CVE-2013-0175

multixml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service memory and CPU consumption involvin...

CVE-2013-0233

Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass...

CVE-2013-1947

kelredd-pruview gem 0.3.8 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument to 1 document.rb, 2 video.rb, or 3 videoimage.rb...

CVE-2013-0233

Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass...

CVE-2013-1948

converter.rb in the md2pdf gem 0.0.1 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename...

CVE-2013-0175

multixml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service memory and CPU consumption involvin...

CVE-2013-1948

The CVE-2013-1948 issue affects the md2pdf Ruby gem (version 0.0.1) where converter.rb passes user input directly to shell commands, allowing a context-dependent attacker to inject shell metacharacters in a filename and execute arbitrary commands. This is a remote command-injection vulnerability ...

CVE-2013-0233

CVE-2013-0233 concerns the Devise gem for Ruby. Affected versions (2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4) may mishandle type conversion during database queries when used with certain databases, potentially allowing remote attackers to obtain incorrect ...

CVE-2013-0233

Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass...

CVE-2013-0175

CVE-2013-0175 affects the multi_xml gem (v0.5.2) used by Grape prior to v0.2.6. The vulnerability stems from improper restriction of string casts, allowing remote object-injection and potential code execution, or DoS via nested XML entity refs, leveraging YAML type conversion or Symbol type conve...

CVE-2013-1947

CVE-2013-1947 concerns the kelredd-pruview Ruby gem (version 0.3.8) where a flaw in /lib/pruview/document.rb (and related code handling document.rb, video.rb, and video_image.rb) allows a context-dependent attacker to execute arbitrary commands via shell metacharacters injected into a filename ar...

PT-2013-3482

Name of the Vulnerable Software and Affected Versions kelredd-pruview gem version 0.3.8 Description The issue allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument to files such as document.rb, video.rb, or video image.rb. Recommendations...

PT-2013-2146

Name of the Vulnerable Software and Affected Versions multi xml gem version 0.5.2 Grape versions prior to 0.2.6 Description The issue allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service involving nested XML entity references. This c...

Ruby Gem md2pdf Command Injection Vulnerability

Ruby Gem md2pdf suffers from a remote command injection vulnerability. Remote command injection md2pdf ruby gem 4/10/2013 Description: "creates pdf documents from markdown documents" https://rubygems.org/gems/md2pdf In md2pdf/converter.rb we see user supplied input being passed to the command lin...

Ruby Gem md2pdf Command Injection

Remote command injection md2pdf ruby gem 4/10/2013 Description: "creates pdf documents from markdown documents" https://rubygems.org/gems/md2pdf In md2pdf/converter.rb we see user supplied input being passed to the command line with out proper sanitization. 12 shell.exec"pandocoptions inputfilena...

Ruby Gem kelredd-pruview 0.3.8 Command Injection Vulnerability

Ruby Gem kelredd-pruview version 0.3.8 suffers from a remote command injection vulnerability. Remote command injection in Ruby Gem kelredd-pruview 0.3.8 Larry W. Cashdollar 4/4/2013 @larry0 Description: "A gem to ease generating image previews thumbnails of various files."...

Ruby Gem kelredd-pruview 0.3.8 Command Injection

Remote command injection in Ruby Gem kelredd-pruview 0.3.8 Larry W. Cashdollar 4/4/2013 @larry0 Description: "A gem to ease generating image previews thumbnails of various files." https://rubygems.org/gems/kelredd-pruview Remote commands can be executed if the file name contains shell meta...

Ruby Gem Karteek Docsplit 0.5.4 Command Injection Vulnerability

Ruby Gem Karteek Docsplit version 0.5.4 fails to sanitize user-supplied input. If a user is tricked into extracting a file with shell characters in the name, code can be executed remotely. Remote Command Injection Ruby Gem Karteek Docsplit 0.5.4 4/1/2013 Larry W. Cashdollar @larry0 User supplied...

Ruby Gem Karteek Docsplit 0.5.4 Command Injection

Remote Command Injection Ruby Gem Karteek Docsplit 0.5.4 4/1/2013 Larry W. Cashdollar @larry0 User supplied input isn't sanitized against shell metacharacters and is fed directly to the shell. If the user is tricked into extracting a file with shell characters in the name code can be executed...

CVE-2013-1802

The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service memory and CPU consumption by leveraging Action Pack support for 1 YAML typ...