GHSA-M44R-GV6Q-9J9R papercrop does not properly handle crop input

The papercrop gem before 0.3.0 for Ruby on Rails does not properly handle crop input...

papercrop does not properly handle crop input

The papercrop gem before 0.3.0 for Ruby on Rails does not properly handle crop input...

Uninitialized read in Nokogiri gem

In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character...

GHSA-4HM9-844J-JMXP Uninitialized read in Nokogiri gem

In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character...

apollo_upload_server has Denial of Service vulnerability

A Denial Of Service vulnerability in the apollouploadserver Ruby gem in GitLab CE/EE version 11.11 and above allows an attacker to deny access to all users via specially crafted requests to the apollouploadserver middleware...

CVE-2019-25061

The randompasswordgenerator aka RandomPasswordGenerator gem through 1.0.0 for Ruby uses Kernelrand to generate passwords, which, due to its cyclic nature, can facilitate password prediction...

OmniAuth Ruby gem 安全漏洞

The OmniAuth Ruby gem is an authentication system that uses Rack middleware. Ruby gem 1.0.0 and earlier versions have a security vulnerability in randompasswordgenerator aka RandomPasswordGenerator, which can be exploited by an attacker to facilitate password prediction...

PT-2022-8283

Name of the Vulnerable Software and Affected Versions random password generator gem versions through 1.0.0 Description The issue concerns the use of Kernelrand to generate passwords, which has a cyclic nature that can facilitate password prediction. This affects the random password generator gem...

GHSA-756M-3QF2-HP58 openshift-origin-node Improper Input Validation vulnerability

Ruby gem openshift-origin-node before 2014-02-14 does not contain a cronjob timeout which could result in a denial of service in cron.daily and cron.weekly...

GHSA-V6J3-7JRW-HQ2P Rack Gem Subject to Denial of Service via Hash Collisions

Rack before 1.1.3, 1.2.x before 1.2.5, and 1.3.x before 1.3.6 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service CPU consumption by sending many crafted parameters...

GHSA-5MGJ-MVV8-46MW RubyGems does not verify SSL certificate

RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers to modify a gem during installation via a man-in-the-middle attack...

GHSA-95XQ-V4M2-FQ3R GitLab Grit Gem for Ruby contains a flaw allowing arbitrary commands to be executed

The Grit gem for Ruby, as used in GitLab 5.2 before 5.4.1 and 6.x before 6.2.3, allows remote authenticated users to execute arbitrary commands, as demonstrated by the search box for the GitLab code search feature. GitLab Grit Gem for Ruby contains a flaw in the app/contexts/searchcontext.rb...

GitLab Grit Gem for Ruby contains a flaw allowing arbitrary commands to be executed

The Grit gem for Ruby, as used in GitLab 5.2 before 5.4.1 and 6.x before 6.2.3, allows remote authenticated users to execute arbitrary commands, as demonstrated by the search box for the GitLab code search feature. GitLab Grit Gem for Ruby contains a flaw in the app/contexts/searchcontext.rb...

GHSA-4FVG-PWV7-V54G Karteek Docsplit vulnerable to OS Command Injection

The extractfromocr function in lib/docsplit/textextractor.rb in the Karteek Docsplit karteek-docsplit gem 0.5.4 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a PDF filename...

openshift-origin-node Improper Input Validation vulnerability

Ruby gem openshift-origin-node before 2014-02-14 does not contain a cronjob timeout which could result in a denial of service in cron.daily and cron.weekly...

VladTheEnterprising allows local users to write to arbitrary files via a symlink attack

lib/vlad/dba/mysql.rb in the VladTheEnterprising gem 0.2 for Ruby allows local users to write to arbitrary files via a symlink attack on /tmp/my.cnf.targethost...

VladTheEnterprising allows local users to obtain sensitive information by reading MySQL root password from temporary file

Race condition in lib/vlad/dba/mysql.rb in the VladTheEnterprising gem 0.2 for Ruby allows local users to obtain sensitive information by reading the MySQL root password from a temporary file before it is removed...

GHSA-WR5J-Q359-6VR2 backup-agoddard and backup_checksum have Information Exposure vulnerability

1 lib/backup/cli/utility.rb in the backup-agoddard gem 3.0.28 and 2 lib/backup/cli/utility.rb in the backupchecksum gem 3.0.23 for Ruby place credentials on the openssl command line, which allows local users to obtain sensitive information by listing the process...

GHSA-X4VJ-279X-QWF2 VladTheEnterprising allows local users to write to arbitrary files via a symlink attack

lib/vlad/dba/mysql.rb in the VladTheEnterprising gem 0.2 for Ruby allows local users to write to arbitrary files via a symlink attack on /tmp/my.cnf.targethost...

GHSA-W9VV-FVW8-J6Q3 codders-dataset Process Table Local Plaintext Credential Disclosure

lib/dataset/database/mysql.rb and lib/dataset/database/postgresql.rb in the codders-dataset gem 1.3.2.1 for Ruby both place credentials on the mysqldump command line, which allows local users to obtain sensitive information by listing the process...