[SECURITY] Fedora 36 Update: godotenv-1.4.0-4.fc36

A Go port of Ruby's dotenv library Loads environment variables from .env...

Exploit for Command Injection in Rubyonrails Rails

PoC exploit for CVE-2019-5420, a Ruby deserialization vulnerabil...

Exploit for Improper Restriction of XML External Entity Reference in Zohocorp Manageengine_Adaudit_Plus

Code to support my CVE-2022-28219 analysishttps://attackerk...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data using YAML.load if the response is a YAML type. This is exploitable only if the attacker is in control of an opensearch server and convinces the victim to connect to it. Details Serialization is a proce...

Deserialization Of Untrusted Data

opensearch-ruby is vulnerable to deserialization of untrusted data. The vulnerability exists due to the unsafe deserialization of response.body data in YAML.load functionality in the verifyopensearch function of pensearch.rb...

Oracle Linux 8 : ruby:2.6 (ELSA-2022-5338)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-5338 advisory. - Fix buffer overrun in String-to-Float conversion. Resolves: CVE-2022-28739 Tenable has extracted the preceding description block directly from the Oracle Linu...

ruby:2.6 security, bug fix, and enhancement update

ruby 2.6.10-109 - Upgrade to Ruby 2.6.10. Resolves: rhbz2088415 - Fix buffer overrun in String-to-Float conversion. Resolves: CVE-2022-28739 - Fix FTBFS due to an incompatible load directive. - Fix a fiddle import test on an optimized glibc on Power 9...

CVE-2022-31115

opensearch-ruby is a community-driven, open source fork of elasticsearch-ruby. In versions prior to 2.0.1 the ruby YAML.load function was used instead of YAML.safeload. As a result opensearch-ruby 2.0.0 and prior can lead to unsafe deserialization using YAML.load if the response is of type YAML. ...

Deserialization of untrusted data

opensearch-ruby is a community-driven, open source fork of elasticsearch-ruby. In versions prior to 2.0.1 the ruby YAML.load function was used instead of YAML.safeload. As a result opensearch-ruby 2.0.0 and prior can lead to unsafe deserialization using YAML.load if the response is of type YAML. ...

CVE-2022-31115 Unsafe YAML deserialization in opensearch-ruby

opensearch-ruby is a community-driven, open source fork of elasticsearch-ruby. In versions prior to 2.0.1 the ruby YAML.load function was used instead of YAML.safeload. As a result opensearch-ruby 2.0.0 and prior can lead to unsafe deserialization using YAML.load if the response is of type YAML. ...

CVE-2022-31115 Unsafe YAML deserialization in opensearch-ruby

opensearch-ruby is a community-driven, open source fork of elasticsearch-ruby. In versions prior to 2.0.1 the ruby YAML.load function was used instead of YAML.safeload. As a result opensearch-ruby 2.0.0 and prior can lead to unsafe deserialization using YAML.load if the response is of type YAML. ...

CVE-2022-31115 Unsafe YAML deserialization in opensearch-ruby

opensearch-ruby is a community-driven, open source fork of elasticsearch-ruby. In versions prior to 2.0.1 the ruby YAML.load function was used instead of YAML.safeload. As a result opensearch-ruby 2.0.0 and prior can lead to unsafe deserialization using YAML.load if the response is of type YAML. ...

CVE-2022-31115

Opensearch-ruby before 2.0.1 is affected by unsafe YAML deserialization via YAML.load (not YAML.safe_load). Vulnerable in 2.0.0 and earlier when the response is YAML, exploitable only if an attacker controls the opensearch server and lures the victim to connect. Patch available in 2.0.1 (and subs...

ruby: Buffer overrun in String-to-Float conversion

A buffer overrun vulnerability was found in Ruby. The issue occurs in a conversion algorithm from a String to a Float that causes process termination due to a segmentation fault, but under limited circumstances. This flaw may cause an illegal memory read...

Moderate: Red Hat Security Advisory: ruby:2.6 security, bug fix, and enhancement update

An update for the ruby:2.6 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Ruby ruby-mysql security vulnerability (CNVD-2022-74096)

Ruby ruby-mysql is a pure Ruby version of the MySQL connector from the Ruby community.An access control error vulnerability exists in Ruby ruby-mysql Gem versions prior to 2.10.0, which stems from the fact that a malicious MySQL server can request local file content from a client without explicit...

Awesome spawn 操作系统命令注入漏洞

Awesome spawn is an open source module from ManageIQ in the US. It provides some useful features on Ruby's Kernel.spawn. A security vulnerability exists in Awesome spawn that stems from the fact that it allows the execution of other commands passed as arguments to Awesome spawn. An attacker can...

opensearch-ruby 代码问题漏洞

opensearch-ruby is an open source Ruby client for OpenSearch from opensearch-project. A code issue vulnerability exists in opensearch-ruby that stems from the use of the ruby YAML.load function instead of YAML.safeload in versions prior to 2.0.1. As a result, opensearch-ruby 2.0.0 and earlier may...

Access Restriction Bypass

Overview ruby-mysql is a MySQL connector. pure Ruby version Affected versions of this package are vulnerable to Access Restriction Bypass. A malicious MySQL server can request local file content from a client using without explicit authorization from the user. Remediation Upgrade ruby-mysql to...

GHSA-73PR-G6JJ-5HC9 Externally Controlled Reference to a Resource in Another Sphere in ruby-mysql

A malicious actor can read arbitrary files from a client that uses ruby-mysql to communicate to a rogue MySQL server and issue database queries. In these cases, the server has the option to create a database reply using the LOAD DATA LOCAL statement, which instructs the client to provide addition...