Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to differences in XML document namespace parsing between REXML and Nokogiri, implemented in xmlsecurity.rb. An attacker can bypass authentication via Signature Wrapping attack. Note:...

Ruby-saml allows a Libxml2 Canonicalization error to bypass Digest/Signature validation

Summary Ruby-saml up to and including 1.12.4, there is an authentication bypass vulnerability because of an issue at libxml2 canonicalization process used by Nokogiri for document transformation. That allows an attacker to be able to execute a Signature Wrapping attack. The vulnerability does not...

Ruby-saml has a SAML authentication bypass due to namespace handling (parser differential)

Summary Ruby-saml up to and including 1.12.4, there is an authentication bypass vulnerability because of an incomplete fix for CVE-2025-25292. ReXML and Nokogiri parse XML differently, the parsers can generate entirely different document structures from the same XML input. That allows an attacker...

ruby:fuzz_json: Heap-buffer-overflow in raise_parse_error

Detailed Report: https://oss-fuzz.com/testcase?key=5248084482523136 Project: ruby Fuzzing Engine: libFuzzer Fuzz Target: fuzzjson Job Type: libfuzzerasanruby Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x7d6f36204a8e Crash State: raiseparseerror jsonparseescapedstrin...

Security Bulletin: Multiple vulnerabilities in IBM Aspera Shares

Summary Multiple vulnerabilities were addressed in IBM Aspera Shares version 1.11.0. Vulnerability Details CVEID:CVE-2017-17718 DESCRIPTION: The Net::LDAP aka net-ldap gem before 0.16.0 for Ruby has Missing SSL Certificate Validation. CWE:CWE-295: Improper Certificate Validation CVSS Source: IBM...

Ruby resolv DoS

The vulnerability of the Ruby programming language’s resolv library is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service failures by using specially created DNS packets...

ruby:fuzz_iseq: Use-after-poison in rb_data_typed_object_zalloc

Detailed Report: https://oss-fuzz.com/testcase?key=6736371885867008 Project: ruby Fuzzing Engine: libFuzzer Fuzz Target: fuzziseq Job Type: libfuzzerasanruby Platform Id: linux Crash Type: Use-after-poison WRITE 8 Crash Address: 0x7d95a5dcf878 Crash State: rbdatatypedobjectzalloc ibfloadsetupbyte...

ruby:fuzz_prism: Stack-use-after-return in parser_lex

Project: https://github.com/ruby/ruby.git Detailed Report: https://oss-fuzz.com/testcase?key=6042597731926016 Project: ruby Fuzzing Engine: libFuzzer Fuzz Target: fuzzprism Job Type: libfuzzerasanruby Platform Id: linux Crash Type: Stack-use-after-return READ 8 Crash Address: 0x7426d3c8f400 Crash...

ruby:fuzz_regex: Crash in forward_search_range

Project: https://github.com/ruby/ruby.git Detailed Report: https://oss-fuzz.com/testcase?key=5968328821899264 Project: ruby Fuzzing Engine: libFuzzer Fuzz Target: fuzzregex Job Type: libfuzzerubsanruby Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x78f8318f0016 Crash State:...

ROS-20251203-19

Vulnerability in the Ruby programming language library that implements the MQTT protocol Rubygem MQTT is related to the lack of hostname validation. Exploitation of the vulnerability could allow A remote attacker to perform a man-in-the-middle attack...

SUSE SLED15: libruby2_5-2_5 / ruby2.5 / ruby2.5-devel / ruby2.5-devel-extra / etc (SUSE-SU-2025:4264-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4264-1 advisory. - CVE-2024-35221: Fixed remote DoS via YAML manifest bsc1225905 - CVE-2024-47220: Fixed HTTP request smuggling...

EUVD-2025-200264

Malicious code in pgresultinit RubyGems...

Malicious code in pg_result_init (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 007d07edb120233aab0539e4646e8b634d2a95e2df9e6179bb9b2b6eb90f5a97 The OpenSSF Package Analysis project identified 'pgresultinit' @ 2.0.9 rubygems as malicious. It is considered malicious because: - The package...

MAL-2025-191667 Malicious code in pg_result_init (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 007d07edb120233aab0539e4646e8b634d2a95e2df9e6179bb9b2b6eb90f5a97 The OpenSSF Package Analysis project identified 'pgresultinit' @ 2.0.9 rubygems as malicious. It is considered malicious because: - The package...

ruby:fuzz_iseq: Crash in RCLASS_EXT_READABLE

Project: https://github.com/ruby/ruby.git Detailed Report: https://oss-fuzz.com/testcase?key=5809393825546240 Project: ruby Fuzzing Engine: libFuzzer Fuzz Target: fuzziseq Job Type: libfuzzerubsanruby Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x0000000d210c Crash State:...

metasploit-framework

This is the Metasploit Framework repository, a widely used penetration testing tool. It is an offensive tool for penetration testing and vulnerability assessment. The repository contains various modules and tools for exploiting vulnerabilities and conducting penetration testing. The primary...

ruby:fuzz_prism: Heap-buffer-overflow in parse_pattern_primitives

Project: https://github.com/ruby/ruby.git Detailed Report: https://oss-fuzz.com/testcase?key=6490606307442688 Project: ruby Fuzzing Engine: afl Fuzz Target: fuzzprism Job Type: aflasanruby Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x7442892e00b5 Crash State:...

net-imap rubygem vulnerable to possible DoS by memory exhaustion

...

Mageia: Security Advisory (MGASA-2025-0311)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

metasploit-framework

This is the Metasploit Framework repository, a comprehensive collection of tools and resources for penetration testing and vulnerability assessment. The repository contains a wide range of modules, including exploits, payloads, and auxiliary tools, which can be used to test and exploit...