Code injection

The datagrid gem 1.0.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party...

CVE-2019-14282

The simplecaptcha2 gem 0.2.3 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party...

CVE-2019-14282

The simplecaptcha2 gem 0.2.3 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party...

CVE-2019-14281

The datagrid gem 1.0.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party...

CVE-2019-14281

The CVE-2019-14281 entry concerns the Ruby datagrid gem (version 1.0.6) distributed on RubyGems.org, which includes a code-execution backdoor inserted by a third party. Multiple connected records (Red Hat, GitHub advisory GHSA, OSV, RubySec) corroborate a malicious backdoor in datagrid-1.0.6. The...

SQL injection vulnerability via Marginalia::Comment

The 'marginalia' gem is affected by a SQL Injection vulnerability. All SQL queries are affected when a user controller argument is added as a component. This affects users that add a component that is user controller, for instance a parameter or a header. The issue is resolved in version 1.6...

PT-2019-13582

Name of the Vulnerable Software and Affected Versions datagrid gem version 1.0.6 Description The issue concerns a code-execution backdoor that was inserted by a third party into the datagrid gem. This backdoor allows for code execution, posing a significant risk. Recommendations For datagrid gem...

Amazon Linux 2 : ruby (ALAS-2019-1249)

An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur. CVE-2019-8322 An issue was discovered in RubyGems 2.6 and later through...

paranoid2 gem for Ruby Code Execution Vulnerability

The paranoid2 gem for Ruby is a paranoid model based on Ruby. A security vulnerability exists in paranoid2 gem for Ruby version 1.1.6 RubyGems.org. An attacker can exploit the vulnerability to execute code...

GHSA-WG9M-GW3H-HG83 field_test gem contains injection vulnerability

The fieldtest gem 0.3.0 for Ruby has unvalidated input. A method call that is expected to return a value from a certain set of inputs can be made to return any input, which can be dangerous depending on how applications use it. If an application treats arbitrary variants as trusted, this can lead...

paranoid2 gem Code backdoor

The paranoid2 gem 1.1.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1.1.5...

CVE-2019-13589

The paranoid2 gem 1.1.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1.1.5...

CVE-2019-13589

The paranoid2 gem 1.1.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1.1.5...

CVE-2019-13589

CVE-2019-13589 affects the Ruby gem paranoid2. The 1.1.6 release distributed on RubyGems.org included a code-execution backdoor inserted by a third party; the fixed version is 1.1.5. Multiple connected documents corroborate that the backdoor is the root cause and that upgrading to a non-backdoore...

CVE-2019-13146

The fieldtest gem 0.3.0 for Ruby has unvalidated input. A method call that is expected to return a value from a certain set of inputs can be made to return any input, which can be dangerous depending on how applications use it. If an application treats arbitrary variants as trusted, this can lead...

CVE-2019-13146

The fieldtest gem 0.3.0 for Ruby has unvalidated input. A method call that is expected to return a value from a certain set of inputs can be made to return any input, which can be dangerous depending on how applications use it. If an application treats arbitrary variants as trusted, this can lead...

Cross site scripting

The fieldtest gem 0.3.0 for Ruby has unvalidated input. A method call that is expected to return a value from a certain set of inputs can be made to return any input, which can be dangerous depending on how applications use it. If an application treats arbitrary variants as trusted, this can lead...

CVE-2019-13146

The fieldtest gem 0.3.0 for Ruby has unvalidated input. A method call that is expected to return a value from a certain set of inputs can be made to return any input, which can be dangerous depending on how applications use it. If an application treats arbitrary variants as trusted, this can lead...

CVE-2019-13146

CVE-2019-13146 concerns the field_test gem (Ruby) 0.3.0, where unvalidated input allows a method to return arbitrary inputs. The root cause is acceptance of arbitrary variants from user-supplied input, enabling potential SQL injection or XSS when trusted values are used. Multiple connected source...

PT-2019-13154

Name of the Vulnerable Software and Affected Versions field test gem version 0.3.0 Description The issue concerns unvalidated input in a method call, which can return any input, potentially leading to various vulnerabilities such as SQL injection or cross-site scripting XSS if applications treat...