Ben Murphy

This issue allows local attackers to escalate privileges on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system. The specific flaw exists within the DTrace DOF files due to the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. This can be leveraged to execute code under the context of the host OS.

This issue allows local attackers to escalate privileges on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system. The flaw exists within the `SMBIOC TREE RELE` ioctl, resulting from the lack of validating the existence of an object prior to performing operations on the object. This can be leveraged to execute code under the context of the host OS.

This issue allows remote attackers to execute arbitrary code on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system. The flaw exists within the `docker API`, which does not properly validate user-supplied data, allowing for the upload of arbitrary files. An attacker can leverage this to execute arbitrary code under the context of root.

The issue is caused by an integer overflow in the dtrace implementation in the kernel. This can be exploited by a remote attacker using a specially crafted application, allowing them to execute arbitrary code in a privileged context.

The issue allows remote attackers to inject arbitrary web script or HTML via crafted tag attributes, which can lead to cross-site scripting (XSS) attacks. This occurs due to a vulnerability in the rails-html-sanitizer gem.

The issue allows remote attackers to bypass the whitelisted ips protection mechanism via a crafted request. This is due to the improper restriction of X-Forwarded-For headers in determining a client's IP address.

The issue allows remote attackers to execute arbitrary Lua bytecode via the `eval` command. It is related to incorrect data type conversion in the deps/lua/src/ldo.c component of the Redis database management system. Exploitation of the issue may allow a remote attacker to execute arbitrary Lua bytecode using a specially crafted `eval` command.

The issue allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call, potentially leading to a breach of confidentiality, integrity, and availability of protected information. This can be exploited by an authenticated attacker.

The issue allows remote attackers to read arbitrary files or cause a denial of service via vectors involving an external DTD or an external entity declaration in conjunction with an entity reference, due to the ActiveSupport::XmlMini JDOM backend not properly restricting the capabilities of the XML parser when JRuby is used.

The issue allows remote attackers to cause a denial of service via crafted input to a where method, due to the Active Record component processing certain queries by converting hash keys to symbols.

The issue allows remote attackers to cause a denial of service or bypass the mass assignment protection mechanism via a crafted JSON document. This can trigger the creation of arbitrary Ruby symbols or certain internal objects, potentially leading to attacks such as SQL injection against Ruby on Rails.

The issue allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service involving nested XML entity references, by leveraging Action Pack support for YAML type conversion or Symbol type conversion. This is due to the improper restriction of casts of string values in the `active support/core ext/hash/conversions.rb` file.

The issue is related to the Active Record component, which does not properly handle the passing of request data to a where method in an ActiveRecord class. This allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage unintended recursion.

The issue allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request. This is due to improper consideration of differences in parameter handling between the Active Record component and the Rack interface. The vulnerability can be exploited by sending certain "[nil]" values in a request.

The issue allows remote authenticated users to execute arbitrary Java code via crafted templates, specifically (1) XSLT or (2) Velocity templates.