4342 matches found
CVE-2013-1875: Improper Control of Generation of Code
commandwrap.rb in the commandwrap Gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL or filename...
PT-2013-3444
Name of the Vulnerable Software and Affected Versions command wrap Gem for Ruby affected versions not specified Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in a URL or filename. This is due to a problem in the command wrap.rb file within th...
PT-2013-3857
Name of the Vulnerable Software and Affected Versions Curl Gem for Ruby affected versions not specified Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in a URL. This is possible due to a flaw in lib/curl.rb within the Curl Gem for Ruby...
CVE-2013-2617: Improper Control of Generation of Code
lib/curl.rb in the Curl Gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL...
PT-2013-3855
Name of the Vulnerable Software and Affected Versions fastreader Gem version 1.0.8 Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in a URL, potentially triggered by specially crafted input containing a ';' character. This may enable a...
DEBIAN-CVE-2013-0913
Integer overflow in drivers/gpu/drm/i915/i915gemexecbuffer.c in the i915 driver in the Direct Rendering Manager DRM subsystem in the Linux kernel through 3.8.3, as used in Google Chrome OS before 25.0.1364.173 and other products, allows local users to cause a denial of service heap-based buffer...
Ruby Gem Fastreader 1.0.8 Code Execution
Ruby gem fastreader-1.0.8 remote code exec 3/6/2013 if the url contains any ; characters code will be executed as the user. for example if fastreader is fed http://www.g;id;.com id will be executed. ./fastreader-1.0.8/lib/entrycontroller.rb .strip only removes whitespace before and after the URL...
Ruby Gem Command Wrap Command Execution
Remote command execution in Ruby Gem Command Wrap 3/15/2013 http://rubygems.org/gems/commandwrap Commands executed if the remote URL or filename contains the shell character ';'. The commands will be executed as the client user if tricked into using the malicious URL or filename. Examining the...
Ruby Gem Curl Command Execution Vulnerability
Ruby Gem Curl suffers from a remote command execution vulnerability due to a lack of user input sanitization. Curl Ruby Gem Remote command execution 3/12/2013 https://github.com/tg0/curl Specially crafted URLs can result in remote code execution: In ./lib/curl.rb the following lines: 131 cmd =...
Ruby Gem Curl Command Execution
Curl Ruby Gem Remote command execution 3/12/2013 https://github.com/tg0/curl Specially crafted URLs can result in remote code execution: In ./lib/curl.rb the following lines: 131 cmd = "curl cookiesstore browsertype @setupparams ref "url" " 132 if @debug 133 puts cmd.red 134 end 135 result =...
Ruby Gem Minimagic Command Execution Vulnerability
Ruby Gem MiniMagic suffers from a remote command execution vulnerability due to a lack of user input sanitization. MiniMagic ruby gem remote code execution 3/12/2013 https://github.com/hcatlin/minimagick A ruby wrapper for ImageMagick or GraphicsMagick command line. Tested on both Ruby 1.9.2 and...
Ruby Gem Fastreader 1.0.8 Command Execution
Ruby gem fastreader-1.0.8 remote code exec 3/6/2013 https://rubygems.org/gems/fastreader if the url contains any ; characters code will be executed as the user when a web browser is launched. for example if fastreader is fed http://www.g;id;.com id will be executed...
Ruby Gem Minimagic Command Execution
MiniMagic ruby gem remote code execution 3/12/2013 https://github.com/hcatlin/minimagick A ruby wrapper for ImageMagick or GraphicsMagick command line. Tested on both Ruby 1.9.2 and Ruby 1.8.7. If a URL is from an untrusted source, commands can be injected into it for remote code execution with...
Ruby Gem Fastreader 1.0.8 Command Execution Vulnerability
Ruby Gem Fastreader version 1.0.8 suffers from a remote command execution vulnerability due to a lack of user input sanitization. Ruby gem fastreader-1.0.8 remote code exec 3/6/2013 https://rubygems.org/gems/fastreader if the url contains any ; characters code will be executed as the user when a...
CVE-2013-2617 rubygem-curl: insufficient URL escaping command injection
lib/curl.rb in the Curl Gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL...
MiniMagick Gem for Ruby URI Handling Arbitrary Command Injection
MiniMagick Gem for Ruby contains a flaw that is triggered during the handling of specially crafted input from an untrusted source passed via a URL that contains a ';' character. This may allow a context-dependent attacker to potentially execute arbitrary commands...
Fileutils ruby gem possible remote command execution and insecure file handling in /tmp
Fileutils ruby gem possible remote command execution and insecure file handling in /tmp 2/23/2013 Hi list, I was looking at some gem files and noticed a few issues with fileutils-0.7 http://rubygems.org/gems/fileutils "A set of utility classes to extract meta data from different file types"...
Ruby Gem ftpd-0.2.1 Remote Command Execution
Remote command execution for Ruby Gem ftpd-0.2.1 2/28/2013 https://github.com/wconrad/ftpd http://rubygems.org/gems/ftpd "ftpd is a pure Ruby FTP server library. It supports implicit and explicit TLS, passive and active mode, and most of the commands specified in RFC 969. It an be used as part of...
CVE-2013-0162
The diffpp function in lib/gauntletrubyparser.rb in the rubyparser gem 3.1.1 and earlier for Ruby allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp...