Reflective XSS Vulnerability in twitter-bootstrap-rails

The twitter-bootstrap-rails Gem for Rails contains a flaw that enables a reflected cross-site scripting XSS attack. This flaw exists because the bootstrapflash helper method does not validate input when handling flash messages before returning it to users. This may allow a context-dependent...

Ruby rack-ssl Gem错误页面跨站脚本漏洞

CVE ID：CVE-2014-2538 Ruby是跨平台、面向对象的动态类型编程语言。 由于某些关于错误页面的输入在返回用户前没有正确过滤，攻击者可以利用漏洞在受影响站点上下文的用户浏览器会话中执行任意HTML和脚本代码。 0 rack-ssl gem for Ruby 1.x rack-ssl gem for Ruby 1.4.0版本以修复此漏洞，建议用户下载使用： https://github.com/josh/rack-ssl/commit/9d7d7300b907e496db68d89d07fbc2e0df0b487b...

Ruby Gem Arabic Prawn 0.0.1 Command Injection Vulnerability

Arabic Prawn Ruby gem version 0.0.1 suffers from a remote command injection vulnerability. Title: Remote Command Injection in Arabic Prawn 0.0.1 Ruby Gem Author: Larry W. Cashdollar, @larry0 Download Site: http://rubygems.org/gems/Arabic-Prawn CVE: 2014-2322 Date: 12/17/2013 In...

Ruby Gem Arabic Prawn 0.0.1 Command Injection

Title: Remote Command Injection in Arabic Prawn 0.0.1 Ruby Gem Author: Larry W. Cashdollar, @larry0 Download Site: http://rubygems.org/gems/Arabic-Prawn CVE: 2014-2322 Date: 12/17/2013 In Arabic-Prawn-0.0.1/lib/stringutfsupport.rb, the following lines pass unsanitized input to the shell. 426 var ...

CVE-2013-4413

Directory traversal vulnerability in controller/concerns/renderredirect.rb in the Wicked gem before 1.0.1 for Ruby allows remote attackers to read arbitrary files via a %2E%2E%2F encoded dot dot slash in the step...

CVE-2013-4413

Directory traversal vulnerability in controller/concerns/renderredirect.rb in the Wicked gem before 1.0.1 for Ruby allows remote attackers to read arbitrary files via a %2E%2E%2F encoded dot dot slash in the step...

CVE-2013-4413

The Wicked gem for Ruby is affected by a directory traversal in controller/concerns/render_redirect.rb before version 1.0.1, where an attacker can read arbitrary files by sending a URL with encoded "../" sequences (via the_step parameter). Impact is reading arbitrary files; no exploitation detail...

Arabic Prawn Gem for Ruby lib/string_utf_support.rb User Input Handling Remote Command Injection

Arabic Prawn Gem for Ruby contains a flaw in the lib/stringutfsupport.rb file. The issue is due to the program failing to sanitize user input. This may allow a remote attacker to inject arbitrary commands. "lib/stringutfsupport.rb" in the Arabic Prawn 0.0.1 gem for Ruby allows remote attackers to...

Active Record: SQL injection

Background Active Record is a Ruby gem that allows database entries to be manipulated as objects. Description An Active Record method parameter can mistakenly be used as a scope. Impact A remote attacker could use specially crafted input to execute arbitrary SQL statements. Workaround The...

echor Gem for Ruby backplane.rb perform_request Function Arbitrary Command Execution

Echor Gem for Ruby contains a flaw in backplane.rb in the performrequest function that is triggered when a semi-colon ; is injected into a username or password. This may allow a context-dependent attacker to inject arbitrary commands if the gem is used in a rails application...

echor Gem for Ruby Process Listing Local Plaintext Credential Disclosure

echor Gem for Ruby contains a flaw that is due to the program exposing credential information in the system process listing. This may allow a local attacker to gain access to plaintext credential information...

CVE-2014-1234

The paratrooper-newrelic gem 1.0.1 for Ruby allows local users to obtain the X-Api-Key value by listing the curl process...

CVE-2014-1233

The paratrooper-pingdom gem 1.0.0 for Ruby allows local users to obtain the App-Key, username, and password values by listing the curl process...

CVE-2014-1233

The CVE-2014-1233 vulnerability affects the paratrooper-pingdom gem for Ruby (version 1.0.0). The exposed code path demonstrates that setup/teardown routines invoke curl to Pingdom API, passing App-Key and basic auth (username:password) in commands. This enables a local attacker to monitor the pr...

CVE-2014-1234

CVE-2014-1234 affects the paratrooper-newrelic gem (Ruby) v1.0.1. A local attacker can obtain the X-Api-Key by listing the curl process, due to leakage in the process tree. Impact is local exposure of the API key. Public patches or mitigations are not detailed in the provided documents; refer to ...

Command injection in Ruby Gem Webbynode 1.0.5.3

Title: Command injection in Ruby Gem Webbynode 1.0.5.3 Date: 11/11/2013 Author: Larry W. Cashdollar, @larry0 Download: http://rubygems.org/gems/webbynode Vulnerability Description: The following code located in: ./webbynode-1.0.5.3/lib/webbynode/notify.rb doesn't fully sanitize user supplied inpu...

[SECURITY] [DSA 2830-1] ruby-i18n security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2830-1 [email protected] http://www.debian.org/security/ Florian Weiemr December 30, 2013 http://www.debian.org/security/faq -...

Command injection vulnerability in Ruby Gem sprout 0.7.246

Title: Command injection vulnerability in Ruby Gem sprout 0.7.246 Date: 11/14/2013 Download: http://rubygems.org/gems/sprout, http://projectsprouts.org/ Vulnerability: The unpackzip function contains the following code: sprout-0.7.246/lib/sprout/archiveunpacker.rb 60 zipdir =...

Ruby will_paginate Gem跨站脚本漏洞

CVE ID:CVE-2013-6459 Ruby是跨平台、面向对象的动态类型编程语言。willpaginate是一个分页插件，提供将搜索结果进行分页显示的功能。 willpaginate gem for Ruby存在跨站脚本漏洞。远程攻击者可通过与生成的分页链接相关的输入利用该漏洞注入任意Web脚本或HTML。 0 willpaginate gem for Ruby 3.x 厂商补丁： Ruby ----- 厂商已经发布了升级补丁以修复此安全问题，补丁获取链接： https://github.com/mislav/willpaginate/releases/tag/v3.0.5...

UBUNTU-CVE-2013-2119

Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service prevent application start or gain privileges by pre-creating a temporary "config" file in a directory with a predictable name in /tmp/ before it is used by the gem...