Search for packages
| purl | pkg:deb/debian/ruby-rest-client@1.6.7-6 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-jggb-58ap-ybab
Aliases: CVE-2015-3448 GHSA-mx9f-w8qq-q5jf |
Log Plaintext Password Local Disclosure REST Client for Ruby contains a flaw that is due to the application logging password information in plaintext. This may allow a local attacker to gain access to password information. |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-vhdm-w6p1-uuh9 | Session fixation vulnerability via Set-Cookie headers The package rest-client in `abstract_response.rb` improperly handles `Set-Cookie` headers on HTTP redirection responses. Any cookies will be forwarded to the redirection target regardless of domain, path, or expiration. If you control a redirection source, you can cause rest-client to perform a request to any third-party domain with cookies of your choosing, which may be useful in performing a session fixation attack. If you control a redirection target, you can steal any cookies set by the third-party redirection request. |
CVE-2015-1820
GHSA-3fhf-6939-qg8p OSV-119878 |