Phusion records
14 published records for vendor phusion.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 0
- With a fix record
- 92.9%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor2
- CWE-59 Improper Link Resolution Before File Access ('Link Following')2
- CWE-732 Incorrect Permission Assignment for Critical Resource2
- CWE-264 Permissions, Privileges, and Access Controls2
- CWE-908 Use of Uninitialized Resource1
- CWE-255 Credentials Management Errors1
The weakness classes this vendor ships most often: where to look.
CWEAll records
14 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
40Plan | CVE-2018-12026No exploit | During the spawning of a malicious Passenger-managed application, SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows such applicatiophusion · passenger · CWE-59 | Critical9.8 | — | 1.9% | Jun 17, 2018 |
35Monitor | CVE-2018-12027No exploit | An Insecure Permissions vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 causes information disclosure in the following phusion · passenger · CWE-200 | High8.8 | — | 1.1% | Jun 17, 2018 |
31Monitor | CVE-2013-7134No exploit | Juvia uses the same secret key for all installations, which allows remote attackers to have unspecified impact by leveraging the secret key phusion · juvia · CWE-255 | High7.5 | — | 2.3% | Apr 29, 2014 |
31Monitor | CVE-2012-6135No exploit | RubyGems passenger 4.0.0 betas 1 and 2 allows remote attackers to delete arbitrary files during the startup process.phusion · passenger · CWE-20 | High7.5 | — | 2.3% | Nov 19, 2019 |
31Monitor | CVE-2018-12028No exploit | An Incorrect Access Control vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows a Passenger-managed malicious applicphusion · passenger · CWE-732 | High7.8 | — | 0.9% | Jun 17, 2018 |
31Monitor | CVE-2016-10345No exploit | In Phusion Passenger before 5.1.0, a known /tmp filename was used during passenger-install-nginx-module execution, which could allow local aphusion · passenger · CWE-264 | High7.8 | — | 0.5% | Apr 18, 2017 |
30Monitor | CVE-2025-26803No exploit | The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invaphusion · passenger · CWE-908 | High7.5 | — | 0.6% | Feb 24, 2025 |
28Monitor | CVE-2018-12029No exploit | A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-stanphusion · passenger · CWE-362 | High7.0 | — | 0.3% | Jun 17, 2018 |
21Monitor | CVE-2018-12615No exploit | An issue was discovered in switchGroup() in agent/ExecHelper/ExecHelperMain.cpp in Phusion Passenger before 5.3.2.phusion · passenger · CWE-732 | Medium5.3 | — | 1.2% | Jun 21, 2018 |
18Monitor | CVE-2013-2119No exploit | Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application staphusion · passenger · CWE-264 | Medium4.6 | — | 0.4% | Jan 3, 2014 |
18Monitor | CVE-2017-16355No exploit | In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if phusion · passenger · CWE-200 | Medium4.7 | — | 0.4% | Dec 14, 2017 |
17Monitor | CVE-2013-4136No exploit | ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ophusion · passenger · CWE-59 | Medium4.4 | — | 0.3% | Sep 30, 2013 |
8Monitor | CVE-2014-1831No exploit | Phusion Passenger before 4.0.37 allows local users to write to certain files and directories via a symlink attack on (1) control_process.pidphusion · passenger | Low2.1 | — | 0.4% | Feb 19, 2015 |
8Monitor | CVE-2014-1832No exploit | Phusion Passenger 4.0.37 allows local users to write to certain files and directories via a symlink attack on (1) control_process.pid or a (phusion · passenger | Low2.1 | — | 0.4% | Feb 19, 2015 |
- CVE-2018-1202640Plan
During the spawning of a malicious Passenger-managed application, SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows such applicatio
CriticalCVSS 9.8No exploitEPSS 2%phusion · passengerJun 17, 2018
- CVE-2018-1202735Monitor
An Insecure Permissions vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 causes information disclosure in the following
HighCVSS 8.8No exploitEPSS 1%phusion · passengerJun 17, 2018
- CVE-2013-713431Monitor
Juvia uses the same secret key for all installations, which allows remote attackers to have unspecified impact by leveraging the secret key
HighCVSS 7.5No exploitEPSS 2%phusion · juviaApr 29, 2014
- CVE-2012-613531Monitor
RubyGems passenger 4.0.0 betas 1 and 2 allows remote attackers to delete arbitrary files during the startup process.
HighCVSS 7.5No exploitEPSS 2%phusion · passengerNov 19, 2019
- CVE-2018-1202831Monitor
An Incorrect Access Control vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows a Passenger-managed malicious applic
HighCVSS 7.8No exploitEPSS 1%phusion · passengerJun 17, 2018
- CVE-2016-1034531Monitor
In Phusion Passenger before 5.1.0, a known /tmp filename was used during passenger-install-nginx-module execution, which could allow local a
HighCVSS 7.8No exploitEPSS 0%phusion · passengerApr 18, 2017
- CVE-2025-2680330Monitor
The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an inva
HighCVSS 7.5No exploitEPSS 1%phusion · passengerFeb 24, 2025
- CVE-2018-1202928Monitor
A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-stan
HighCVSS 7.0No exploitEPSS 0%phusion · passengerJun 17, 2018
- CVE-2018-1261521Monitor
An issue was discovered in switchGroup() in agent/ExecHelper/ExecHelperMain.cpp in Phusion Passenger before 5.3.2.
MediumCVSS 5.3No exploitEPSS 1%phusion · passengerJun 21, 2018
- CVE-2013-211918Monitor
Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application sta
MediumCVSS 4.6No exploitEPSS 0%phusion · passengerJan 3, 2014
- CVE-2017-1635518Monitor
In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if
MediumCVSS 4.7No exploitEPSS 0%phusion · passengerDec 14, 2017
- CVE-2013-413617Monitor
ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the o
MediumCVSS 4.4No exploitEPSS 0%phusion · passengerSep 30, 2013
- CVE-2014-18318Monitor
Phusion Passenger before 4.0.37 allows local users to write to certain files and directories via a symlink attack on (1) control_process.pid
LowCVSS 2.1No exploitEPSS 0%phusion · passengerFeb 19, 2015
- CVE-2014-18328Monitor
Phusion Passenger 4.0.37 allows local users to write to certain files and directories via a symlink attack on (1) control_process.pid or a (
LowCVSS 2.1No exploitEPSS 0%phusion · passengerFeb 19, 2015