CVE-2015-4410
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 5.7%
The Moped::BSON::ObjecId.legal? method in rubygem-moped before commit dd5a7c14b5d2e466f7875d079af71ad19774609b allows remote attackers to cause a denial of service (worker resource consumption) or perform a cross-site scripting (XSS) attack via a crafted string.
Produtos afetados
n/a · n/aReferências
http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161964.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-July/161987.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=1229757https://github.com/mongoid/moped/commit/dd5a7c14b5d2e466f7875d079af71ad19774609b#diff-3b93602f64c2fe46d38efd9f73ef5358R24https://homakov.blogspot.ru/2012/05/saferweb-injects-in-various-ruby.htmlhttps://sakurity.com/blog/2015/06/04/mongo_ruby_regexp.htmlhttps://seclists.org/oss-sec/2015/q2/653https://www.securityfocus.com/bid/75045http://www.openwall.com/lists/oss-security/2015/06/06/3http://www.securityfocus.com/bid/75045