CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 1CVE-2018-16476 – activejob: Information Exposure through deserialization using GlobalId
https://notcve.org/view.php?id=CVE-2018-16476
A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give them access to information that they should not have. This vulnerability has been fixed in versions 4.2.11, 5.0.7.1, 5.1.6.1, and 5.2.1.1. Una vulnerabilidad del Control de acceso roto en las versiones de Trabajo activo> = versión 4.2.0 permite a un atacante crear una entrada de usuario que puede hacer que el Trabajo activo lo deserialice con GlobalId y les dé acceso a la información que no deberían tener. Esta vulnerabilidad se ha corregido en las versiones 4.2.11, 5.0.7.1, 5.1.6.1 y 5.2.1.1. A deserialization flaw, leading to an information exposure flaw, was found in the activejob component used by Red Hat CloudForms and Red Hat Satellite. • https://access.redhat.com/errata/RHSA-2019:0600 https://groups.google.com/d/msg/rubyonrails-security/FL4dSdzr2zw/zjKVhF4qBAAJ https://weblog.rubyonrails.org/2018/11/27/Rails-4-2-5-0-5-1-5-2-have-been-released https://access.redhat.com/security/cve/CVE-2018-16476 https://bugzilla.redhat.com/show_bug.cgi?id=1659223 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-284: Improper Access Control CWE-502: Deserialization of Untrusted Data •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2018-10905 – cfme: Improper access control in dRuby allows local users to execute arbitrary commands as root
https://notcve.org/view.php?id=CVE-2018-10905
CloudForms Management Engine (cfme) is vulnerable to an improper security setting in the dRuby component of CloudForms. An attacker with access to an unprivileged local shell could use this flaw to execute commands as a high privileged user. CloudForms Management Engine (cfme) es vulnerable a una opción de seguridad incorrecta en el componente dRuby de CloudForms. Un atacante con acceso a un shell local sin privilegios podría emplear este error para ejecutar comandos como usuario con altos privilegios. CloudForms Management Engine has a vulnerability that allows local users to execute arbitrary commands as root. • https://access.redhat.com/errata/RHSA-2018:2561 https://access.redhat.com/errata/RHSA-2018:2745 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10905 https://access.redhat.com/security/cve/CVE-2018-10905 https://bugzilla.redhat.com/show_bug.cgi?id=1602190 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-284: Improper Access Control •
CVSS: 7.5EPSS: 2%CPEs: 19EXPL: 2CVE-2018-3760 – rubygem-sprockets: Path traversal in forbidden_request?() can allow remote attackers to read arbitrary files
https://notcve.org/view.php?id=CVE-2018-3760
There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately. Existe una vulnerabilidad de fuga de información en Sprockets. • https://github.com/mpgn/CVE-2018-3760 https://github.com/cyberharsh/Ruby-On-Rails-Path-Traversal-Vulnerability-CVE-2018-3760- https://access.redhat.com/errata/RHSA-2018:2244 https://access.redhat.com/errata/RHSA-2018:2245 https://access.redhat.com/errata/RHSA-2018:2561 https://access.redhat.com/errata/RHSA-2018:2745 https://github.com/rails/sprockets/commit/c09131cf5b2c479263939c8582e22b98ed616c5fhttps://github.com/rails/sprockets/commit/9c34fa05900b968d74f08ccf40917848a7be9441https://github.com/rails/sproc • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 1CVE-2018-1000544 – rubyzip: arbitrary file write vulnerability / arbitrary code execution using a specially crafted zip file
https://notcve.org/view.php?id=CVE-2018-1000544
rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , an attacker can upload a malicious file that contains symlinks or files with absolute pathnames "../" to write arbitrary files to the filesystem.. rubyzip gem rubyzip en versiones 1.2.1 y anteriores contiene una vulnerabilidad de salto de directorio en el componente Zip::File que puede resultar en la escritura de archivos arbitrarios en el sistema de archivos. Si un sitio permite la subida de archivos .zip, un atacante puede subir un archivo malicioso que contiene vínculos simbólicos o archivos con nombre de ruta absolutos "../" para escribir archivos arbitrarios en el sistema de archivos. A directory and symbolic link traversal flaw was found in the way rubyzip gem extracts zip files. An attacker, with access to a privileged application capable of extracting zip files, could use this flaw to write new files to arbitrary paths, accessible by the aforementioned privileged application. • https://access.redhat.com/errata/RHSA-2018:3466 https://github.com/rubyzip/rubyzip/issues/369 https://lists.debian.org/debian-lts-announce/2018/08/msg00013.html https://lists.debian.org/debian-lts-announce/2020/08/msg00002.html https://access.redhat.com/security/cve/CVE-2018-1000544 https://bugzilla.redhat.com/show_bug.cgi?id=1593001 • CWE-59: Improper Link Resolution Before File Access ('Link Following') CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 5.9EPSS: 0%CPEs: 12EXPL: 0CVE-2018-10855 – ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs
https://notcve.org/view.php?id=CVE-2018-10855
Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible. Ansible, en versiones 2.5 anteriores a la 2.5.5 y 2.4 anteriores a la 2.4.5, no cumplen con la marca de tarea no_log para las tareas fallidas. Cuando se ha empleado la marca no_log para proteger datos sensibles que se pasan a una tarea desde que se registra y esa tarea no se ejecuta con éxito, Ansible mostrará datos sensibles en archivos de registro y en el terminal del usuario que ejecuta Ansible. • https://access.redhat.com/errata/RHBA-2018:3788 https://access.redhat.com/errata/RHSA-2018:1948 https://access.redhat.com/errata/RHSA-2018:1949 https://access.redhat.com/errata/RHSA-2018:2022 https://access.redhat.com/errata/RHSA-2018:2079 https://access.redhat.com/errata/RHSA-2018:2184 https://access.redhat.com/errata/RHSA-2018:2585 https://access.redhat.com/errata/RHSA-2019:0054 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10855 https://usn.ubuntu.com/ • CWE-532: Insertion of Sensitive Information into Log File •