CVSS: 7.5EPSS: 32%CPEs: 27EXPL: 0CVE-2013-1756
https://notcve.org/view.php?id=CVE-2013-1756
The Dragonfly gem 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby, when used with Ruby on Rails, allows remote attackers to execute arbitrary code via a crafted request. La gema Dragonfly 0.7 anterior a 0.8.6 y 0.9.x anterior a 0.9.13 para Ruby, cuando se utiliza con Ruby on Rails, permite a atacantes remotos ejecutar código arbitrario a través de una solicitud manipulada. • http://secunia.com/advisories/52380 http://www.securityfocus.com/bid/58225 https://exchange.xforce.ibmcloud.com/vulnerabilities/82476 https://github.com/markevans/dragonfly/commit/a8775aacf9e5c81cf11bec34b7afa7f27ddfe277 https://groups.google.com/forum/?fromgroups=#%21topic/dragonfly-users/3c3WIU3VQTo • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.5EPSS: 5%CPEs: 1EXPL: 4CVE-2013-5671
https://notcve.org/view.php?id=CVE-2013-5671
lib/dragonfly/imagemagickutils.rb in the fog-dragonfly gem 0.8.2 for Ruby allows remote attackers to execute arbitrary commands via unspecified vectors. lib/dragonfly/imagemagickutils.rb en la gema fog-dragonfly 0.8.2 para Ruby permite a atacantes remotos ejecutar comandos arbitrarios a través de vectores no especificados. • http://seclists.org/fulldisclosure/2013/Sep/18 http://seclists.org/oss-sec/2013/q3/526 http://seclists.org/oss-sec/2013/q3/528 http://www.osvdb.org/96798 http://www.vapid.dhs.org/advisories/fog-dragonfly-0.8.2-cmd-inj.html •