4294 matches found
Design/Logic Flaw
The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persistent application access...
CVE-2009-4123
The jruby-openssl gem before 0.6 for JRuby mishandles SSL certificate validation...
CVE-2013-2513
The flashtool gem through 0.6.0 for Ruby allows command execution via shell metacharacters in the name of a downloaded file...
Command injection
The flashtool gem through 0.6.0 for Ruby allows command execution via shell metacharacters in the name of a downloaded file...
CVE-2015-2179
The CVE-2015-2179 issue affects the xaviershay-dm-rails gem for Ruby, version 0.10.3.8, where a flaw in the execute() function in /datamapper/dm-rails/blob/master/lib/dm-rails/storage.rb exposes sensitive information via the process table. This can allow local users to discover MySQL credentials ...
CVE-2009-4123
CVE-2009-4123 affects the jruby-openssl gem for JRuby, with versions prior to 0.6 mishandling SSL certificate validation. The issue enables attackers to masquerade as a legitimate SSL server by abusing certificate validation logic, per Red Hat andVeracode entries, which detail faulty handling suc...
CVE-2013-2513
The flashtool gem through 0.6.0 for Ruby allows command execution via shell metacharacters in the name of a downloaded file...
CVE-2013-2513
The CVE-2013-2513 entry concerns the flash_tool gem for Ruby (versions prior to 0.6.0). The vulnerability arises from the handling of downloaded file names containing shell metacharacters, which can lead to command execution. Affected component: flash_tool gem (Ruby). Root cause: processing of do...
CVE-2015-8314
The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persistent application access...
CVE-2015-8314
The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persistent application access...
CVE-2015-8314
CVE-2015-8314 affects the Devise gem for Ruby prior to 3.5.4, where the Remember Me cookie handling is flawed. This flaw may allow an attacker to obtain unauthorized persistent access to an application by leveraging the compromised cookie. The issue is reported across multiple sources (Red Hat, D...
VulnCheck KEV: CVE-2021-33564
An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL when the verifyurl option is disabled. This may lead to code execution. The problem occurs because the generate and process features...
The vulnerability of the `qxl_gem_object_create_with_handle()` function in the `drivers/gpu/drm/qxl/qxl_gem.c` file of the Linux operating system’s kernel driver QXL allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the qxlgemobjectcreatewithhandle function in the drivers/gpu/drm/qxl/qxlgem.c driver of the Linux operating system is related to the reutilization of previously freed memory due to concurrent access to resources. Exploiting this vulnerability could allow an attacker to...
kernel: vmwgfx: race condition leading to information disclosure vulnerability
A race condition vulnerability was found in the vmwgfx driver in the Linux kernel. The flaw exists within the handling of GEM objects. The issue results from improper locking when performing operations on an object. This flaw allows a local privileged user to disclose information in the context o...
RHEL 8 : ruby:2.5 (RHSA-2023:7025)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7025 advisory. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system...
@gem-sdk/pages (>=1.9.33, <=1.33.4) potentially affected by CVE-2023-46729 via @sentry/nextjs (>=7.46.0, <=7.57.0)
@sentry/nextjs NPM version =7.46.0, =1.9.33, =1.33.4 Source cves: CVE-2023-46729 Source advisory: OSV:GHSA-2RMR-XW8M-22Q9...
rubygem-actionpack: Denial of Service in Action Dispatch
A flaw was found in the rubygem-actionpack. RubyGem's actionpack gem is vulnerable to a denial of service caused by a regular expression denial of service ReDoS flaw in the Action Dispatch module. By sending specially-crafted cookies with an XFORWARDEDHOST header, a remote attacker could exploit...
rubygem-activerecord: SQL Injection
A flaw was found in RubyGem's activerecord gem, which is vulnerable to SQL injection. This flaw allows a remote attacker to send specially-crafted SQL statements to the comments, allowing the attacker to view, add, modify, or delete information in the back-end database...
rubygem-activesupport: Regular Expression Denial of Service
A flaw was found in rubygem-activesupport. RubyGem's activesupport gem is vulnerable to a denial of service caused by a regular expression denial of service ReDoS flaw in Inflector.underscore. By sending a specially-crafted regex input, a remote attacker can use large amounts of CPU and memory,...
rubygem-rack: Denial of service in Multipart MIME parsing
A flaw was found in rubygem-rack. This issue occurs in the Multipart MIME parsing code in Rack, which limits the number of file parts but does not limit the total number of parts that can be uploaded. Carefully crafted requests can abuse this and cause multipart parsing to take longer than...