CVE-2013-2616

lib/minimagick.rb in the MiniMagick Gem 1.3.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL...

CVE-2013-2616: Improper Control of Generation of Code

lib/minimagick.rb in the MiniMagick Gem 1.3.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL...

CVE-2013-2615: Improper Control of Generation of Code

lib/entrycontroller.rb in the fastreader Gem 1.0.8 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL...

PT-2013-3856

Name of the Vulnerable Software and Affected Versions MiniMagick Gem version 1.3.1 Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in a URL. This is possible due to a flaw in the lib/mini magick.rb file of the MiniMagick Gem for Ruby...

CVE-2013-2617: Improper Control of Generation of Code

lib/curl.rb in the Curl Gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL...

PT-2013-3857

Name of the Vulnerable Software and Affected Versions Curl Gem for Ruby affected versions not specified Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in a URL. This is possible due to a flaw in lib/curl.rb within the Curl Gem for Ruby...

PT-2013-3855

Name of the Vulnerable Software and Affected Versions fastreader Gem version 1.0.8 Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in a URL, potentially triggered by specially crafted input containing a ';' character. This may enable a...

PT-2013-3416

Name of the Vulnerable Software and Affected Versions Moodle versions prior to 2.1.11 Moodle versions 2.2.x prior to 2.2.8 Moodle versions 2.3.x prior to 2.3.5 Moodle versions 2.4.x prior to 2.4.2 Description The issue allows remote attackers to obtain sensitive information via an invalid request...

java-1_6_0-openjdk: update to icedtea 1.12.3 (important)

java-160-openjdk was updated to IcedTea 1.12.3 bnc804654 containing security and bugfixes: Security fixes - S8006446: Restrict MBeanServer access CVE-2013-1486 - S8006777: Improve TLS handling of invalid messages Lucky 13 CVE-2013-0169 - S8007688: Blacklist known bad certificate issued by DigiCer...

java-1_6_0-openjdk: update to icedtea 1.12.3 (important)

java-160-openjdk was updated to IcedTea 1.12.3 bnc804654 containing security and bugfixes: Security fixes - S8006446: Restrict MBeanServer access CVE-2013-1486 - S8006777: Improve TLS handling of invalid messages Lucky 13 CVE-2013-0169 - S8007688: Blacklist known bad certificate issued by DigiCer...

CVE-2013-0162

The diffpp function in lib/gauntletrubyparser.rb in the rubyparser gem 3.1.1 and earlier for Ruby allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp...

CVE-2012-6109

lib/rack/multipart.rb in Rack before 1.1.4, 1.2.x before 1.2.6, 1.3.x before 1.3.7, and 1.4.x before 1.4.2 uses an incorrect regular expression, which allows remote attackers to cause a denial of service infinite loop via a crafted Content-Disposion header...

CVE-2012-6109: Undefined Security Weakness

lib/rack/multipart.rb in Rack before 1.1.4, 1.2.x before 1.2.6, 1.3.x before 1.3.7, and 1.4.x before 1.4.2 uses an incorrect regular expression, which allows remote attackers to cause a denial of service infinite loop via a crafted Content-Disposion header...

CVE-2013-0162: Undefined Security Weakness

The diffpp function in lib/gauntletrubyparser.rb in the rubyparser gem 3.1.1 and earlier for Ruby allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp...

SuSE 11.2 Security Update : Java (SAT Patch Number 7385)

java-160-openjdk has been updated to IcedTea 1.12.3 bnc804654 which contains security and bugfixes : - Security fixes - S8006446: Restrict MBeanServer access. CVE-2013-1486 - S8006777: Improve TLS handling of invalid messages Lucky 13. CVE-2013-0169 - S8007688: Blacklist known bad certificate...

PT-2013-1473

Name of the Vulnerable Software and Affected Versions OrangeHRM versions prior to 2.6.11.2 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the uniqcode or isAdmin parameter to "index.php", or the PATH INFO to...

CVE-2013-0333

lib/activesupport/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication v...

CVE-2013-0333: Undefined Security Weakness

lib/activesupport/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication v...

CVE-2012-6088

The rpmpkgRead function in lib/package.c in RPM 4.10.x before 4.10.2 does not return an error code in certain situations involving an "unparseable signature," which allows remote attackers to bypass RPM signature checks via a crafted package...

CVE-2012-6088: Undefined Security Weakness

The rpmpkgRead function in lib/package.c in RPM 4.10.x before 4.10.2 does not return an error code in certain situations involving an "unparseable signature," which allows remote attackers to bypass RPM signature checks via a crafted package...