CVSS: 5.0EPSS: 1%CPEs: 13EXPL: 0CVE-2015-3227
https://notcve.org/view.php?id=CVE-2015-3227
The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth. Vulnerabilidad en los componentes (1) jdom.rb y (2) rexml.rb en Active Support en Ruby on Rails en versiones anteriores a 4.1.11 y 4.2.x anteriores a 4.2.2, cuando JDOM o REXML está activado, permite a atacantes remotos causar una denegación de servicio (SystemStackError) a través de un documento XML de gran tamaño. • http://lists.opensuse.org/opensuse-updates/2015-07/msg00050.html http://openwall.com/lists/oss-security/2015/06/16/16 http://www.debian.org/security/2016/dsa-3464 http://www.securityfocus.com/bid/75234 http://www.securitytracker.com/id/1033755 https://groups.google.com/forum/message/raw?msg=rubyonrails-security/bahr2JLnxvk/x4EocXnHPp8J •
CVSS: 5.0EPSS: 0%CPEs: 141EXPL: 1CVE-2014-7829
https://notcve.org/view.php?id=CVE-2014-7829
Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via vectors involving a \ (backslash) character, a similar issue to CVE-2014-7818. Una vulnerabilidad de salto de directorio en actionpack/lib/action_dispatch/middleware/static.rb en el Action Pack de Ruby on Rails 3.x anterior a 3.2.21, 4.0.x anterior a 4.0.12, 4.1.x anterior a 4.1.8, y 4.2.x anterior a 4.2.0.beta4, cuando serve_static_assets está activado, permite a atacantes remotos determinar la existencia de ficheros fuera de la aplicación root a través de vectores que implican un carácter \ (barra invertida), un problema similar al CVE-2014-7818. • http://lists.opensuse.org/opensuse-updates/2014-11/msg00112.html http://www.securityfocus.com/bid/71183 https://groups.google.com/forum/message/raw?msg=rubyonrails-security/rMTQy4oRCGk/loS_CRS8mNEJ https://puppet.com/security/cve/cve-2014-7829 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.3EPSS: 0%CPEs: 137EXPL: 0CVE-2014-7818
https://notcve.org/view.php?id=CVE-2014-7818
Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via a /..%2F sequence. Vulnerabilidad de salto de directorio en actionpack/lib/action_dispatch/middleware/static.rb en Action Pack en Ruby on Rails 3.x anterior a 3.2.20, 4.0.x anterior a 4.0.11, 4.1.x anterior a 4.1.7, y 4.2.x anterior a 4.2.0.beta3, cuando serve_static_assets está habilitado, permite a atacantes remotos determinar la existencia de ficheros fuera del root de la aplicación a través de una secuencia /..%2F. • http://lists.opensuse.org/opensuse-updates/2014-11/msg00112.html https://groups.google.com/forum/message/raw?msg=rubyonrails-security/dCp7duBiQgo/v_R_8PFs5IwJ https://puppet.com/security/cve/cve-2014-7829 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •