CVSS: 7.5EPSS: 20%CPEs: 39EXPL: 1CVE-2014-0130 – Ruby on Rails Directory Traversal Vulnerability
https://notcve.org/view.php?id=CVE-2014-0130
07 May 2014 — Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request. Vulnerabilidad de salto de directorio en actionpack/lib/abstract_controller/base.rb en la implementación implicit-render en Ruby on Rails anterior a 3.2.18, 4.0.x anterior a 4.0.5 y 4.1.x ant... • https://github.com/omarkurt/cve-2014-0130 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 0CVE-2013-6439 – candlepin: insecure authentication enabled by default
https://notcve.org/view.php?id=CVE-2013-6439
22 Dec 2013 — Candlepin in Red Hat Subscription Asset Manager 1.0 through 1.3 uses a weak authentication scheme when the configuration file does not specify a scheme, which has unspecified impact and attack vectors. Candlepin en Red Hat Subscription Asset Manager v1.0 hasta v1.3 utiliza un esquema de autenticación débil cuando el archivo de configuración no especifica un esquema, lo cual tiene un impacto no especificado y vectores de ataque. Candlepin is an open source entitlement management system. It tracks the product... • http://rhn.redhat.com/errata/RHSA-2013-1863.html • CWE-287: Improper Authentication CWE-290: Authentication Bypass by Spoofing •