the original cloud security
Showing 1 - 5 of 5 RSS Feed

CVE-2016-2098

Status Candidate

Overview

Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.

Related Files

Ruby On Rails ActionPack Inline ERB Code Execution
Posted Jul 9, 2016
Authored by RageLtMan | Site metasploit.com

This Metasploit module exploits a remote code execution vulnerability in the inline request processor of the Ruby on Rails ActionPack component. This vulnerability allows an attacker to process ERB to the inline JSON processor, which is then rendered, permitting full RCE within the runtime, without logging an error condition.

tags | exploit, remote, code execution, ruby
advisories | CVE-2016-2098
MD5 | 23217c482c48d5e43f21337fc1f8cd50
Red Hat Security Advisory 2016-0455-01
Posted Mar 15, 2016
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2016-0455-01 - The ruby193 collection provides Ruby version 1.9.3 and Ruby on Rails version 3.2. Ruby on Rails is a model-view-controller framework for web application development. Multiple directory traversal flaws were found in the way the Action View component searched for templates for rendering. If an application passed untrusted input to the 'render' method, a remote, unauthenticated attacker could use these flaws to render unexpected files and, possibly, execute arbitrary code. Various other issues were also addressed.

tags | advisory, remote, web, arbitrary, ruby
systems | linux, redhat
advisories | CVE-2015-7576, CVE-2015-7577, CVE-2016-0751, CVE-2016-0752, CVE-2016-2097, CVE-2016-2098
MD5 | 8625d8d859f151a4705c173f0170ff21
Red Hat Security Advisory 2016-0456-01
Posted Mar 15, 2016
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2016-0456-01 - The rh-ror41 collection provides Ruby on Rails version 4.1. Ruby on Rails is a model-view-controller framework for web application development. A directory traversal flaw was found in the way the Action View component searched for templates for rendering. If an application passed untrusted input to the 'render' method, a remote, unauthenticated attacker could use this flaw to render unexpected files and, possibly, execute arbitrary code. Various other issues were also addressed.

tags | advisory, remote, web, arbitrary, ruby
systems | linux, redhat
advisories | CVE-2016-2097, CVE-2016-2098
MD5 | 91e3d88d927291e8bdd5976dd1f1cbd5
Red Hat Security Advisory 2016-0454-01
Posted Mar 15, 2016
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2016-0454-01 - The ror40 collection provides Ruby on Rails version 4.0. Ruby on Rails is a model-view-controller framework for web application development. Multiple directory traversal flaws were found in the way the Action View component searched for templates for rendering. If an application passed untrusted input to the 'render' method, a remote, unauthenticated attacker could use these flaws to render unexpected files and, possibly, execute arbitrary code. Various other issues were also addressed.

tags | advisory, remote, web, arbitrary, ruby
systems | linux, redhat
advisories | CVE-2015-7576, CVE-2015-7577, CVE-2015-7581, CVE-2016-0751, CVE-2016-0752, CVE-2016-2097, CVE-2016-2098
MD5 | 8e41922a32401f4d697a36e85a3b1172
Debian Security Advisory 3509-1
Posted Mar 10, 2016
Authored by Debian | Site debian.org

Debian Linux Security Advisory 3509-1 - Two vulnerabilities have been discovered in Rails, a web application framework written in Ruby. Both vulnerabilities affect Action Pack, which handles the web requests for Rails.

tags | advisory, web, vulnerability, ruby
systems | linux, debian
advisories | CVE-2016-2097, CVE-2016-2098
MD5 | 0b7240331abe38630d6dfbe37fea3330
Page 1 of 1
Back1Next

File Archive:

October 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    15 Files
  • 2
    Oct 2nd
    16 Files
  • 3
    Oct 3rd
    15 Files
  • 4
    Oct 4th
    15 Files
  • 5
    Oct 5th
    11 Files
  • 6
    Oct 6th
    6 Files
  • 7
    Oct 7th
    2 Files
  • 8
    Oct 8th
    1 Files
  • 9
    Oct 9th
    13 Files
  • 10
    Oct 10th
    16 Files
  • 11
    Oct 11th
    15 Files
  • 12
    Oct 12th
    23 Files
  • 13
    Oct 13th
    13 Files
  • 14
    Oct 14th
    12 Files
  • 15
    Oct 15th
    2 Files
  • 16
    Oct 16th
    16 Files
  • 17
    Oct 17th
    16 Files
  • 18
    Oct 18th
    15 Files
  • 19
    Oct 19th
    10 Files
  • 20
    Oct 20th
    7 Files
  • 21
    Oct 21st
    4 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close