Exploit the possiblities
Showing 1 - 5 of 5 RSS Feed

CVE-2016-2098

Status Candidate

Overview

Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.

Related Files

Ruby On Rails ActionPack Inline ERB Code Execution
Posted Jul 9, 2016
Authored by RageLtMan | Site metasploit.com

This Metasploit module exploits a remote code execution vulnerability in the inline request processor of the Ruby on Rails ActionPack component. This vulnerability allows an attacker to process ERB to the inline JSON processor, which is then rendered, permitting full RCE within the runtime, without logging an error condition.

tags | exploit, remote, code execution, ruby
advisories | CVE-2016-2098
MD5 | 23217c482c48d5e43f21337fc1f8cd50
Red Hat Security Advisory 2016-0455-01
Posted Mar 15, 2016
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2016-0455-01 - The ruby193 collection provides Ruby version 1.9.3 and Ruby on Rails version 3.2. Ruby on Rails is a model-view-controller framework for web application development. Multiple directory traversal flaws were found in the way the Action View component searched for templates for rendering. If an application passed untrusted input to the 'render' method, a remote, unauthenticated attacker could use these flaws to render unexpected files and, possibly, execute arbitrary code. Various other issues were also addressed.

tags | advisory, remote, web, arbitrary, ruby
systems | linux, redhat
advisories | CVE-2015-7576, CVE-2015-7577, CVE-2016-0751, CVE-2016-0752, CVE-2016-2097, CVE-2016-2098
MD5 | 8625d8d859f151a4705c173f0170ff21
Red Hat Security Advisory 2016-0456-01
Posted Mar 15, 2016
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2016-0456-01 - The rh-ror41 collection provides Ruby on Rails version 4.1. Ruby on Rails is a model-view-controller framework for web application development. A directory traversal flaw was found in the way the Action View component searched for templates for rendering. If an application passed untrusted input to the 'render' method, a remote, unauthenticated attacker could use this flaw to render unexpected files and, possibly, execute arbitrary code. Various other issues were also addressed.

tags | advisory, remote, web, arbitrary, ruby
systems | linux, redhat
advisories | CVE-2016-2097, CVE-2016-2098
MD5 | 91e3d88d927291e8bdd5976dd1f1cbd5
Red Hat Security Advisory 2016-0454-01
Posted Mar 15, 2016
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2016-0454-01 - The ror40 collection provides Ruby on Rails version 4.0. Ruby on Rails is a model-view-controller framework for web application development. Multiple directory traversal flaws were found in the way the Action View component searched for templates for rendering. If an application passed untrusted input to the 'render' method, a remote, unauthenticated attacker could use these flaws to render unexpected files and, possibly, execute arbitrary code. Various other issues were also addressed.

tags | advisory, remote, web, arbitrary, ruby
systems | linux, redhat
advisories | CVE-2015-7576, CVE-2015-7577, CVE-2015-7581, CVE-2016-0751, CVE-2016-0752, CVE-2016-2097, CVE-2016-2098
MD5 | 8e41922a32401f4d697a36e85a3b1172
Debian Security Advisory 3509-1
Posted Mar 10, 2016
Authored by Debian | Site debian.org

Debian Linux Security Advisory 3509-1 - Two vulnerabilities have been discovered in Rails, a web application framework written in Ruby. Both vulnerabilities affect Action Pack, which handles the web requests for Rails.

tags | advisory, web, vulnerability, ruby
systems | linux, debian
advisories | CVE-2016-2097, CVE-2016-2098
MD5 | 0b7240331abe38630d6dfbe37fea3330
Page 1 of 1
Back1Next

Want To Donate?


Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

February 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    15 Files
  • 2
    Feb 2nd
    15 Files
  • 3
    Feb 3rd
    15 Files
  • 4
    Feb 4th
    13 Files
  • 5
    Feb 5th
    16 Files
  • 6
    Feb 6th
    15 Files
  • 7
    Feb 7th
    15 Files
  • 8
    Feb 8th
    15 Files
  • 9
    Feb 9th
    18 Files
  • 10
    Feb 10th
    8 Files
  • 11
    Feb 11th
    8 Files
  • 12
    Feb 12th
    17 Files
  • 13
    Feb 13th
    15 Files
  • 14
    Feb 14th
    15 Files
  • 15
    Feb 15th
    17 Files
  • 16
    Feb 16th
    18 Files
  • 17
    Feb 17th
    37 Files
  • 18
    Feb 18th
    2 Files
  • 19
    Feb 19th
    16 Files
  • 20
    Feb 20th
    6 Files
  • 21
    Feb 21st
    0 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close