Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 8

Export CSV
CVE-2014-3120

elasticsearch: remote code execution flaw via dynamic scripting

The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.

CVSS 3.1 · 8.1 High EPSS 88.6% KEV · Listed
Vendors
Elastic Redhat Rhel Sam
Products
Elasticsearch Fuse Esb Enterprise Fuse Management Console and 4 more
CVE-2014-0130

rubygem-actionpack: directory traversal issue

Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.

CVSS 3.1 · 7.5 High EPSS 53.7% KEV · Listed
Vendors
Redhat Rhel Sam Rubyonrails
Products
Cloudforms Managementengine Enterprise Linux Server Rhel Software Collections and 3 more
CVE-2013-1857

rubygem-actionpack: sanitize_protocol: XSS Vulnerability in the helper of Ruby on Rails

The sanitize helper in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded : (colon) characters in URLs, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted scheme name, as demonstrated by including a : sequence.

CVSS 2.0 · 4.3 Medium EPSS 1.9% KEV · Not listed
Vendors
Redhat Rhel Sam Rubyonrails
Products
Enterprise Linux Openshift 1.4 and 2 more
CVE-2013-4491

rubygem-actionpack: i18n missing translation XSS

Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/translation_helper.rb in the internationalization component in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted string that triggers generation of a fallback string by the i18n gem.

CVSS 2.0 · 4.3 Medium EPSS 2.2% KEV · Not listed
Vendors
Redhat Rhel Sam Rubyonrails
Products
Openstack Rhel Software Collections 1.4 and 2 more
CVE-2013-1854

rubygem-activerecord: attribute_dos Symbol DoS vulnerability

The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by converting hash keys to symbols, which allows remote attackers to cause a denial of service via crafted input to a where method.

CVSS 2.0 · 5.0 Medium EPSS 3.5% KEV · Not listed
Vendors
Redhat Rhel Sam Rubyonrails
Products
Enterprise Linux Openshift 1.4 and 2 more
CVE-2013-6415

rubygem-actionpack: number_to_currency XSS

Cross-site scripting (XSS) vulnerability in the number_to_currency helper in actionpack/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the unit parameter.

CVSS 2.0 · 4.3 Medium EPSS 3.2% KEV · Not listed
Vendors
Redhat Rhel Sam Rubyonrails
Products
Openstack Rhel Software Collections 1.4 and 2 more
CVE-2013-6414

rubygem-actionpack: Action View DoS

actionpack/lib/action_view/lookup_context.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to cause a denial of service (memory consumption) via a header containing an invalid MIME type that leads to excessive caching.

CVSS 2.0 · 5.0 Medium EPSS 20.7% KEV · Not listed
Vendors
Redhat Rhel Sam Rubyonrails
Products
Openstack Rhel Software Collections 1.4 and 2 more
CVE-2013-1855

rubygem-actionpack: css_sanitization: XSS vulnerability in sanitize_css

The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle \n (newline) characters, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences.

CVSS 2.0 · 4.3 Medium EPSS 2.6% KEV · Not listed
Vendors
Redhat Rhel Sam Rubyonrails
Products
Enterprise Linux Openshift 1.4 and 2 more