Astra Linux – Vulnerability in Ruby 2.5

A buffer-overread issue was discovered in StringIO 3.0.1, which is available in Ruby 3.0.x through 3.0.6, and in Ruby 3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return the memory value. 3.0.3 is...

Astra Linux – Vulnerability in Ruby 2.5

A vulnerability was discovered in Ruby. The Ruby interpreter is vulnerable to the Marvin Attack. This attack allows the attacker to decrypt previously encrypted messages or forge signatures by exchanging a large number of messages with the vulnerable service...

Astra Linux – Vulnerability in Ruby-Nokogiri

A command injection vulnerability exists in Nokogiri v1.10.3 and earlier. This vulnerability allows commands to be executed in a subprocess via Ruby’s Kernel.open method. Processes become vulnerable only if the undocumented method Nokogiri::CSS::Tokenizerloadfile is called with unsafe user input ...

Astra Linux – Vulnerability in ruby-addressable

Addressable is an alternative implementation to the URI implementation that is part of Ruby’s standard library. A vulnerability related to uncontrolled resource consumption exists in versions 2.3.0 through 2.7.0. In the URI template implementation provided by Addressable, a maliciously crafted...

Astra Linux – Vulnerability in Ruby 2.5

The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allow HTTP response splitting. This is relevant for applications that use untrusted user input, either to generate an HTTP response or to create a CGI::Cookie object...

Astra Linux – Vulnerability in Ruby 2.5, JRuby

A issue was discovered in Ruby between versions 2.6.7, 2.7.x up to 2.7.3, and 3.x up to 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a specified IP address and port. This potentially allows curl to extract information about services that would...

Astra Linux – Vulnerability in Puma

Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate that the incoming HTTP requests comply with the RFC7230 standard, Puma and the frontend proxy may disagree about where the requests start and...

Astra Linux – Vulnerability in ruby-websocket-extensions

The websocket-extensions Ruby module before version 0.1.5 allowed Denial of Service DoS attacks through Regex backtracking. The extension parser could take quadratic time when parsing a header containing an unclosed string parameter value whose content was a repeated two-byte sequence of a...

Astra Linux – Vulnerability in Ruby 2.5

A issue was discovered in RDoc versions 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. When parsing .rdocoptions used for configuration in RDoc as a YAML file, object injection and resulting remote code execution are possible because there are no restrictions on the classes that c...

Astra Linux – Vulnerability in Ruby-Rack

There is a DoS vulnerability in Rack versions v3.0.4.2, v2.2.6.3, v2.1.4.3, and v2.0.9.3, particularly in the Multipart MIME parsing code. This vulnerability could allow an attacker to craft requests that can be abused to cause the multipart parsing to take longer than expected...

CVE-2023-46035

The svgoptimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents...

CVE-2023-46035

The svgoptimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents...

CVE-2023-46035

The svgoptimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents...

CVE-2023-46035: Improper Restriction of Recursive Entity References in DTDs

The svgoptimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents...

CVE-2023-46035

The svgoptimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents...

AlmaLinux 10 : ruby (ALSA-2026:50778)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:50778 advisory. zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader CVE-2026-27820 net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF...

PT-2026-91729

Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables...

CVE-2026-68489: Improper Neutralization of Directives in Statically Saved Code

Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables...

EUVD-2023-60669

The svgoptimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents...

CVE-2026-57579: Missing Authorization

Alchemy is an open source content management system engine written in Ruby on Rails. Prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6, the unauthenticated GET /api/pages/nested endpoint implemented by Api::PagesControllernested in app/controllers/alchemy/api/pagescontroller.rb returns an unfiltered pag...