Internet Bug Bounty: [CVE-2024-54133] Possible Content Security Policy bypass in Action Dispatch

A vulnerability was discovered in the contentsecuritypolicy helper in Action Pack of Ruby on Rails. Carefully crafted inputs were able to inject new directives into the Content-Security-Policy CSP header, potentially leading to a bypass of the CSP and its protection against cross-site scripting X...

CVE-2024-49761 affecting package ruby for versions less than 3.3.5-1

CVE-2024-49761 affecting package ruby for versions less than 3.3.5-1. A patched version of the package is available...

CVE-2024-43398 affecting package ruby for versions less than 3.3.5-1

CVE-2024-43398 affecting package ruby for versions less than 3.3.5-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-39908 affecting package ruby for versions less than 3.3.5-1

CVE-2024-39908 affecting package ruby for versions less than 3.3.5-1. An upgraded version of the package is available that resolves this issue...

GHSA-5MPW-4546-2WCR vulnerabilities

Vulnerabilities for packages: ruby3.2-elasticsearch, ruby3.3-elasticsearch...

GHSA-5MPW-4546-2WCR vulnerabilities

Vulnerabilities for packages: ruby3.3-elasticsearch, ruby3.2-elasticsearch...

CVE-2024-12539 vulnerabilities

Vulnerabilities for packages: ruby3.3-elasticsearch, ruby3.2-elasticsearch...

Malicious code in haefgerasgrae (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c51eb8de5b4c76701af20deeb703ba85374c2036c17fd5bcd09b7b0233c6ae34 The OpenSSF Package Analysis project identified 'haefgerasgrae' @ 0.1.0 rubygems as malicious. It is considered malicious because: - The package...

RHSA-2024:11029 Red Hat Security Advisory: ruby:2.5 security update

Bulletin has no description...

RHSA-2024:11028 Red Hat Security Advisory: ruby:2.5 security update

Bulletin has no description...

RHSA-2024:11027 Red Hat Security Advisory: ruby:2.5 security update

Bulletin has no description...

RHSA-2024:11001 Red Hat Security Advisory: ruby:2.5 security update

Bulletin has no description...

RHSA-2024:10984 Red Hat Security Advisory: ruby:3.1 security update

Bulletin has no description...

RHSA-2024:10982 Red Hat Security Advisory: ruby:3.1 security update

Bulletin has no description...

RHSA-2024:10977 Red Hat Security Advisory: ruby security update

Bulletin has no description...

RHEL 8 : ruby:2.5 (RHSA-2024:11028)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:11028 advisory. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management task...

RHEL 8 : ruby:2.5 (RHSA-2024:11029)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:11029 advisory. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management task...

Important: Red Hat Security Advisory: ruby:2.5 security update

An update for the ruby:2.5 module is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.6 Telecommunications Update Service. Red Hat Product Security has rated this...

rexml: REXML ReDoS vulnerability

A flaw was found in the ReXML XML toolkit for Ruby. Parsing XML data containing a large number of digits between & and x...; in a hex numeric character reference &x...; can trigger a regular expression denial of service ReDoS condition, leading to a denial of service...

Important: Red Hat Security Advisory: ruby:2.5 security update

An update for the ruby:2.5 module is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.4 Telecommunications Update Service. Red Hat Product Security has rated this...