19070 matches found
NULL Pointer Dereference
Amendment This was deemed not a vulnerability. Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to NULL Pointer Dereference via the XML parsing process. An attacker can cause denial of service or memory corruption by submitting...
NULL Pointer Dereference
Amendment This was deemed not a vulnerability. Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to NULL Pointer Dereference via the XML Schema processing in the packaged libxml2 library. An attacker can cause a segmentation fault...
Out-of-bounds Read
Amendment This was deemed not a vulnerability. Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to Out-of-bounds Read via the xmlSchemaIDCFillNodeTables function. An attacker can cause a denial of service by submitting specially...
UBUNTU-CVE-2026-79769
Nokogiri versions before 1.19.4 contain a possible invalid out-of-bounds memory read in the protected internal Nodeinitializecopywithargs helper behind Nodedup and clone, which unwrapped its source argument as an xmlNode without a type check. If application code calls this protected method with a...
UBUNTU-CVE-2026-79771
Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling...
UBUNTU-CVE-2023-54354
Nokogiri before 1.14.3 CRuby implementation only, when using the packaged libxml2 bundles libxml2 v2.10.3, which is vulnerable to NULL pointer dereferences in XML Schema processing xmlSchemaFixupComplexType, CVE-2023-28484, and xmlSchemaCheckCOSSTDerivedOK. An attacker who supplies a...
PT-2026-85150
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-v2fc-qm4h-8hqv. This link is maintained to preserve external references. Original Description Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby...
CVE-2026-44476: Improper Authentication
Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's clientid, which is public information, can authenticate as that client at the token endpoint and obtain an access token without providing its clientsecret. This occu...
CVE-2026-79771: Missing Release of Memory after Effective Lifetime
Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling...
MiracleLinux 9 : ruby:3.3 (AXSA:2026-1647:01)
The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1647:01 advisory. zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader CVE-2026-27820 net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF...
Malicious code in ultra-safe-box (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in ultra-pure-mod (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in ultra-fast-rb (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in ultra-max-pkg (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in tiny-sharp-pkg (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in tiny-safe-sys (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in tiny-pure-box (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in tiny-pro-rb (RubyGems)
--- -= Per source details. Do not edit below this line.=-...