Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,139

Export CSV
CVE-2013-1854

rubygem-activerecord: attribute_dos Symbol DoS vulnerability

The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by converting hash keys to symbols, which allows remote attackers to cause a denial of service via crafted input to a where method.

CVSS 2.0 · 5.0 Medium EPSS 3.5% KEV · Not listed
Vendors
Redhat Rhel Sam Rubyonrails
Products
Enterprise Linux Openshift 1.4 and 2 more
CVE-2013-1808

stapler-adjunct-zeroclipboard: XSS via copying XSS payload into buffer

Cross-site scripting (XSS) vulnerability in ZeroClipboard.swf and ZeroClipboard10.swf in ZeroClipboard before 1.0.8, as used in em-shorty, RepRapCalculator, Fulcrum, Django, aCMS, and other products, allows remote attackers to inject arbitrary web script or HTML via the id parameter. NOTE: this is might be the same vulnerability as CVE-2013-1463. If so, it is likely that CVE-2013-1463 will be REJECTed.

CVSS 2.0 · 4.3 Medium EPSS 7.3% KEV · Not listed
Vendors
Redhat Zeroclipboard Project
Products
Openshift Zeroclipboard
CVE-2013-0333

rubygem-activesupport: json to yaml parsing

lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.

CVSS 2.0 · 7.5 High EPSS 95.6% KEV · Not listed
Vendors
Cloudforms Cloudengine Redhat Rhel Sam and 1 more
Products
1 Openshift 1.1 and 2 more
CVE-2012-3465

rubygem-actionpack: XSS Vulnerability in strip_tags

Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/sanitize_helper.rb in the strip_tags helper in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via malformed HTML markup.

CVSS 2.0 · 4.3 Medium EPSS 2.0% KEV · Not listed
Vendors
Cloudforms Cloudengine Redhat Rhel Sam and 1 more
Products
1 Openshift 1.1 and 2 more
CVE-2012-2661

rubygem-activerecord: SQL injection when processing nested query paramaters

The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage unintended recursion, a related issue to CVE-2012-2695.

CVSS 2.0 · 5.0 Medium EPSS 4.0% KEV · Not listed
Vendors
Cloudforms Cloudengine Redhat Rhel Sam and 1 more
Products
1 Openshift 1.1 and 2 more
CVE-2013-0331

jenkins: denial of service attack by feeding a carefully crafted payload to Jenkins

Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to cause a denial of service via a crafted payload.

CVSS 2.0 · 4.0 Medium EPSS 2.0% KEV · Not listed
Vendors
Jenkins Redhat
Products
Jenkins Openshift
CVE-2012-6074

Jenkins: cross-site scripting vulnerability

Cross-site scripting (XSS) vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote authenticated users with write access to inject arbitrary web script or HTML via unspecified vectors.

CVSS 2.0 · 3.5 Low EPSS 1.4% KEV · Not listed
Vendors
Cloudbees Jenkins Redhat
Products
Jenkins Jenkins Openshift
CVE-2013-0330

jenkins: cause building jobs without direct access

Unspecified vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to build arbitrary jobs via unknown attack vectors.

CVSS 2.0 · 4.0 Medium EPSS 1.8% KEV · Not listed
Vendors
Jenkins Redhat
Products
Jenkins Openshift
CVE-2013-0329

jenkins: cross-site request forgery (CSRF) protection mechanism bypass

Unspecified vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to bypass the CSRF protection mechanism via unknown attack vectors.

CVSS 2.0 · 7.5 High EPSS 2.3% KEV · Not listed
Vendors
Jenkins Redhat
Products
Jenkins Openshift
CVE-2012-6073

Jenkins: open redirect

Open redirect vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

CVSS 2.0 · 5.8 Medium EPSS 1.8% KEV · Not listed
Vendors
Cloudbees Jenkins Redhat
Products
Jenkins Jenkins Openshift
CVE-2014-1869

stapler-adjunct-zeroclipboard: multiple cross-site scripting (XSS) flaws

Multiple cross-site scripting (XSS) vulnerabilities in ZeroClipboard.swf in ZeroClipboard before 1.3.2, as maintained by Jon Rohan and James M. Greene, allow remote attackers to inject arbitrary web script or HTML via vectors related to certain SWF query parameters (aka loaderInfo.parameters).

CVSS 2.0 · 4.3 Medium EPSS 2.8% KEV · Not listed
Vendors
Redhat Zeroclipboard Project
Products
Openshift Zeroclipboard
CVE-2013-0328

jenkins: XSS

Cross-site scripting (XSS) vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS 2.0 · 4.3 Medium EPSS 1.3% KEV · Not listed
Vendors
Jenkins Redhat
Products
Jenkins Openshift
CVE-2013-0327

jenkins: cross-site request forgery (CSRF) on Jenkins master

Cross-site request forgery (CSRF) vulnerability in Jenkins master in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to hijack the authentication of users via unknown vectors.

CVSS 2.0 · 6.8 Medium EPSS 3.3% KEV · Not listed
Vendors
Jenkins Redhat
Products
Jenkins Openshift
CVE-2012-3464

rubygem-actionpack: potential XSS vulnerability

Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a ' (quote) character.

CVSS 2.0 · 4.3 Medium EPSS 2.6% KEV · Not listed
Vendors
Cloudforms Cloudengine Redhat Rhel Sam and 1 more
Products
1 Openshift 1.1 and 2 more
CVE-2012-2660

rubygem-actionpack: Unsafe query generation

actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2694.

CVSS 2.0 · 6.4 Medium EPSS 4.5% KEV · Not listed
Vendors
Cloudforms Cloudengine Redhat Rhel Sam and 1 more
Products
1 Openshift 1.1 and 2 more
CVE-2013-0276

rubygem-activerecord/rubygem-activemodel: circumvention of attr_protected

ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the attr_protected protection mechanism and modify protected model attributes via a crafted request.

CVSS 2.0 · 4.3 Medium EPSS 3.0% KEV · Not listed
Vendors
Redhat Rhel Sam Rubyonrails
Products
Openshift 1.2 Rails
CVE-2012-6072

Jenkins: HTTP response splitting

CRLF injection vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

CVSS 2.0 · 4.3 Medium EPSS 1.8% KEV · Not listed
Vendors
Cloudbees Jenkins Redhat
Products
Jenkins Jenkins Openshift
CVE-2013-0269

rubygem-json: Denial of Service and SQL Injection

The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."

CVSS 2.0 · 7.5 High EPSS 13.9% KEV · Not listed
Vendors
Redhat Rhel Sam Rubygems
Products
Fuse Esb Enterprise Jboss Enterprise Soa Platform Jboss Fuse and 3 more
CVE-2012-5658

Origin: rhc-chk.rb password exposure in log files

rhc-chk.rb in Red Hat OpenShift Origin before 1.1, when -d (debug mode) is used, outputs the password and other sensitive information in cleartext, which allows context-dependent attackers to obtain sensitive information, as demonstrated by including log files or Bugzilla reports in support channels.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Openshift Openshift Origin
CVE-2013-0263

rubygem-rack: Timing attack in cookie sessions

Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.

CVSS 2.0 · 5.1 Medium EPSS 5.4% KEV · Not listed
Vendors
Rack Project Redhat Rhel Sam
Products
Rack Openshift 1.2