Directory traversal

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.2 and 4.x before 4.1.14.2 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. dot dot in a pathname. NOTE: this vulnerability exists...

CVE-2016-2098

Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method...

CVE-2016-2098

Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method...

CVE-2016-2097

CVE-2016-2097 is a directory-traversal vulnerability in Rails’ Action View, exploitable when an application uses the render method with an untrusted pathname containing .., allowing remote attackers to read arbitrary files. It affects Ruby on Rails before 3.2.22.2 and 4.x before 4.1.14.2, and is ...

CVE-2016-2098

CVE-2016-2098 affects Ruby on Rails Action Pack render usage. Affected: ActionPack in Rails before 3.2.22.2, Rails 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2. Root cause: unrestricted/unsafe use of the render method allowing attacker-controlled arguments, enabling remote code execution of Ruby...

CVE-2016-2097

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.2 and 4.x before 4.1.14.2 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. dot dot in a pathname. NOTE: this vulnerability exists...

The vulnerability of the Ruby on Rails software platform, which allows a hacker to trigger a service failure

The vulnerability in the actionpack/lib/actiondispatch/routing/routeset.rb file of the Action Pack component in the Ruby on Rails software framework is related to resource management errors. Exploiting this vulnerability could allow a malicious actor to cause service interruptions e.g., memory...

The vulnerability of the Ruby on Rails software platform, which allows attackers to circumvent existing access control policies

The vulnerability in the nestedattributes.rb file of the activerecord/lib/activerecord module in the Ruby on Rails software framework is related to access control deficiencies. Exploiting this vulnerability could allow an attacker to bypass existing access restrictions by using nested attributes ...

The vulnerability of the Ruby on Rails software platform, which allows attackers to bypass the authentication process

The vulnerability of the httpbasicauthenticatewith method in the ActionController/lib/actioncontroller/metal/httpauthentication.rb implementation of Basic Authentication in the Ruby on Rails software framework is related to security configuration errors. Exploiting this vulnerability allows a...

The vulnerability of the Ruby on Rails software platform, which allows attackers to bypass the mechanism for verifying data correctness

The vulnerability of the Ruby on Rails software platform lies in the fact that the Active Model component supports the use of instance-level records for class methods. Exploiting this vulnerability allows a malicious actor to bypass the data validation mechanism by using a specially crafted...

Ruby on Rails Action View 信息泄漏

Possible Information Leak Vulnerability in Action View. There is a possible directory traversal and information leak vulnerability in Action View. This was meant to be fixed on CVE-2016-0752. However the 3.2 patch was not covering all the scenarios. This vulnerability has been assigned the CVE...

Ruby on Rails Action Pack远程代码执行漏洞

漏洞应用 测试环境:Rails-4.0.13 Ruby-2.1.5 测试系统:Kali Linux 2.0 创建 Rails 应用: rails new cve-2016-2098 cd cve-2016-2098 使用自带命令创建控制器 vuln 路由 index,并修改其路由默认处理代码: rails generate scaffold User name:string desc:text age:integer rake db:migrate 修改 app/controllers/userscontroller.rb 中 index 函数代码为: class...

The vulnerability of the Ruby on Rails software platform, which allows a hacker to read arbitrary files

The vulnerability of the Action View component in the Ruby on Rails software framework is related to deficiencies in path name restrictions. Exploiting this vulnerability allows an attacker, operating remotely, to read arbitrary files by using the application’s path name with the “..” symbol...

rubygem-actionpack: code injection vulnerability in Action View

A code injection flaw was found in the way Action View component searched for templates for rendering. If an application passed untrusted input to the 'render' method, a remote, unauthenticated attacker could use this flaw to execute arbitrary code...

Important: Red Hat Security Advisory: ror40 security update

Updated ror40-rubygem-actionpack and ror40-rubygem-activerecord packages that fix multiple security issues are now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores,...

rubygem-actionpack: directory traversal flaw in Action View

A directory traversal flaw was found in the way the Action View component searched for templates for rendering. If an application passed untrusted input to the 'render' method, a remote, unauthenticated attacker could use this flaw to render unexpected files and, possibly, execute arbitrary code...

Important: Red Hat Security Advisory: ruby193 security update

Updated ruby193-rubygem-actionpack and ruby193-rubygem-activerecord packages that fix multiple security issues are now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base...

Important: Red Hat Security Advisory: rh-ror41 security update

Updated rh-ror41-rubygem-actionview packages that fix two security issues are now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...

rails -- multiple vulnerabilities

Ruby on Rails blog: Rails 4.2.5.2, 4.1.14.2, and 3.2.22.2 have been released! These contain the following important security fixes, and it is recommended that users upgrade as soon as possible...

Important: Red Hat Security Advisory: rh-ror41 security update

Updated rh-ror41-rubygem-actionpack, rh-ror41-rubygem-actionview, rh-ror41-rubygem-activemodel, and rh-ror41-rubygem-activerecord packages that fix multiple security issues are now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having Important...