Ubuntu: Security Advisory (USN-7366-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-7664-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OPENSUSE-SU-2025:15382-1 ruby3.4-rubygem-thor-1.4.0-1.1 on GA media

These are all security issues fixed in the ruby3.4-rubygem-thor-1.4.0-1.1 package on the GA media of openSUSE Tumbleweed...

ROS-20250724-06

A vulnerability in the Ruby websocket-extensions module that supports the implementation of WebSocket extensions is related to spending quadratic time parsing a header containing an unclosed string parameter value, which is a repeating two-byte sequence of backslash and some of backslash and some...

GHSA-353F-X4GH-CQQ8 vulnerabilities

Vulnerabilities for packages: logstash, ruby3.3-rails, gitlab-rails-ce-fips, gitlab-rails-ce, ruby3.2-rails, ruby3.4-rails...

Ubuntu: Security Advisory (USN-7659-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

AZL-65613 CVE-2025-54314 affecting package rubygem-thor 1.2.1-1

Thor before 1.4.0 can construct an unsafe shell command from library input. NOTE: this is disputed by the Supplier because "the method that was fixed can only be used with arguments that are controlled by Thor, and there is no way an attacker can take control of those arguments."...

Thor operating system command injection vulnerability

Thor is a Ruby on Rails open source toolkit for building command line interfaces. An operating system command injection vulnerability exists in versions of Thor prior to 1.4.0, which stems from constructing insecure shell commands from library input and could lead to command injection...

CVE-2025-49828

Conjur provides secrets management and application identity for infrastructure. Conjur OSS versions 1.19.5 through 1.21.1 and Secrets Manager, Self-Hosted formerly known as Conjur Enterprise 13.1 through 13.4.1 are vulnerable to remote code execution An authenticated attacker who can inject secre...

Ruby on Rails CSRF

The vulnerability of the Ruby on Rails software platform is related to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to remotely send CSRF tokens to incorrect domains...

Ruby on Rails Improper Authentication DoS

The vulnerability of the Ruby on Rails software platform is related to improper authentication. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures...

Ruby on Rails CSRF Token

The vulnerability of the Ruby on Rails software platform is related to the manipulation of inter-site requests in the authenticitytoken metagestion. Exploiting this vulnerability allows a malicious actor to forge the valid CSRF token remotely...

GHSA-XH69-987W-HRP8 vulnerabilities

Vulnerabilities for packages: jruby, ruby...

CVE-2025-24294 vulnerabilities

Vulnerabilities for packages: jruby, ruby...

GHSA-XH69-987W-HRP8 vulnerabilities

Vulnerabilities for packages: jruby, truffleruby, ruby...

CVE-2025-24294 vulnerabilities

Vulnerabilities for packages: jruby, truffleruby, ruby...

CVE-2025-6442 affecting package ruby for versions less than 3.1.7-2

CVE-2025-6442 affecting package ruby for versions less than 3.1.7-2. A patched version of the package is available...

CVE-2025-49828

Conjur provides secrets management and application identity for infrastructure. Conjur OSS versions 1.19.5 through 1.21.1 and Secrets Manager, Self-Hosted formerly known as Conjur Enterprise 13.1 through 13.4.1 are vulnerable to remote code execution An authenticated attacker who can inject secre...

CVE-2025-49828

Conjur provides secrets management and application identity for infrastructure. Conjur OSS versions 1.19.5 through 1.21.1 and Secrets Manager, Self-Hosted formerly known as Conjur Enterprise 13.1 through 13.4.1 are vulnerable to remote code execution An authenticated attacker who can inject secre...

Directory Traversal

Overview measured is a package containing wrapper objects which encapsulate measurements and their associated units in Ruby. Affected versions of this package are vulnerable to Directory Traversal when initializing the Measured::Cache::Json class. An attacker can access arbitrary files by supplyi...