UBUNTU-CVE-2015-1828

The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack...

CVE-2015-1828

The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack...

Design/Logic Flaw

The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack...

CVE-2015-1828

The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack...

CVE-2015-1828

The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack...

CVE-2015-1828

The CVE-2015-1828 entry concerns the Ruby http gem prior to 0.7.3, where hostname verification is not performed in SSL connections. This hostname verification bypass enables a man-in-the-middle attack to potentially obtain sensitive information from affected users. Multiple connected sources (SUS...

CVE-2015-1828

The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack...

Medium: ruby22, ruby23

Issue Overview: SMTP command injection via CRLF sequences in RCPT TO or MAIL FROM commands in Net::SMTP A SMTP command injection flaw was found in the way Ruby's Net::SMTP module handled CRLF sequences in certain SMTP commands. An attacker could potentially use this flaw to inject SMTP commands i...

Cross-Site Scripting (XSS)

geminabox is vulnerable to cross-site scripting XSS attacks. It is possible because the spec.homepage and the spec.email parameters are not sanitized, allowing the attackers to trigger XSS by sending a .gem file with gem.homepage value in its .gemspec file...

Debian DLA-1112-1 : rubygems security update

Some vulnerabilities were found in the Rubygems package that affects the LTS distribution. CVE-2017-0900 DOS vulernerability in the query command CVE-2017-0901 gem installer allows a malicious gem to overwrite arbitrary files For Debian 7 'Wheezy', these problems have been fixed in version...

Debian DLA-1114-1 : ruby1.9.1 security update

Multiple vulnerabilities were discovered in the Ruby 1.9 interpretor. CVE-2017-0898 Buffer underrun vulnerability in Kernel.sprintf CVE-2017-0899 ANSI escape sequence vulnerability CVE-2017-0900 DOS vulernerability in the query command CVE-2017-0901 gem installer allows a malicious gem to overwri...

[SECURITY] [DLA 1114-1] ruby1.9.1 security update

Package : ruby1.9.1 Version : 1.9.3.194-8.1+deb7u6 CVE ID : CVE-2017-0898 CVE-2017-0899 CVE-2017-0900 CVE-2017-0901 CVE-2017-10784 CVE-2017-14033 CVE-2017-14064 Debian Bug : 873802 873906 875928 875931 875936 Multiple vulnerabilities were discovered in the Ruby 1.9 interpretor. CVE-2017-0898 Buff...

CVE-2017-14683

geminabox aka Gem in a Box before 0.13.7 has CSRF, as demonstrated by an unintended gem upload...

Design/Logic Flaw

geminabox aka Gem in a Box before 0.13.6 has XSS, as demonstrated by uploading a gem file that has a crafted gem.homepage value in its .gemspec file...

Cross site request forgery (csrf)

geminabox aka Gem in a Box before 0.13.7 has CSRF, as demonstrated by an unintended gem upload...

CVE-2017-14683

geminabox aka Gem in a Box before 0.13.7 has CSRF, as demonstrated by an unintended gem upload...

CVE-2017-14506

geminabox aka Gem in a Box before 0.13.6 has XSS, as demonstrated by uploading a gem file that has a crafted gem.homepage value in its .gemspec file...

CVE-2017-14683

geminabox aka Gem in a Box before 0.13.7 has CSRF, as demonstrated by an unintended gem upload...

CVE-2017-14683

Gem in a Box (geminabox) CVE-2017-14683 affects versions before 0.13.7 and is due to a Cross-Site Request Forgery (CSRF) flaw demonstrated by an unintended gem upload. Affected software is geminabox, a Ruby-based personal code hosting platform. The Root Cause, per the description, is CSRF allowin...

CVE-2017-14506

Gem in a Box (geminabox) prior to 0.13.6 is vulnerable to Cross-site Scripting (XSS) via a crafted gem.homepage value in a .gemspec file uploaded as a gem. Affected product: geminabox (Ruby) before 0.13.6. Impact: XSS that may affect users accessing the web interface; some sources note potential ...