3599 matches found
CVE-2014-1835
The performrequest function in /lib/echor/backplane.rb in echor 0.1.6 Ruby Gem allows local users to steal the login credentials by watching the process table...
CVE-2014-1834
The CVE-2014-1834 entry concerns the echor 0.1.6 Ruby Gem (backplane.rb) where the perform_request function allows local users to inject arbitrary commands by inserting a semicolon into their username or password. The root cause is insufficient input handling for user-supplied credentials, enabli...
USN-3553-1 ruby2.3 vulnerabilities
It was discovered that Ruby failed to validate specification names. An attacker could possibly use a maliciously crafted gem to potentially overwrite any file on the filesystem. CVE-2017-0901 It was discovered that Ruby was vulnerable to a DNS hijacking vulnerability. An attacker could use this t...
Nokogiri gem, via libxml, is affected by DoS vulnerabilities
The version of libxml2 packaged with Nokogiri contains a vulnerability. Nokogiri has mitigated these issue by upgrading to libxml 2.9.6. It was discovered that libxml2 incorrecty handled certain files. An attacker could use this issue with specially constructed XML data to cause libxml2 to consum...
lynx doesn't properly sanitize user input and exposes database password to unauthorized users
The lynx gem prior to 1.0.0 for Ruby places the configured password on command lines, which allows local users to obtain sensitive information by listing processes. As of version 1.0.0, lynx no longer supports a --password option. Passwords are only configured in a configuration file, so it's no...
GHSA-94CQ-7CCQ-CMCM lynx doesn't properly sanitize user input and exposes database password to unauthorized users
The lynx gem prior to 1.0.0 for Ruby places the configured password on command lines, which allows local users to obtain sensitive information by listing processes. As of version 1.0.0, lynx no longer supports a --password option. Passwords are only configured in a configuration file, so it's no...
Paperclip ruby gem suffers from a Server-Side Request Forgery (SSRF) vulnerability in the Paperclip::UriAdapter and Paperclip::HttpUrlProxyAdapter class.
Paperclip gem provides multiple ways a file can be uploaded to a web server. The vulnerability affects two of Paperclip’s IO adapters that accept URLs as attachment data UriAdapter and HttpUrlProxyAdapter. When these adapters are used, Paperclip acts as a proxy and downloads the file from the...
GHSA-RHGQ-VV9X-J4P5 lawn-login exposes database password to unauthorized users
The login function in lib/lawn.rb in the lawn-login gem 0.0.7 for Ruby places credentials on the curl command line, which allows local users to obtain sensitive information by listing the process...
GHSA-6X45-86Q6-RCMR Gyazo allows local users to write arbitrary files
lib/gyazo/client.rb in the gyazo gem 1.0.0 for Ruby allows local users to write to arbitrary files via a symlink attack on a temporary file, related to time-based filenames...
Gyazo allows local users to write arbitrary files
lib/gyazo/client.rb in the gyazo gem 1.0.0 for Ruby allows local users to write to arbitrary files via a symlink attack on a temporary file, related to time-based filenames...
paperclip Server-Side Request Forgery vulnerability
Paperclip ruby gem version 3.1.4 and later suffers from a Server-SIde Request Forgery SSRF vulnerability in the Paperclip::UriAdapter class. Attackers may be able to access information about internal network resources...
GHSA-5JCF-C5RG-RMM8 paperclip Server-Side Request Forgery vulnerability
Paperclip ruby gem version 3.1.4 and later suffers from a Server-SIde Request Forgery SSRF vulnerability in the Paperclip::UriAdapter class. Attackers may be able to access information about internal network resources...
Cross site scripting
An exploitable cross site scripting XSS vulnerability exists in the filter functionality of the delayedjobweb rails gem version 1.4. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim's browser. An attacker can phish an...
CVE-2017-12097
An exploitable cross site scripting XSS vulnerability exists in the filter functionality of the delayedjobweb rails gem version 1.4. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim's browser. An attacker can phish an...
CVE-2017-12097
An exploitable cross site scripting XSS vulnerability exists in the filter functionality of the delayedjobweb rails gem version 1.4. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim's browser. An attacker can phish an...
CVE-2017-12097
An exploitable cross site scripting XSS vulnerability exists in the filter functionality of the delayedjobweb rails gem version 1.4. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim's browser. An attacker can phish an...
CVE-2017-12097
CVE-2017-12097 affects the delayed_job_web rail gem, where the filter functionality is vulnerable to cross-site scripting. A specially crafted URL can cause arbitrary JavaScript execution in the victim’s browser, enabling an attacker to phish an authenticated user. Affected versions include 1.2.9...
CVE-2017-12098
An exploitable cross site scripting XSS vulnerability exists in the add filter functionality of the railsadmin rails gem version 1.2.0. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim's browser. An attacker can phish ...
CVE-2017-12098
CVE-2017-12098 is an XSS vulnerability in the rails_admin gem (version 1.2.0) affecting the add filter functionality. A specially crafted URL can cause an attacker to execute arbitrary JavaScript in an authenticated user’s browser (phishing possible). This is documented across multiple sources (N...
