CVE-2020-8165

CVE-2020-8165 Ruby on Rails 교육 목적으로만 사용하세요. 자세한 내용은 참고문헌을 확인하세요. 환경 Ruby: 2.6.3 Rails: 5.2.3 실행 root@kitploit: $ git clone https://github.com/masahiro331/CVE-2020-8165.git $ bundle install --path vendor/bundle $ bundle exec rails db:migrate $ bundle exec rails s use redis $ docker run -d -p...

cve-2019-5420-POC

Rails ActiveSupport 익스플로잇 cve-2019-5420 POC CVE-2019-5418과 연계 사용 고려! CVE-2019-5418과 찰떡궁합! POC 스크린샷 🚨 경고 이 저장소에는 ActiveSupport::MessageVerifier 남용을 통해 Ruby on Rails 애플리케이션에서 원격 코드 실행RCE 을 시연하는 개념 증명PoC 익스플로잇 이 포함되어 있습니다. 책임감 있게 사용하세요! 📌 개요 이 스크립트는 DeprecatedInstanceVariableProxy로 감싼 조작된 ERB 객체 를...

ruby-RCE-CVE-2019-5420-

Ruby 逆シリアル化（CVE-2019-5420） root@kitploit: https://github.com/PenTestical/CVE-2019-5420 参照： root@kitploit: 1 Ruby on Rails コマンド実行脆弱性ペイロード実装プロセス https://hackerone.com/reports/473888 ActiveSupport::MessageVerifier と ActiveSupport::MessageEncryptor はデフォルトのシリアライザとして Marshal を使用するため、オブジェクトインジェクションによる R...

The vulnerability of the activesupport component in the Ruby on Rails software framework allows a hacker to trigger a service failure.

The vulnerability of the activesupport component in the Ruby on Rails software framework is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service failures...

The vulnerability of the activesupport component in the Ruby on Rails software framework allows a hacker to trigger a service failure.

The vulnerability of the activesupport component in the Ruby on Rails software framework is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

The vulnerability of the activesupport component in the Ruby on Rails software framework allows a hacker to trigger a service failure.

The vulnerability of the activesupport component in the Ruby on Rails software framework is related to the use of a regular expression with inefficient computational complexity. Exploiting this vulnerability could allow an attacker to cause service failures...

The vulnerability of the activesupport component of the Ruby on Rails software framework allows a hacker to execute arbitrary code.

The vulnerability of the activesupport component in the Ruby on Rails software framework is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Malicious Package

Overview knot-activesupport-logger is a malicious package. This package is part of a malicious cluster of Ruby gems published by the threat actor knot-theory. Designed to impersonate legitimate utilities, it executes a payload upon installation that harvests environment variables, SSH keys, AWS...

ROS-20260508-73-0004

Vulnerability in rubygem-activesupport related to failure to take measures to protect web page structure. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code...

ROS-20260508-73-0002

Vulnerability in rubygem-activesupport related to the use of regular expression with inefficient computational complexity. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...

Important: Red Hat Security Advisory: Satellite 6.16.8 Async Update

An update is now available for Red Hat Satellite 6.16 for RHEL 8 and RHEL 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

RHEL 8 / 9 : Satellite 6.16.8 Async Update (Important) (RHSA-2026:14874)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:14874 advisory. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessi...

ROS-20260506-73-0041

Vulnerability in rubygem-activesupport related to uncontrolled resource consumption. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...

RHCOS 6 : rubygem-activesupport (RHSA-2013:0202)

The remote Red Hat Enterprise Linux CoreOS 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2013:0202 advisory. - rubygem-activesupport: json to yaml parsing CVE-2013-0333 Note that Nessus has not tested for this issue but has instead relied only on the...

RHCOS 6 : Ruby on Rails (RHSA-2013:0153)

The remote Red Hat Enterprise Linux CoreOS 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2013:0153 advisory. - rubygem-activesupport: Multiple vulnerabilities in parameter parsing in ActionPack CVE-2013-0156 Note that Nessus has not tested for this...

PT-2026-33982

Name of the Vulnerable Software and Affected Versions ERB versions prior to 6.0.1.1 ERB versions prior to 6.0.4 ERB versions prior to 4.0.3.1 ERB versions prior to 4.0.4.1 Ruby versions prior to 4.0.3 Description A deserialization guard bypass exists in ERB involving the init variable. This issue...

Important Photon OS Security Update - PHSA-2026-4.0-0995

Updates of 'python3-PyJWT', 'libtiff', 'python3-pyasn1', 'rubygem-rdiscount', 'rubygem-activesupport', 'nodejs' packages of Photon OS have been released...

Critical Photon OS Security Update - PHSA-2026-5.0-91-0802

Updates of 'python3', 'python3-pyOpenSSL', 'libpng', 'strongswan', 'python3-requests', 'nghttp2', 'sqlite', 'glibc', 'rubygem-activesupport', 'etcd', 'python3-Pygments' packages of Photon OS have been released...

Cross-site Scripting (XSS)

Overview activesupport is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the @htmlunsafe flag used by the SafeBuffer% function. An attacker can inject scripts by providing...

Allocation of Resources Without Limits or Throttling

Overview activesupport is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in NumberConverter. An attacker can cause excessive memory allocation by...