2180 matches found
CVE-2021-21288
CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1 the download feature has an SSRF vulnerability, allowing attacks to provide DNS entries or IP addresses that are intended for...
CVE-2021-21305
CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1, there is a code injection vulnerability. The "manipulate!" method inappropriately evals the content of mutation option:read/:write...
Design/Logic Flaw
CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1 the download feature has an SSRF vulnerability, allowing attacks to provide DNS entries or IP addresses that are intended for...
CVE-2021-21288
CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1 the download feature has an SSRF vulnerability, allowing attacks to provide DNS entries or IP addresses that are intended for...
Code injection
CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1, there is a code injection vulnerability. The "manipulate!" method inappropriately evals the content of mutation option:read/:write...
CVE-2021-21305 Code Injection vulnerability in CarrierWave
CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1, there is a code injection vulnerability. The "manipulate!" method inappropriately evals the content of mutation option:read/:write...
CVE-2021-21305
CVE-2021-21305 affects CarrierWave, a RubyGem for file uploads. The vulnerability lies in the manipulate! method, which in CarrierWave versions before 1.3.2 and 2.1.1 evals content of mutation option(:read/:write), enabling an attacker-controlled string to be executed as Ruby code (RCE) if untrus...
CVE-2021-21288
CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1 the download feature has an SSRF vulnerability, allowing attacks to provide DNS entries or IP addresses that are intended for...
CVE-2021-21288
CVE-2021-21288 affects the CarrierWave RubyGem. The vulnerability is in the download feature of CarrierWave before versions 1.3.2 and 2.1.1, where an attacker can trigger server-side request forgery (SSRF) by supplying DNS entries or IPs intended for internal use, enabling information discovery a...
CVE-2021-21288 Server-side request forgery in CarrierWave
CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1 the download feature has an SSRF vulnerability, allowing attacks to provide DNS entries or IP addresses that are intended for...
openSUSE Security Update : rubygem-nokogiri (openSUSE-2021-237)
This update for rubygem-nokogiri fixes the following issues: rubygem-nokogiri was updated to 1.8.5 bsc1156722. Security issues fixed : - CVE-2019-5477: Fixed a command injection vulnerability bsc1146578. - CVE-2020-26247: Fixed an XXE vulnerability in Nokogiri::XML::Schema bsc1180507. This update...
OPENSUSE-SU-2021:0237-1 Security update for rubygem-nokogiri
This update for rubygem-nokogiri fixes the following issues: rubygem-nokogiri was updated to 1.8.5 bsc1156722. Security issues fixed: - CVE-2019-5477: Fixed a command injection vulnerability bsc1146578. - CVE-2020-26247: Fixed an XXE vulnerability in Nokogiri::XML::Schema bsc1180507. This update...
Security update for rubygem-nokogiri (important)
openSUSE Security Update: Security update for rubygem-nokogiri Announcement ID: openSUSE-SU-2021:0237-1 Rating: important References: 1146578 1156722 1180507 Cross-References: CVE-2019-5477 CVE-2020-26247 Affected Products: openSUSE Leap 15.2 An update that solves two vulnerabilities and has one...
SUSE-SU-2021:0251-1 Security update for rubygem-nokogiri
This update for rubygem-nokogiri fixes the following issues: rubygem-nokogiri was updated to 1.8.5 bsc1156722. Security issues fixed: - CVE-2019-5477: Fixed a command injection vulnerability bsc1146578. - CVE-2020-26247: Fixed an XXE vulnerability in Nokogiri::XML::Schema bsc1180507...
SUSE-SU-2021:0210-1 Security update for rubygem-nokogiri
This update for rubygem-nokogiri fixes the following issues: - CVE-2019-5477: Fixed a command injection vulnerability bsc1146578. - CVE-2020-26247: Fixed an XXE vulnerability in Nokogiri::XML::Schema bsc1180507...
SUSE-SU-2021:0115-1 Security update for rubygem-archive-tar-minitar
This update for rubygem-archive-tar-minitar fixes one security issue: - CVE-2016-10173: Archives with files containing '..' in the extracted filename could have been used to overwrite arbitrary files bsc1021740...
Fedora 33 : rubygem-em-http-request (2020-8ccd750904)
Security fix for CVE-2020-13482 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network...
Fedora 32 : rubygem-em-http-request (2020-117f1b67fb)
Security fix for CVE-2020-13482. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network...
Fedora: Security Advisory for rubygem-em-http-request (FEDORA-2020-117f1b67fb)
The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
