News
threat-intel Russian Hackers Create Fake US and UK Websites to Target Visitors With Mobile Exploits - GBHackers cybersecurity AI-Linked Breaches Mount as WorkOS, Northflank, Trigger.dev Disclose Hacks - SecurityWeek threat-intel Google Patches Critical Android RCE Flaws That Let Attackers Execute Code Without User Interaction - GBHackers cybersecurity Google Fixes 208 Android Vulnerabilities, Including Critical Zero-Click RCE Flaws - CyberPress cybersecurity CISA flags WordPress RCE flaw as actively exploited in attacks - BleepingComputer cybersecurity Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads - The Hacker News threat-intel CISA Warns of Active Attacks Exploiting WordPress Core Code Execution Vulnerability - GBHackers threat-intel Hackers Use Stolen Microsoft Entra ID App Credentials to Breach 27 Organizations and Steal Sensitive Data - GBHackers cybersecurity Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory - The Hacker News threat-intel Cloudflare Launches Zero Wire to Track Critical Vulnerabilities and Active Exploitation Across the Internet - GBHackers threat-intel 3AM Ransomware Hackers Use AI-Assisted Attacks to Breach UK Schools and Spread Across Windows Domains - GBHackers cybersecurity China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor - The Hacker News cybersecurity mSecure Password Manager Warns Users to Reset Passwords, 2FA and Passkeys After Security Incident - CyberPress cybersecurity Hackers Use BeautyStealer Malware to Steal Browser Passwords and Sensitive Files Before Erasing Evidence - CyberPress cybersecurity APT29 Hackers Poison Websites to Target iPhones and Android Phones Without Users Clicking Anything - CyberPress
1 / 15
All news ›
Cybersecurity

Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads

The Hacker News ·

A critical flaw in Ruby on Rails could allow an unauthenticated attacker to write arbitrary files on an app's server by uploading a crafted file if the app processes uploads using ImageMagick. The Rails project disclosed the flaw in an advisory and fixed it in versions 8.1.4.1 and 8.0.5.2. The flaw is in Active Storage, the part of Rails that handles file uploads. Some apps store

Continue on The Hacker News ↗ ‹ All news Get the newsletter

The summary and image come from The Hacker News; the image is shown from their website.