A vulnerability has been discovered in the Grails web framework, intended for developing web applications following the MVC paradigm using Java, Groovy, and other languages for the JVM, which allows remote code execution in the environment where the web application runs. The exploitation of the vulnerability occurs through sending a specially crafted request, granting the attacker access to the ClassLoader. The issue arises from a flaw in the data-binding logic used both when creating objects and during manual binding with bindData. This issue has been fixed in releases 3.3.15, 4.1.1, 5.1.9, and 5.2.1.
Additionally, a vulnerability in the Ruby tzinfo module allows the loading of any file's contents, limited only by the access rights of the targeted application. The vulnerability is related to the lack of proper checks for the use of special characters in the timezone name specified in the TZInfo::Timezone.get method. This issue affects applications that pass unverified external data to TZInfo::Timezone.get. For instance, to read the file /tmp/payload, one might specify a value like "foo\n/../../../../tmp/payload".
Source: opennet.ru
