CVE-2022-28481

CSV-Safe gem 3.0.0 doesn't filter out special characters which could trigger CSV Injection...

CVE-2022-28481

CSV-Safe gem 3.0.0 doesn't filter out special characters which could trigger CSV Injection...

Input validation

CSV-Safe gem 3.0.0 doesn't filter out special characters which could trigger CSV Injection...

CVE-2022-28481

CSV-Safe gem 3.0.0 doesn't filter out special characters which could trigger CSV Injection...

CVE-2022-28481

CSV-Safe gem 3.0.0 doesn't filter out special characters which could trigger CSV Injection...

CVE-2022-28481

CVE-2022-28481 affects the CSV-Safe Ruby gem prior to 3.0.0, which does not filter out characters that can trigger CSV/Formula Injection in exported CSV files. This is supported by multiple sources (e.g., Red Hat advisory, RubySec/RUBYGEMS notes, OSV/NVD records). Affected component: CSV-Safe gem...

CSV-Safe gem 安全漏洞

The CSV-Safe gem is a library to prevent CSV injection attacks. A security vulnerability exists in versions of the CSV-Safe gem prior to 3.0.0 that stems from not however filtering out special characters that could trigger CSV injection...

GSD-2022-1002121 drm/i915/gem: add missing boundary check in vm_access

drm/i915/gem: add missing boundary check in vmaccess This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.110 by commit...

GSD-2022-1001898 drm/i915/gem: add missing boundary check in vm_access

drm/i915/gem: add missing boundary check in vmaccess This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.33 by commit...

RubyGems passenger gem allows remote attackers to delete files

RubyGems passenger 4.0.0 betas 1 and 2 allows remote attackers to delete arbitrary files during the startup process. Affects both open source and Enterprise versions 4.0.0.beta1, 4.0.0.beta2...

The vulnerability of the vgem_gem_dumb_create function in Linux kernel allows a hacker to execute arbitrary code.

The vulnerability of the vgemgemdumbcreate function in Linux kernel relates to the use of memory after deallocation. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

Regular Expression Denial of Service (ReDoS)

Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS due to an expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Details Denial...

AZL-10552 CVE-2022-24795 affecting package rubygem-yajl-ruby for versions less than 1.3.1-2

yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of yajl contain an integer overflow which leads to subsequent heap memory corruption when dealing with large 2GB inputs. The reallocation logic at yajlbuf.cL64 may result in the need 32bit...

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in view_component

This is an XSS vulnerability that has the potential to impact anyone using translations with the viewcomponent gem. Data received via user input and passed as an interpolation argument to the translate method is not properly sanitized before display. Versions 2.29.1 and 2.49.1 have been released...

GHSA-CM9W-C4RJ-R2CF Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in view_component

This is an XSS vulnerability that has the potential to impact anyone using translations with the viewcomponent gem. Data received via user input and passed as an interpolation argument to the translate method is not properly sanitized before display. Versions 2.29.1 and 2.49.1 have been released...

XSS via `translate` method of `ViewComponent::Translatable` in view_component gem

This is an XSS vulnerability that has the potential to impact anyone using translations with the viewcomponent gem. Data received via user input and passed as an interpolation argument to the translate method is not properly sanitized before display. Versions 2.31.2 and 2.49.1 have been released...

rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source

A flaw was found in the way Bundler determined the source repository when installing dependencies of source-restricted gem packages. In configurations that use multiple gem repositories and explicitly define from which source repository certain gems are to be installed, a dependency of a...

rubygem-json: Unsafe object creation vulnerability in JSON

A flaw was found in rubygem-json. While parsing certain JSON documents, the json gem including the one bundled with Ruby can be coerced into creating arbitrary objects in the target system. This is the same issue as CVE-2013-0269...

rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source

A flaw was found in the way Bundler determined the source repository when installing dependencies of source-restricted gem packages. In configurations that use multiple gem repositories and explicitly define from which source repository certain gems are to be installed, a dependency of a...

rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source

A flaw was found in the way Bundler determined the source repository when installing dependencies of source-restricted gem packages. In configurations that use multiple gem repositories and explicitly define from which source repository certain gems are to be installed, a dependency of a...