Skip to content
OpenAdvisories

Archive

July 2015

Vulnerabilities first published in this month (UTC), newest first.

← June 2015 2015 / July August 2015 →
  1. 117
  2. 29
  3. 375
  4. 47
  5. 55
  6. 639
  7. 73
  8. 822
  9. 936
  10. 1018
  11. 11 
  12. 12 
  13. 131
  14. 1488
  15. 1548
  16. 16172
  17. 17 
  18. 185
  19. 192
  20. 2022
  21. 218
  22. 226
  23. 2323
  24. 244
  25. 251
  26. 2610
  27. 271
  28. 28 
  29. 2910
  30. 303
  31. 31 
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium —
    CVE-2015-1840

    jquery-rails and jquery-ujs subject to Exposure of Sensitive Information

    jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-d…

    jquery-rails jquery-ujs ruby-jquery-rails Debian RubyGems
  • Medium —
    CVE-2015-3226

    activesupport Cross-site Scripting vulnerability

    Cross-site scripting (XSS) vulnerability in json/encoding.rb in Active Support in Ruby on Rails 3.x and 4.1.x before 4.1.11 and 4.2.x before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted Hash that is mishandled during JSON…

    rails activesupport Debian RubyGems
  • Medium —
    CVE-2015-3227

    activesupport vulnerable to Denial of Service via large XML document depth

    The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.

    rails activesupport Debian RubyGems
  • Medium —
    CVE-2015-3224 Public exploit EPSS 49%

    Web Console (Ruby gem) contains whitelisted_ips bypass

    request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanis…

    web-console RubyGems
  • Medium —
    CVE-2015-3225

    Rack vulnerable to Denial of Service via large parameter depth request

    lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote attackers to cause a denial of service (SystemStackError) via a request with a large parameter depth.

    rack ruby-rack Debian RubyGems
  • Medium —
    CVE-2015-2963

    paperclip Cross-site Scripting vulnerability

    The thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type value during media-type validation, which allows remote attackers to upload HTML documents and conduct cross-site scripting (XSS) attacks via a spoofed value, as demonstrate…

    paperclip RubyGems
  • Medium —
    CVE-2015-1796

    Improper Certificate Validation in Shibboleth Identity Provider and OpenSAML

    The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java (OpenSAML-J) before 2.6.5 trust candidate X.509 credentials when no trusted names are available for the entityID, which allows remote attackers to impersonate an entity via …

    org.opensaml:opensaml edu.internet2.middleware:shibboleth-identityprovider Maven
  • Medium —
    CVE-2014-1836 Public exploit

    ImpressCMS Path Traversal to Arbitrary File Delete

    Absolute path traversal vulnerability in htdocs/libraries/image-editor/image-edit.php in ImpressCMS before 1.3.6 allows remote attackers to delete arbitrary files via a full pathname in the image_path parameter in a cancel action.

    impresscms/impresscms Packagist