GHSA-5CM2-9H8C-RVFX TZInfo relative path traversal vulnerability allows loading of arbitrary files

Impact Affected versions - 0.3.60 and earlier. - 1.0.0 to 1.2.9 when used with the Ruby data source tzinfo-data. Vulnerability With the Ruby data source the tzinfo-data gem for tzinfo version 1.0.0 and later and built-in to earlier versions, time zones are defined in Ruby files. There is one file...

CVE-2022-31163

CVE-2022-31163 affects the TZInfo Ruby library. The vulnerability arises when TZInfo::Timezone.get validates time zone identifiers, allowing a newline in the identifier to cause relative path traversal and, with Ruby 1.9.3+, loading unintended files via require. Affected versions are TZInfo prior...

CVE-2022-31163 TZInfo relative path traversal vulnerability allows loading of arbitrary files

TZInfo is a Ruby library that provides access to time zone data and allows times to be converted using time zone rules. Versions prior to 0.36.1, as well as those prior to 1.2.10 when used with the Ruby data source tzinfo-data, are vulnerable to relative path traversal. With the Ruby data source,...

CVE-2022-31163 TZInfo relative path traversal vulnerability allows loading of arbitrary files

TZInfo is a Ruby library that provides access to time zone data and allows times to be converted using time zone rules. Versions prior to 0.36.1, as well as those prior to 1.2.10 when used with the Ruby data source tzinfo-data, are vulnerable to relative path traversal. With the Ruby data source,...

CVE-2022-31163 TZInfo relative path traversal vulnerability allows loading of arbitrary files

TZInfo is a Ruby library that provides access to time zone data and allows times to be converted using time zone rules. Versions prior to 0.36.1, as well as those prior to 1.2.10 when used with the Ruby data source tzinfo-data, are vulnerable to relative path traversal. With the Ruby data source,...

CVE-2022-31163

TZInfo is a Ruby library that provides access to time zone data and allows times to be converted using time zone rules. Versions prior to 0.36.1, as well as those prior to 1.2.10 when used with the Ruby data source tzinfo-data, are vulnerable to relative path traversal. With the Ruby data source,...

The vulnerability of the `hash_new_from_values()` function in the Ruby Mruby interpreter allows a attacker to cause a service failure or execute arbitrary code.

The vulnerability of the hashnewfromvalues function in the Ruby Mruby interpreter is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure or execute arbitrary code...

PT-2022-20578 · Tzinfo +3 · Tzinfo +3

Name of the Vulnerable Software and Affected Versions: TZInfo versions prior to 0.3.61 TZInfo versions 1.0.0 to 1.2.9 when used with the Ruby data source TZInfo version 0.3.60 and earlier Description: The issue is related to relative path traversal in the TZInfo Ruby library, which provides acces...

TZInfo relative path traversal vulnerability allows loading of arbitrary files

Impact Affected versions - 0.3.60 and earlier. - 1.0.0 to 1.2.9 when used with the Ruby data source tzinfo-data. Vulnerability With the Ruby data source the tzinfo-data gem for tzinfo version 1.0.0 and later and built-in to earlier versions, time zones are defined in Ruby files. There is one file...

[Security Nation] Jacques Chester of Shopify Talks CVSS Scores

!\Security Nation\ Jacques Chester of Shopify Talks CVSS Scoreshttps://blog.rapid7.com/content/images/2022/07/securitynationlogo-1.jpg In this episode of Security Nation, Shopify Senior Staff Software Developer Jacques Chester joins Jen and Tod to discuss his intriguing paper on CVSS scores and t...

Fedora: Security Advisory for godotenv (FEDORA-2022-3969b64d4b)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Denial Of Service (DoS)

ruby-apollo-upload-server is vulnerable to Denial Of Service vulnerability. The vulnerability exists in the apollouploadserver which allows an attacker to deny access to all users via specially crafted requests to the apollouploadserver middleware...

[SECURITY] Fedora 35 Update: golang-github-sourcegraph-syntaxhighlight-0-0.11.20180418gitbd320f5.fc35

Syntaxhighlight provides syntax highlighting for code. It currently uses a language-independent lexer and performs decently on JavaScript, Java, Ruby, Python, Go, and C...

[SECURITY] Fedora 35 Update: godotenv-1.4.0-4.fc35

A Go port of Ruby's dotenv library Loads environment variables from .env...

[SECURITY] Fedora 35 Update: exercism-3.0.13-8.fc35

Exercism provides a way to do the problems on https://exercism.io. This CLI ships as a binary with no additional run-time requirements. This mea ns that if you're doing the Haskell problems on exercism you don't need a working Python or Ruby environment simply to fetch and submit exercises...

OESA-2022-1752 rubygem-yajl-ruby security update

Ruby C bindings to the excellent Yajl JSON stream-based parser library. Security Fixes: yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of yajl contain an integer overflow which leads to subsequent heap memory corruption when dealing wit...

Remote Code Execution (RCE)

activerecord is vulnerable to Remote Code Execution RCE. Active Record uses YAML.unsafeload to convert the YAML data in to Ruby objects allowing an attacker who can manipulate data in the database to execute malicious code remotely...

Remote Code Execution (RCE)

Overview activerecord is a library for databases on Rails. Affected versions of this package are vulnerable to Remote Code Execution RCE. When serialized columns that use YAML the default are deserialized, Rails uses YAML.unsafeload to convert the YAML data in to Ruby objects. If an attacker can...

The vulnerability of the actionpack plugin in the Ruby on Rails software platform allows attackers to execute XSS attacks.

The vulnerability of the actionpack plugin for the Ruby on Rails software platform exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

Active Record RCE bug with Serialized Columns

When serialized columns that use YAML the default are deserialized, Rails uses YAML.unsafeload to convert the YAML data in to Ruby objects. If an attacker can manipulate data in the database via means like SQL injection, then it may be possible for the attacker to escalate to an RCE. There are no...