Code injection

In the Loofah gem for Ruby, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished...

UBUNTU-CVE-2018-16468

In the Loofah gem for Ruby, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished...

CVE-2018-16468

In the Loofah gem for Ruby, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished...

CVE-2018-16468

In the Loofah gem for Ruby, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished...

PT-2018-2643

Name of the Vulnerable Software and Affected Versions Loofah gem for Ruby versions through 2.2.2 Description The issue is related to insufficient sanitization of SVG elements in JavaScript, which can lead to the occurrence of unsanitized JavaScript in sanitized output when a crafted SVG element i...

Loofah XSS Vulnerability

In the Loofah gem, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished...

Loofah -- XSS vulnerability

GitHub issue: This issue has been created for public disclosure of an XSS vulnerability that was responsibly reported independently by Shubham Pathak and @yasinS Yasin Soliman. In the Loofah gem, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is...

Incorrect equality check in OpenSSL::X509::Name

The equality check of OpenSSL::X509::Name is not correctly in openssl extension library bundled with Ruby. An instance of OpenSSL::X509::Name contains entities such as CN, C and so on. Some two instances of OpenSSL::X509::Name are equal only when all entities are exactly equal. However, there is ...

Command injection

The karo gem 2.3.8 for Ruby allows Remote command injection via the host field...

CVE-2014-10075

The karo gem 2.3.8 for Ruby allows Remote command injection via the host field...

CVE-2014-10075

The karo gem 2.3.8 for Ruby allows Remote command injection via the host field...

CVE-2014-10075

CVE-2014-10075 affects the Ruby karo gem (v2.3.8) and enables Remote command injection via the host field. The flaw resides in db.rb where metacharacters are mishandled, allowing an attacker to execute arbitrary commands (examples show building and executing a shell command with unsanitized input...

Rubyzip gem contains a Directory Traversal vulnerability in zip file component

rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , an attacker can upload a malicious file...

GHSA-W655-W578-99PQ High severity vulnerability that affects espeak-ruby

Withdrawn, accidental duplicate publish. The espeak-ruby gem before 1.0.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the speak, save, bytes or byteswav method in lib/espeak/speech.rb...

The vulnerability of the active-support gem for the Ruby programming language, which allows a hacker to execute arbitrary code.

The vulnerability of the active-support gem for the Ruby programming language is related to the use of hidden malicious code. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

GHSA-9WV8-JGW4-4G28 High severity vulnerability that affects festivaltts4r

Withdrawn, accidental duplicate publish. The festivaltts4r gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the 1 tospeech or 2 tomp3 method in lib/festivaltts4r/festival4r.rb...

GHSA-9WCM-RRVH-QJC8 High severity vulnerability that affects colorscore

Withdrawn, accidental duplicate publish. The initialize method in the Histogram class in lib/colorscore/histogram.rb in the colorscore gem before 0.0.5 for Ruby allows context-dependent attackers to execute arbitrary code via shell metacharacters in the 1 imagepath, 2 colors, or 3 depth variable...

GHSA-5P9F-55J8-922M Moderate severity vulnerability that affects doorkeeper

Withdrawn, accidental duplicate publish. The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging failure to implement the OAuth 2.0 Token Revocation specification...

Moderate severity vulnerability that affects doorkeeper

Withdrawn, accidental duplicate publish. The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging failure to implement the OAuth 2.0 Token Revocation specification...

GHSA-PHMW-PV3F-VVX7 Moderate severity vulnerability that affects paperclip

Withdrawn, accidental duplicate publish. The thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type value during media-type validation, which allows remote attackers to upload HTML documents and conduct cross-site scripting XSS attacks via a spoofed value, as demonstrat...