Denial of Service (DoS)

Overview puma is a simple, fast, threaded, and highly concurrent HTTP 1.1 server for Ruby/Rack applications. Puma is intended for use in both development and production environments. It's great for highly concurrent Ruby implementations such as Rubinius and JRuby as well as as providing process...

CVE-2021-29509

Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same...

CVE-2021-29509 Keepalive Connections Causing Denial Of Service in puma

Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same...

CVE-2021-29509

Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same...

CVE-2021-29509

CVE-2021-29509 affects the Puma HTTP/1.1 server for Ruby/Rack apps. The issue is that, even after the CVE-2019-16770 fix, new keep-alive connections can still cause denial of service by saturating threadpools across a cluster, starving additional connections. The problem is triggered when more co...

Exploit for Command Injection in Rubyonrails Rails

CVE-2019-5420.rb POC Explo...

Ruby 资源管理错误漏洞

Ruby is a cross-platform, object-oriented, dynamically-typed programming language from the individual developer, Yukihiro Matsumoto. A resource management error vulnerability exists in Ruby. The vulnerability is caused due to a "post-sale use" error in "operation scheduling", which allows remote...

OpenNetAdmin 18.1.1 Remote Command Execution Exploit

OpenNetAdmin versions 8.5.14 through 18.1.1 remote command execution exploit written in Ruby. This exploit was based on the original discovery of the issue by mattpascoe...

Ruby 安全漏洞

Ruby is a cross-platform, object-oriented, dynamically-typed programming language from the personal developer, Yukihiro Matsumoto. A security vulnerability exists in Ruby. The vulnerability is caused due to a "use after sale" error in the token authentication logic in the Operations Controller,...

CVE-2021-32096

The ConsoleAction component of U.S. National Security Agency NSA Emissary 5.9.0 allows a CSRF attack that results in injecting arbitrary Ruby code for an eval call via the CONSOLECOMMANDSTRING parameter...

CVE-2021-32096

The ConsoleAction component of U.S. National Security Agency NSA Emissary 5.9.0 allows a CSRF attack that results in injecting arbitrary Ruby code for an eval call via the CONSOLECOMMANDSTRING parameter...

CVE-2021-32096

The ConsoleAction component of U.S. National Security Agency NSA Emissary 5.9.0 allows a CSRF attack that results in injecting arbitrary Ruby code for an eval call via the CONSOLECOMMANDSTRING parameter...

Cross site request forgery (csrf)

The ConsoleAction component of U.S. National Security Agency NSA Emissary 5.9.0 allows a CSRF attack that results in injecting arbitrary Ruby code for an eval call via the CONSOLECOMMANDSTRING parameter...

CVE-2021-32096

The ConsoleAction component of U.S. National Security Agency NSA Emissary 5.9.0 allows a CSRF attack that results in injecting arbitrary Ruby code for an eval call via the CONSOLECOMMANDSTRING parameter...

CVE-2021-32096

CVE-2021-32096 affects NSA Emissary 5.9.0 — the ConsoleAction component is vulnerable to a CSRF attack that results in injecting arbitrary Ruby code (via an eval call) through the CONSOLE_COMMAND_STRING parameter. This is the stated impact in the CVE entry. The connected documents also corroborat...

Emissary 跨站请求伪造漏洞

Emissary is a software application. A P2P-based data-driven workflow engine that operates across heterogeneous and potentially widely distributed multi-tier P2P network computing resources. U.S. National Security Agency NSA Emissary 5.9.0 suffers from a cross-site request forgery vulnerability th...

Tempfile on Windows path traversal vulnerability

There is an unintentional directory creation vulnerability in tmpdir library bundled with Ruby on Windows. And there is also an unintentional file creation vulnerability in tempfile library bundled with Ruby on Windows, because it uses tmpdir internally...

Directory Traversal

Overview tmpdir is a package that extends the Dir class to manage the OS temporary file path. Affected versions of this package are vulnerable to Directory Traversal. There is are unintentional directory and file creation vulnerabilities in tmpdir library bundled with Ruby on Windows. The...

OESA-2021-1175 rubygem-redcarpet security update

A fast, safe and extensible Markdown to XHTML parser. Security Fixes: Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being perform...

GitLab Permission License and Access Control Issues Vulnerability

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. GitLab suffers from a privilege-permission and...