joernchen

24 exploits Active since Mar 2011
CVE-2017-1000117 NOMISEC HIGH WORKING POC
Malicious Git HTTP Server For CVE-2017-1000117
A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim could be tricked into running "git clone --recurse-submodules" to trigger the vulnerability.
3 stars
CVSS 8.8
CVE-2017-1000117 GITLAB HIGH WORKING POC
Malicious Git HTTP Server For CVE-2017-1000117
A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim could be tricked into running "git clone --recurse-submodules" to trigger the vulnerability.
2 stars
CVSS 8.8
CVE-2015-3224 NOMISEC WORKING POC
rubyonrails/web_console < 2.1.2 and rubygems/web-console < 2.1.3 - Improper Access Control via X-Forwarded-For Header
request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request.
2 stars
CVE-2016-2098 GITLAB HIGH WORKING POC
Debian Linux < 3.2.22.1 - Improper Input Validation
Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.
CVSS 7.3
CVE-2017-1000117 NOMISEC HIGH WORKING POC
Malicious Git HTTP Server For CVE-2017-1000117
A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim could be tricked into running "git clone --recurse-submodules" to trigger the vulnerability.
CVSS 8.8
CVE-2017-1000117 NOMISEC HIGH WORKING POC
Malicious Git HTTP Server For CVE-2017-1000117
A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim could be tricked into running "git clone --recurse-submodules" to trigger the vulnerability.
CVSS 8.8
CVE-2011-5331 EXPLOITDB CRITICAL ruby WORKING POC
Distributed Ruby <1.8 - Code Injection
Distributed Ruby (aka DRuby) 1.8 mishandles instance_eval.
CVSS 9.8
CVE-2011-5330 EXPLOITDB CRITICAL ruby WORKING POC
Distributed Ruby <1.8 - Buffer Overflow
Distributed Ruby (aka DRuby) 1.8 mishandles the sending of syscalls.
CVSS 9.8
CVE-2011-10026 EXPLOITDB CRITICAL ruby WORKING POC
Spreecommerce < 0.50.x - Unauthenticated Remote Code Execution via API Search Parameter
Spreecommerce versions prior to 0.50.x contain a remote command execution vulnerability in the API's search functionality. Improper input sanitation allows attackers to inject arbitrary shell commands via the search[instance_eval] parameter, which is dynamically invoked using Ruby’s send method. This flaw enables unauthenticated attackers to execute commands on the server.
CVSS 9.8
CVE-2011-10019 EXPLOITDB CRITICAL ruby WORKING POC
Spreecommerce < 0.60.2 - Unauthenticated Remote Code Execution via Search Parameter
Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality. The application fails to properly sanitize input passed via the search[send][] parameter, which is dynamically invoked using Ruby’s send method. This allows attackers to execute arbitrary shell commands on the server without authentication.
CVSS 9.8
CVE-2013-0233 METASPLOIT ruby WORKING POC
Devise <1.5.4, <2.0.5, <2.1.3, <2.2.3 - Unauthenticated Security Bypass
Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass security checks via unknown vectors, as demonstrated by resetting passwords of arbitrary accounts.
CVE-2011-1140 METASPLOIT ruby WORKING POC
Wireshark 1.0.x 1.2.0-1.2.14 1.4.0-1.4.3 - Denial of Service via SMB or CLDAP Packet
Multiple stack consumption vulnerabilities in the dissect_ms_compressed_string and dissect_mscldap_string functions in Wireshark 1.0.x, 1.2.0 through 1.2.14, and 1.4.0 through 1.4.3 allow remote attackers to cause a denial of service (infinite recursion) via a crafted (1) SMB or (2) Connection-less LDAP (CLDAP) packet.
CVE-2011-10019 METASPLOIT CRITICAL ruby WORKING POC
Spreecommerce < 0.60.2 - Unauthenticated Remote Code Execution via Search Parameter
Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality. The application fails to properly sanitize input passed via the search[send][] parameter, which is dynamically invoked using Ruby’s send method. This allows attackers to execute arbitrary shell commands on the server without authentication.
CVSS 9.8
CVE-2011-10026 METASPLOIT CRITICAL ruby WORKING POC
Spreecommerce < 0.50.x - Unauthenticated Remote Code Execution via API Search Parameter
Spreecommerce versions prior to 0.50.x contain a remote command execution vulnerability in the API's search functionality. Improper input sanitation allows attackers to inject arbitrary shell commands via the search[instance_eval] parameter, which is dynamically invoked using Ruby’s send method. This flaw enables unauthenticated attackers to execute commands on the server.
CVSS 9.8
CVE-2011-4929 METASPLOIT ruby WORKING POC
Redmine 0.9.x-1.0.x - Remote Code Execution via Bazaar Repository Adapter
Unspecified vulnerability in the bazaar repository adapter in Redmine 0.9.x and 1.0.x before 1.0.5 allows remote attackers to execute arbitrary commands via unknown vectors.
CVE-2015-3224 METASPLOIT ruby WORKING POC
rubyonrails/web_console < 2.1.2 and rubygems/web-console < 2.1.3 - Improper Access Control via X-Forwarded-For Header
request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request.
CVE-2015-3224 EXPLOITDB ruby WORKING POC
rubyonrails/web_console < 2.1.2 and rubygems/web-console < 2.1.3 - Improper Access Control via X-Forwarded-For Header
request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request.
EIP-2026-103316 EXPLOITDB ruby WORKING POC
Redmine SCM Repository 0.9.x/1.0.x - Arbitrary Command Execution (Metasploit)
EIP-2026-103115 EXPLOITDB ruby WORKING POC
Gitorious - Arbitrary Command Execution (Metasploit)
CVE-2011-4929 EXPLOITDB ruby WORKING POC
Redmine 0.9.x-1.0.x - Remote Code Execution via Bazaar Repository Adapter
Unspecified vulnerability in the bazaar repository adapter in Redmine 0.9.x and 1.0.x before 1.0.5 allows remote attackers to execute arbitrary commands via unknown vectors.
CVE-2018-17456 EXPLOITDB CRITICAL WRITEUP
Malicious Git HTTP Server For CVE-2018-17456
Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.
CVSS 9.8
EIP-2026-102885 EXPLOITDB text WORKING POC
JRuby Sandbox 0.2.2 - Sandbox Escape
CVE-2018-17456 EXPLOITDB CRITICAL text WRITEUP
Malicious Git HTTP Server For CVE-2018-17456
Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.
CVSS 9.8
CVE-2012-0809 EXPLOITDB text WRITEUP
sudo 1.8.0-1.8.3p1 - Local Use-After-Free via Format String in sudo_debug
Format string vulnerability in the sudo_debug function in Sudo 1.8.0 through 1.8.3p1 allows local users to execute arbitrary code via format string sequences in the program name for sudo.