CVE-2015-3224

CVE-2015-3224 affects Ruby on Rails Web Console (Web Console) prior to 2.1.3 when used with Rails 3.x/4.x. The root cause is improper restriction of X-Forwarded-For headers, allowing remote bypass of the whitelisted_ips protection via a crafted request. Exploitation is demonstrated in public advi...

CVE-2015-3226

CVE-2015-3226 is an XSS vulnerability in Active Support's JSON encoding (ActiveSupport::JSON.encode) where a Hash with user-controlled data is mishandled during JSON encoding, potentially injecting script/HTML when inserted into HTML. Affected are Ruby on Rails 3.x and 4.1.x before 4.1.11 and 4.2...

CVE-2015-3225

CVE-2015-3225: Rack (lib/rack/utils.rb) before 1.5.4 and 1.6.x before 1.6.2 allows remote abuse via requests with very large parameter depth, causing SystemStackError DoS. Public references confirm this is a vulnerability in Rack used with Rails 3.x/4.x. Remediation in public advisories: upgrade ...

CVE-2015-1840

jqueryujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space...

CVE-2015-3226

Cross-site scripting XSS vulnerability in json/encoding.rb in Active Support in Ruby on Rails 3.x and 4.1.x before 4.1.11 and 4.2.x before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted Hash that is mishandled during JSON encoding...

CVE-2015-3227

The 1 jdom.rb and 2 rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service SystemStackError via a large XML document depth...

CVE-2015-3225

lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote attackers to cause a denial of service SystemStackError via a request with a large parameter depth...

PT-2015-6103

Name of the Vulnerable Software and Affected Versions Web Console versions prior to 2.1.3 Ruby on Rails versions 3.x and 4.x Description The issue allows remote attackers to bypass the whitelisted ips protection mechanism via a crafted request. This is due to the improper restriction of...

PT-2015-6104

Name of the Vulnerable Software and Affected Versions Rack versions prior to 1.5.4 Rack versions 1.6.x prior to 1.6.2 Description The issue allows remote attackers to cause a denial of service, resulting in a SystemStackError, via a request with a large parameter depth. This affects products that...

Sysphonic Thetis SQL Injection Vulnerability

Thetis World-Strongest groupware/web collaboration suite is based on Ruby on Rails. A SQL injection vulnerability exists in Sysphonic Thetis versions prior to 2.3.0, which can be exploited by remote attackers to execute arbitrary SQL commands...

Snorby 'menu.html.erb' HTML Injection Vulnerability

Snorby is a set of Ruby on Rails based on the Ruby language open source web application framework for network security monitoring web applications . An HTML injection vulnerability exists in Snorby that stems from the program failing to adequately filter user-submitted input. When a user browses...

Ruby On Rails Paperclip Cross-Site Scripting Vulnerability

Ruby on Rails Rails is Rails core team development and maintenance of a set of open source Web application framework based on the Ruby language . Paperclip is a Rails upload image plugin . Ruby On Rails Paperclip has a cross-site scripting vulnerability. This vulnerability allows an attacker to...

[SECURITY] Fedora 22 Update: rubygem-web-console-2.1.3-1.fc22

A debugging tool for your Ruby on Rails applications...

Ruby on Rails jquery-ujs and jquery-rails Security Bypass Vulnerabilities

Ruby on Rails is a set of open source Web application framework based on the Ruby language . jquery-ujs is one of the scripting support files ; jquery-rails is for Rails 4 + applications to provide jQuery and jQuery-ujs driven plug-ins . A security vulnerability exists in Ruby on Rails jquery-ujs...

Ruby on Rails activesupport Remote Denial of Service Vulnerability

Ruby on Rails is a set of open source Web application framework based on the Ruby language . activesupport is a tool function library . A security vulnerability exists in Ruby on Rails activesupport, which allows remote attackers to conduct denial-of-service attacks by submitting special requests...

Acunetix v10 - Web Application Security Testing Tool

Acunetix, the pioneer in automated web application security software, has announced the release of version 10 of its Vulnerability Scanner. New features are designed to prevent the risk of hacking for all customers; from small businesses up to large enterprises, including WordPress users, web...

Ruby on Rails library Paperclip vulnerable to cross-site scripting

Overview Paperclip provided by thoughtbot is a library to upload files in Ruby on Rails. Paperclip contains a persistent cross-site scripting vulnerability CWE-79. MORI Shingo of DeNA Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security...

JVN#83881261: Ruby on Rails library Paperclip vulnerable to cross-site scripting

Paperclip provided by thoughtbot is a library to upload files in Ruby on Rails. Paperclip contains a persistent cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Update to the latest version according to t...

rubygem-actionmailer: email address processing DoS

Multiple format string vulnerabilities in logsubscriber.rb files in the log subscriber component in Action Mailer in Ruby on Rails 3.x before 3.2.15 allow remote attackers to cause a denial of service via a crafted e-mail address that is improperly handled during construction of a log message...

Moderate: Red Hat Bug Fix Advisory: CFME 5.4.0 bug fixes, and enhancement update

Updated cfme packages that fix several bugs, and add various enhancements are now available for Red Hat CloudForms 3.2. Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments. CloudForms Management Engin...