[SECURITY] Fedora 27 Update: rubygem-rack-2.0.3-4.fc27

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between the so-called middleware into a single...

Fedora 27 : 1:rubygem-rack (2018-5743ef02a1)

Cross-site scripting XSS via scheme method on Rack::Request CVE-2018-16471. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without...

Fedora 27 : rubygem-loofah (2018-4ce40afcb6)

XXS when a crafted SVG element is republished CVE-2018-16468. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Fedora 27 : rubygem-i18n (2018-4febd7f702)

Fix denial of service in Hashslice in lib/i18n/coreext/hash.rb CVE-2014-10077. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without...

SUSE-SU-2018:3928-1 Security update for rubygem-loofah

This update for rubygem-loofah fixes the following issues: Security issue fixed: - CVE-2018-16468: Fixed XXS by removing the svg animate attribute from from the allowlist bsc1113969...

openSUSE: Security Advisory for rubygem-sprockets (openSUSE-SU-2018:2124-1)

The remote host is missing an update for the Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

RHEL 7 : rubygem-smart_proxy_dynflow (RHSA-2018:2733)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2018:2733 advisory. The rubygem provided by rubygem-smartproxydynflow is a plugin into Foreman's Smart Proxy for running Dynflow actions on the Smart Proxy. Security...

Critical: Red Hat Security Advisory: rubygem-smart_proxy_dynflow security update

An update for rubygem-smartproxydynflow is now available for Red Hat Satellite 6.3 for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...

grape subject to Cross-site Scripting

The grape rubygem suffers from a cross-site scripting XSS vulnerability via "format" parameter...

GHSA-F599-5M7P-HCPF grape subject to Cross-site Scripting

The grape rubygem suffers from a cross-site scripting XSS vulnerability via "format" parameter...

GHSA-8474-RC7C-WRHP High severity vulnerability that affects safemode

Withdrawn, accidental duplicate publish. The safemode rubygem, as used in Foreman, versions 1.3.2 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax. This can lead to deletion of objects for which the user does not have delete permissions or possibly to privileg...

SUSE-SU-2018:2217-1 Security update for rubygem-sprockets-2_12

This update for rubygem-sprockets-212 fixes the following issues: Security issue fixed: - CVE-2018-3760: Fix path traversal in sprockets/server.rb:forbiddenrequest? that can allow remote attackers to read arbitrary files bsc1098369...

SUSE-SU-2018:2176-1 Security update for rubygem-sprockets-2_12

This update for rubygem-sprockets-212 fixes the following issues: Security issue fixed: - CVE-2018-3760: Fix path traversal in sprockets/server.rb:forbiddenrequest? that can allow remote attackers to read arbitrary files bsc1098369...

FreeBSD : rubygem-doorkeeper -- token revocation vulnerability (e309a2c7-598b-4fa6-a398-bc72fbd1d167)

NVD reports : Doorkeeper version 4.2.0 and later contains a Incorrect Access Control vulnerability in Token revocation API's authorized method that can result in Access tokens are not revoked for public OAuth apps, leaking access until expiry. C Tenable Network Security, Inc. The descriptive text...

Json-jwt did not verify the cryptographic signature for data

The json-jwt rubygem version = 0.5.0 && 1.9.4 contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability in Decryption of AES-GCM encrypted JSON Web Tokens that can result in Attacker can forge a authentication tag. This attack appear to be exploitable via network...

GHSA-MJ4X-WCXF-HM8X Json-jwt did not verify the cryptographic signature for data

The json-jwt rubygem version = 0.5.0 && 1.9.4 contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability in Decryption of AES-GCM encrypted JSON Web Tokens that can result in Attacker can forge a authentication tag. This attack appear to be exploitable via network...

openSUSE Security Update : rubygem-sprockets (openSUSE-2018-773)

This update for rubygem-sprockets fixes the following issues : The following security vulnerability was addressed : - CVE-2018-3760: Fixed a path traversal issue in sprockets/server.rb:forbiddenrequest?, which allowed remote attackers to read arbitrary files bsc1098369 This update was imported fr...

Security update for rubygem-sprockets (moderate)

This update for rubygem-sprockets fixes the following issues: The following security vulnerability was addressed: - CVE-2018-3760: Fixed a path traversal issue in sprockets/server.rb:forbiddenrequest?, which allowed remote attackers to read arbitrary files bsc1098369 This update was imported from...

Fedora 27 : rubygem-sprockets (2018-fd29597fa4)

Update to Sprockets 3.7.2. Fixes CVE-2018-3760: https://access.redhat.com/security/cve/cve-2018-3760 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much ...

Low severity vulnerability that affects sensu

The sensu rubygem prior to version 1.2.0 contains a CWE-522 Insufficiently Protected Credentials flaw that can result in sensitive configuration data e.g. passwords being logged in clear-text. Users are advised to upgrade to rubygem version 1.2.1 or later...