etc. Git is a free, open source distributed version control system. A security...
Ruby on Rails: ActiveStorage direct upload fails to sign content-length header for S3 service
When a user makes a direct upload using ActiveStorage, the browser makes a request to the DirectUploadsController containing the directupload parameters filename, contenttype, bytesize, and checksum. These are used to generate a presigned url that is then passed back to the browser, allowing the...
Input validation
The papercrop gem before 0.3.0 for Ruby on Rails does not properly handle crop input...
CVE-2015-2784
The CVE-2015-2784 entry concerns the papercrop gem for Ruby on Rails. Affected software is the papercrop gem before version 0.3.0; the root cause is improper handling of crop input. Impacted systems may face security issues due to unvalidated or mishandled crop data, with public sources indicatin...
GitLab Information Disclosure Vulnerability (CNVD-2020-01232)
GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An information disclosure vulnerability exists in GitLab,...
Security Bulletin: Vulnerabilities in Ruby on Rails affect IBM License Metric Tool v9.
Summary Vulnerabilities discovered in Ruby on Rails component affect IBM License Metric Tool v9. Vulnerability Details CVEID: CVE-2019-15587 DESCRIPTION: In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished. CVSS...
VulnCheck KEV: CVE-2016-0752
Directory traversal vulnerability in Action View in Ruby on Rails allows remote attackers to read arbitrary files...
Moderate: Red Hat Security Advisory: CloudForms 5.0.1 security, bug fix and enhancement update
An update is now available for CloudForms Management Engine 5.11. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...
Moderate: Red Hat Bug Fix Advisory: CloudForms 5.0 bug fix and enhancement update
An update is now available for CloudForms Management Engine 5.11. Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a model-view-controller M...
Ruby on Rails: Prevent XSS when passing a parameter directly into link_to
Note: I would say this is perhaps more of a feature request than an actual vulnerability, but Rafael França deleted this from GitHub and asked to submit it here instead In a rails views it's easy to accidentally create an XSS vulnerability by using the following in a template: Doing this exposes...
GitLab Resource Management Error Vulnerability (CNVD-2019-44228)
GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A resource management error vulnerability exists in GitLa...
Exploit for Path Traversal in Rubyonrails Rails
CVE-2019-5418 Another sca...
vulhub
It is an offensive tool for web application security training. The tool is a collection of pre-built vulnerable docker environments, Vulhub, which can be used to test and train web application security skills. The tool is designed to be easy to use, with a simple installation process and a...
CVE-2010-3299
The encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks...
DEBIAN-CVE-2010-3299
The encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks...
CVE-2010-3299
The encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks...
Buffer overflow
The encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks...
CVE-2010-3299
The encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks...
CVE-2010-3299
CVE-2010-3299 : The initial description indicates a padding oracle vulnerability in the encrypt/decrypt functions of Ruby on Rails 2.3. Connected documentation confirms this CVE and reiterates the padding oracle issue but does not provide specifics on affected versions beyond Rails 2.3, nor detai...
