ROS-20251111-05

The vulnerability in the Ruby REXML XML toolkit is related to the fact that the application does not properly control the internal resource consumption when analyzing malformed XML code containing multiple XML declarations. Exploitation of the vulnerability could allow an attacker to cause a deni...

CVE-2025-64501: Improper Neutralization of Input During Web Page Generation

ProsemirrorToHtml is a JSON converter which takes ProseMirror-compatible JSON and outputs HTML. In versions 0.2.0 and below, the prosemirrortohtml gem is vulnerable to Cross-Site Scripting XSS attacks through malicious HTML attribute values. While tag content is properly escaped, attribute values...

Fedora: Security Advisory (FEDORA-2025-28a9cec027)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Critical Photon OS Security Update - PHSA-2025-4.0-0903

Updates of 'polkit', 'rubygem-yajl-ruby', 'curl', 'lasso' packages of Photon OS have been released...

[SECURITY] Fedora 43 Update: ruby-3.4.7-28.fc43

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks as in Perl. It is simple, straight-forward, and extensible...

Fedora 43 : ruby (2025-28a9cec027)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-28a9cec027 advisory. - Upgrade to Ruby 3.4.7. - Fix URI Credential Leakage Bypass previous fixes. Resolves: CVE-2025-61594 - Fix REXML denial of service. Resolves:...

Photon OS 5.0: Ruby PHSA-2025-5.0-0672

An update of the ruby package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-0672. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Important Photon OS Security Update - PHSA-2025-5.0-0672

Updates of 'unbound', 'git-lfs', 'vim', 'ruby', 'libarchive', 'glib' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2025-5.0-91-0672

Updates of 'git-lfs', 'libarchive', 'unbound', 'glib', 'vim', 'ruby' packages of Photon OS have been released...

GHSA-9C5Q-W6GR-FXCQ MQTT does not validate hostnames

A flaw was found in Rubygem MQTT. By default, the package used to not have hostname validation, resulting in possible Man-in-the-Middle MITM attack...

MQTT does not validate hostnames

A flaw was found in Rubygem MQTT. By default, the package used to not have hostname validation, resulting in possible Man-in-the-Middle MITM attack...

RLSA-2025:19719 Important: pcs security update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fixes: rubygem-rack: Rack QueryParser has an unsafe default allowing paramslimit bypass via semicolon-separated parameters CVE-2025-59830 rack: Rack's unbounded multipart preamble...

Important: Red Hat Security Advisory: pcs security update

An update for pcs is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

rack: Rack memory exhaustion denial of service

A denial of service flaw has been found in the rubygems rack package. Rack::Multipart::Parser can accumulate unbounded data when a multipart part’s header block never terminates with the required blank line CRLFCRLF. The parser keeps appending incoming bytes to memory without a size cap, allowing...

Debian: Security Advisory (DSA-6048-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ALSA-2025:19719 Important: pcs security update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fixes: rubygem-rack: Rack QueryParser has an unsafe default allowing paramslimit bypass via semicolon-separated parameters CVE-2025-59830 rack: Rack's unbounded multipart preamble...

[SECURITY] [DSA 6048-1] ruby-rack security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6048-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff November 03, 2025 https://www.debian.org/security/faq -...

CVE-2025-37727 vulnerabilities

Vulnerabilities for packages: ruby3.2-elasticsearch, ruby3.3-elasticsearch, ruby3.4-elasticsearch...

GHSA-56R7-H6MW-RCFV vulnerabilities

Vulnerabilities for packages: conductor, commercial-elasticsearch, camunda-zeebe, ruby3.4-elasticsearch, ruby3.2-elasticsearch, ruby3.3-elasticsearch, conductor-fips, camunda, elasticsearch-fips, ranger...

Debian: Security Advisory (DLA-4357-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...