Debian: Security Advisory (DLA-3264-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 3264-1] ruby-sinatra security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3264-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb January 10, 2023 https://wiki.debian.org/LTS -...

Debian dla-3264 : ruby-rack-protection - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3264 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3264-1 [email protected] https://www.debian.org/lts/security/...

DLA-3264-1 ruby-sinatra - security update

Bulletin has no description...

GHSA-PFPR-3463-C6JH ruby-git has potential remote code execution vulnerability

The git gem, between versions 1.2.0 and 1.12.0, incorrectly parsed the output of the git ls-files command using eval to unescape quoted file names. If a file name was added to the git repository contained special characters, such as \n, then the git ls-files command would print the file name in...

Remote Code Execution (RCE)

Overview git is a Ruby library that can be used to create, read and manipulate Git repositories by wrapping system calls to the git binary. Affected versions of this package are vulnerable to Remote Code Execution RCE due to the usage of the insecure eval function in the lsfiles method, which...

Huawei EulerOS: Security Advisory for ruby (EulerOS-SA-2023-1056)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RedditOnRails 访问控制错误漏洞

RedditOnRails is a Reddit-like site built on Ruby on Rails. An access control error vulnerability exists in RedditOnRails, which stems from incorrect access control...

OESA-2023-1003 ruby security update

Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks such as Perl. Security Fixes: The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP...

EulerOS Virtualization 3.0.2.6 : ruby (EulerOS-SA-2023-1056)

According to the versions of the ruby packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV...

Multiple code injection vulnerabilities in ruby-git

Overview ruby-git is a Ruby library that can be used to create, read and operate Git repositories. ruby-git contains multiple code injection vulnerabilities CWE-94. Yuki Kokubun of DeNA Co., Ltd. reported these vulnerabilities to IPA. JPCERT/CC coordinated with the developer under Information...

JVN#16765254: Multiple code injection vulnerabilities in ruby-git

ruby-git is a Ruby library that can be used to create, read and operate Git repositories. ruby-git contains multiple code injection vulnerabilities CWE-94. Impact If a repository containing a specially crafted filename is loaded to the product, an arbitrary ruby code may be executed. Solution...

Potential remote code execution in ruby-git

The git gem, between versions 1.2.0 and 1.12.0, incorrectly parsed the output of the 'git ls-files' command using eval to unescape quoted file names. If a file name was added to the git repository contained special characters, such as '\n', then the 'git ls-files' command would print the file nam...

httparty has multipart/form-data request tampering vulnerability

Impact I found "multipart/form-data request tampering vulnerability" caused by Content-Disposition "filename" lack of escaping in httparty. httparty/lib/httparty/request body.rb def generatemultipart...

GHSA-5PQ7-52MG-HR42 httparty has multipart/form-data request tampering vulnerability

Impact I found "multipart/form-data request tampering vulnerability" caused by Content-Disposition "filename" lack of escaping in httparty. httparty/lib/httparty/request body.rb def generatemultipart...

Cross-site Scripting (XSS)

Overview keynote is a package that provides a consistent interface for defining and instantiating presenters. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the attrstos function in lib/keynote/rumble.rb, which does not escape quote marks in attribute strings...

Arbitrary Command Injection

Overview printer is a module for sending commands to a small thermal printer Affected versions of this package are vulnerable to Arbitrary Command Injection in the saveurltopath function in lib/printer/jobs/preparepage.rb. Remediation A fix was pushed into the master branch but not yet published...

Debian: Security Advisory (DSA-5310-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DSA 5310-1] ruby-image-processing security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5310-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso December 31, 2022 https://www.debian.org/security/faq -...

Debian DSA-5310-1 : ruby-image-processing - security update

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dsa-5310 advisory. It was discovered that ruby-image-processing, a ruby package that provides higher-level image processing helpers, is prone to a remote shell execution vulnerability when...