CVE-2013-5647

lib/sounder/sound.rb in the sounder gem 1.0.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a filename...

CVE-2013-5647

CVE-2013-5647 affects the Ruby gem Sounder (library: lib/sounder/sound.rb) version 1.0.1. The vulnerability allows remote attackers to execute arbitrary commands via shell metacharacters in a filename, indicating a remote command execution flaw in file-name handling. Several sources (NVD, Red Hat...

Sounder Gem for Ruby File Name Handling Arbitrary Command Execution

Sounder Gem for Ruby contains a flaw that is triggered during the handling of file names. This may allow a context-dependent attacker to execute arbitrary commands...

Rgpg 0.2.2 Ruby Gem Remote Command Injection

Title: Rgpg 0.2.2 Ruby Gem Remote Command Injection Date: 7/31/2013 Advisory Author: Larry W. Cashdollar, @larry0 CVE: CVE-2013-4203 Download: https://rubygems.org/gems/rgpg Description: "A simple Ruby wrapper around gpg command for file encryption. rgpg is a simple API for interacting with the g...

rubygem-json: Denial of Service and SQL Injection

The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service resource consumption or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain...

rubygem-passenger: incorrect temporary file usage

Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service prevent application start or gain privileges by pre-creating a temporary "config" file in a directory with a predictable name in /tmp/ before it is used by the gem...

rubygem-passenger: insecure temporary directory usage due to reuse of existing server instance directories

ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/...

Ruby Gem Rgpg 0.2.2 Command Injection Vulnerability

Ruby Gem Rgpg version 0.2.2 suffers from a remote command injection vulnerability. Title: Rgpg 0.2.2 Ruby Gem Remote Command Injection Date: 7/31/2013 Advisory Author: Larry W. Cashdollar, @larry0 CVE: CVE-2013-4203 Download: https://rubygems.org/gems/rgpg Description: "A simple Ruby wrapper arou...

Ruby Gem Rgpg 0.2.2 Command Injection

Title: Rgpg 0.2.2 Ruby Gem Remote Command Injection Date: 7/31/2013 Advisory Author: Larry W. Cashdollar, @larry0 CVE: CVE-2013-4203 Download: https://rubygems.org/gems/rgpg Description: "A simple Ruby wrapper around gpg command for file encryption. rgpg is a simple API for interacting with the g...

rgpg Gem for Ruby lib/rgpg/gpg_helper.rb Remote Command Execution

rgpg Gem for Ruby contains a flaw in the GpgHelper module lib/rgpg/gpghelper.rb. The issue is due to the program failing to properly sanitize user-supplied input before being used in the system function for execution. This may allow a remote attacker to execute arbitrary commands...

Fedora 19 : ruby-2.0.0.247-14.fc19 (2013-12663)

Update to Ruby 2.0.0-p247 rhbz979605. - Fix RubyGems search paths when building gems with native extension. - Make symlinks for psych gem to ruby stdlib dirs. - Add support for ABRT autoloading. - Better support for build without configuration rhbz977941. - Use system-wide cert.pem. - Fixes...

rubygem-json: Denial of Service and SQL Injection

The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service resource consumption or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain...

Important: Red Hat Security Advisory: Fuse ESB Enterprise 7.1.0 update

Fuse ESB Enterprise 7.1.0 roll up patch 1, which fixes multiple security issues and various bugs, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores,...

PT-2014-2554 · Phusion · Phusion Passenger

Name of the Vulnerable Software and Affected Versions: Phusion Passenger gem versions 3.0.0 through 3.0.20 Phusion Passenger gem versions 4.0.0 through 4.0.4 Description: The issue allows local users to cause a denial of service or gain privileges by pre-creating a temporary config file in a...

Show In Browser 0.0.3 Ruby Gem File Injection Vulnerability

Show In Browser 0.0.3 is a Ruby Gem that suffers from a file injection vulnerability, allowing arbitrary text to be opened in a browser. TITLE: Show In Browser 0.0.3 Ruby Gem /tmp file injection vulnerability. DATE: 5/15/2023 AUTHOR: Larry W. Cashdollar @larry0 DOWNLOAD:...

Show In Browser Gem for Ruby /tmp/browser.html Arbitrary Script Injection

Show In Browser Gem for Ruby contains a flaw that is triggered when the application does not validate input passed via the /tmp/browser.html file. This may allow a local attacker to create a specially crafted request that would execute arbitrary script code in a user's browser...

Ruby Gem Creme Fraiche 0.6 Command Injection

TITLE: Remote command Injection in Creme Fraiche 0.6 Ruby Gem DATE: 5/14/2013 AUTHOR: Larry W. Cashdollar @larry0 DOWNLOAD: http://rubygems.org/gems/cremefraiche, http://www.uplawski.eu/technology/cremefraiche/ DESCRIPTION: Converts Email to PDF files. VENDOR: Notifed on 5/13/2013, provided fix...

Creme Fraiche Gem for Ruby File Name Shell Metacharacter Injection Arbitrary Command Execution

Creme Fraiche Gem for Ruby contains a flaw that is due to the program failing to properly sanitize input in file names. With a specially crafted file name that contains shell metacharacters, a context-dependent attacker can execute arbitrary commands...

Curl Ruby Gem Remote command execution

Curl Ruby Gem Remote command execution 3/12/2013 https://github.com/tg0/curl Specially crafted URLs can result in remote code execution: In ./lib/curl.rb the following lines: 131 cmd = "curl cookiesstore browsertype @setupparams ref "url" " 132 if @debug 133 puts cmd.red 134 end 135 result =...

Remote command execution in fastreader ruby gem

Ruby gem fastreader-1.0.8 remote code exec 3/6/2013 if the url contains any ; characters code will be executed as the user. for example if fastreader is fed http://www.g;id;.com id will be executed. ./fastreader-1.0.8/lib/entrycontroller.rb .strip only removes whitespace before and after the URL...