4576 matches found
CVE-2024-39906
A command injection vulnerability was found in the IndieAuth functionality of the Ruby on Rails based Haven blog web application. The affected functionality requires authentication, but an attacker can craft a link that they can pass to a logged in administrator of the blog software. This leads t...
GHSA-G9JG-W8VM-G96V vulnerabilities
Vulnerabilities for packages: ruby3.4-rails, ruby3.2-rails, ruby3.3-rails...
GHSA-G9JG-W8VM-G96V vulnerabilities
Vulnerabilities for packages: ruby3.2-rails, ruby3.4-rails, ruby3.3-rails...
CVE-2026-22588
Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Authenticated Insecure Direct Object Reference IDOR vulnerability was identified that allows an authenticated user to retrieve other users’ address information by modifying ...
CVE-2026-22588 Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification
Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Authenticated Insecure Direct Object Reference IDOR vulnerability was identified that allows an authenticated user to retrieve other users’ address information by modifying ...
CVE-2025-59830 vulnerabilities
Vulnerabilities for packages: ruby3.4-rack, gitlab-rails-ce, ruby3.3-rack, ruby3.2-rack, ruby4.0-rack...
GHSA-625H-95R8-8XPM vulnerabilities
Vulnerabilities for packages: ruby3.4-rack, gitlab-rails-ce, ruby3.3-rack, ruby3.2-rack, ruby4.0-rack...
[SECURITY] [DLA 4416-1] rails security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-4416-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucariès December 21, 2025 https://wiki.debian.org/LTS -...
Debian dla-4416 : rails - security update
The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4416 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4416-1 [email protected]...
Malicious code in rails-structured-logging (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-192915 Malicious code in rails-structured-logging (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Debian: Security Advisory (DSA-6090-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Debian: Security Advisory (DLA-4416-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] [DSA 6090-1] rails security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6090-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff December 21, 2025 https://www.debian.org/security/faq -...
DSA-6090-1 rails - security update
Bulletin has no description...
DLA-4416-1 rails - security update
Bulletin has no description...
Debian dsa-6090 : rails - security update
The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6090 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6090-1 [email protected]...
EUVD-2025-203660
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down PC=3 According to UFS specifications, the power-off sequence for a UFS device includes: - Sending an SSU command with PowerCondition=3 and await a response. - Asserting...
Security Bulletin: Multiple vulnerabilities in IBM Aspera Shares
Summary Multiple vulnerabilities were addressed in IBM Aspera Shares version 1.11.0. Vulnerability Details CVEID:CVE-2017-17718 DESCRIPTION: The Net::LDAP aka net-ldap gem before 0.16.0 for Ruby has Missing SSL Certificate Validation. CWE:CWE-295: Improper Certificate Validation CVSS Source: IBM...