39 matches found
SUSE CVE-2019-16255
Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument aka the "command" argument to Shell or Shelltest in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method...
GHSA-GWRJ-88FP-5M36 Code injection in Narou
Narou aka Narou.rb before 3.8.0 allows Ruby Code Injection via the title name or author name of a novel...
CVE-2021-35514
Narou aka Narou.rb before 3.8.0 allows Ruby Code Injection via the title name or author name of a novel...
CVE-2021-35514
Narou aka Narou.rb before 3.8.0 allows Ruby Code Injection via the title name or author name of a novel...
CVE-2021-35514
Narou aka Narou.rb before 3.8.0 allows Ruby Code Injection via the title name or author name of a novel...
CVE-2021-35514
Narou aka Narou.rb before 3.8.0 allows Ruby Code Injection via the title name or author name of a novel...
CVE-2021-35514
Narou (aka Narou.rb) up to version 3.8.0 is vulnerable to Ruby code injection via the title or author name fields of a novel. The underlying issue is untrusted code execution through these inputs, enabling code execution on the affected system. Affected software: Narou.rb (Ruby-based Narou). Root...
CVE-2021-35514
Narou aka Narou.rb before 3.8.0 allows Ruby Code Injection via the title name or author name of a novel...
CVE-2021-35514: Improper Control of Generation of Code
Narou aka Narou.rb before 3.8.0 allows Ruby Code Injection via the title name or author name of a novel...
PT-2021-20949
Name of the Vulnerable Software and Affected Versions: Narou aka Narou.rb versions prior to 3.8.0 Description: The issue allows Ruby Code Injection via the title name or author name of a novel. Recommendations: For versions prior to 3.8.0, update to version 3.8.0 or later to resolve the issue...
CVE-2021-32096
The ConsoleAction component of U.S. National Security Agency NSA Emissary 5.9.0 allows a CSRF attack that results in injecting arbitrary Ruby code for an eval call via the CONSOLECOMMANDSTRING parameter...
PT-2021-19664
Name of the Vulnerable Software and Affected Versions: Emissary version 5.9.0 Description: The issue allows for a CSRF attack, which can result in injecting arbitrary Ruby code via the CONSOLE COMMAND STRING parameter. This can lead to an eval call, potentially allowing an attacker to execute...
CVE-2021-32096: Cross-Site Request Forgery (CSRF)
The ConsoleAction component of U.S. National Security Agency NSA Emissary 5.9.0 allows a CSRF attack that results in injecting arbitrary Ruby code for an eval call via the CONSOLECOMMANDSTRING parameter...
ClusterLabs Hawk Code Injection Vulnerability
Clusterlabs Crmsh is a command line software for GNU/Linux systems for high availability cluster management from the ClusterLabs Clusterlabs team. A code injection vulnerability exists in ClusterLabs Hawk 2.x through 2.3.0-x, which stems from a Ruby code injection in hawkremembermeid in the...
EulerOS Virtualization 3.0.6.0 : ruby (EulerOS-SA-2020-1717)
According to the versions of the ruby packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in Oniguruma 6.x before 6.9.4rc2. In the function fetchintervalquantifier formerly known as...
DEBIAN-CVE-2019-16255
Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument aka the "command" argument to Shell or Shelltest in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method...
PT-2016-3337
Name of the Vulnerable Software and Affected Versions Bundler versions 1.x Description The issue is related to a gem name collision on a secondary source, which could allow remote attackers to inject arbitrary Ruby code into an application. This might lead to unauthorized access to confidential...
