CVSS: 5.0EPSS: 0%CPEs: 141EXPL: 1CVE-2014-7829
https://notcve.org/view.php?id=CVE-2014-7829
Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via vectors involving a \ (backslash) character, a similar issue to CVE-2014-7818. Una vulnerabilidad de salto de directorio en actionpack/lib/action_dispatch/middleware/static.rb en el Action Pack de Ruby on Rails 3.x anterior a 3.2.21, 4.0.x anterior a 4.0.12, 4.1.x anterior a 4.1.8, y 4.2.x anterior a 4.2.0.beta4, cuando serve_static_assets está activado, permite a atacantes remotos determinar la existencia de ficheros fuera de la aplicación root a través de vectores que implican un carácter \ (barra invertida), un problema similar al CVE-2014-7818. • http://lists.opensuse.org/opensuse-updates/2014-11/msg00112.html http://www.securityfocus.com/bid/71183 https://groups.google.com/forum/message/raw?msg=rubyonrails-security/rMTQy4oRCGk/loS_CRS8mNEJ https://puppet.com/security/cve/cve-2014-7829 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.0EPSS: 0%CPEs: 3EXPL: 0CVE-2014-3916
https://notcve.org/view.php?id=CVE-2014-3916
The str_buf_cat function in string.c in Ruby 1.9.3, 2.0.0, and 2.1 allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string. La función str_buf_cat en string.c en Ruby 1.9.3, 2.0.0, y 2.1 permite a atacantes dependientes del contexto, provocar una denegación de servicio (fallo de segmentación y caída) mediante una larga cadena de texto. • http://seclists.org/oss-sec/2014/q2/362 http://seclists.org/oss-sec/2014/q2/375 http://www.securityfocus.com/bid/67705 https://bugs.ruby-lang.org/issues/9709 https://exchange.xforce.ibmcloud.com/vulnerabilities/93505 • CWE-19: Data Processing Errors •
CVSS: 4.3EPSS: 0%CPEs: 137EXPL: 0CVE-2014-7818
https://notcve.org/view.php?id=CVE-2014-7818
Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via a /..%2F sequence. Vulnerabilidad de salto de directorio en actionpack/lib/action_dispatch/middleware/static.rb en Action Pack en Ruby on Rails 3.x anterior a 3.2.20, 4.0.x anterior a 4.0.11, 4.1.x anterior a 4.1.7, y 4.2.x anterior a 4.2.0.beta3, cuando serve_static_assets está habilitado, permite a atacantes remotos determinar la existencia de ficheros fuera del root de la aplicación a través de una secuencia /..%2F. • http://lists.opensuse.org/opensuse-updates/2014-11/msg00112.html https://groups.google.com/forum/message/raw?msg=rubyonrails-security/dCp7duBiQgo/v_R_8PFs5IwJ https://puppet.com/security/cve/cve-2014-7829 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 125EXPL: 0CVE-2014-3482 – rubygem-activerecord: SQL injection vulnerability in 'bitstring' quoting
https://notcve.org/view.php?id=CVE-2014-3482
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting. Vulnerabilidad de inyección SQL en activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb en el adaptador PostgreSQL para Active Record en Ruby on Rails 2.x y 3.x anterior a 3.2.19 permite a atacantes remotos ejecutar comandos SQL arbitrarios mediante el aprovechamiento del citado de bitstrings indebido. It was discovered that Active Record did not properly quote values of the bitstring type attributes when using the PostgreSQL database adapter. A remote attacker could possibly use this flaw to conduct an SQL injection attack against applications using Active Record. • http://openwall.com/lists/oss-security/2014/07/02/5 http://rhn.redhat.com/errata/RHSA-2014-0876.html http://secunia.com/advisories/59973 http://secunia.com/advisories/60214 http://secunia.com/advisories/60763 http://www.debian.org/security/2014/dsa-2982 http://www.securityfocus.com/bid/68343 https://groups.google.com/forum/message/raw?msg=rubyonrails-security/wDxePLJGZdI/WP7EasCJTA4J https://access.redhat.com/security/cve/CVE-2014-3482 https://bugzilla.redhat.com/show_bug • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.0EPSS: 2%CPEs: 103EXPL: 0CVE-2014-0082 – rubygem-actionpack: Action View string handling denial of service
https://notcve.org/view.php?id=CVE-2014-0082
actionpack/lib/action_view/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during use of the :text option to the render method, which allows remote attackers to cause a denial of service (memory consumption) by including these strings in headers. actionpack/lib/action_view/template/text.rb en Action View en Ruby on Rails 3.x anterior a 3.2.17 convierte cadenas tipo MIME a símbolos durante el uso de la opción :text al método render, lo que permite a atacantes remotos causar una denegación de servicio (consumo de memoria) mediante la inclusión de estas cadenas en cabeceras. • http://lists.opensuse.org/opensuse-updates/2014-02/msg00081.html http://openwall.com/lists/oss-security/2014/02/18/10 http://rhn.redhat.com/errata/RHSA-2014-0215.html http://rhn.redhat.com/errata/RHSA-2014-0306.html http://secunia.com/advisories/57376 http://secunia.com/advisories/57836 http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release https://groups.google.com/forum/message/raw?msg=rubyonrails-security/LMxO_3_eCuc/ozGBEhKaJbIJ https://puppet.com& • CWE-20: Improper Input Validation •