3598 matches found
CVE-2013-0334
Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source...
CVE-2013-0334
CVE-2013-0334 affects Bundler prior to 1.7, where using multiple top-level gem sources allows a remote attacker to install a gem with the same name from a different source, enabling arbitrary gem installation. The connected MiracleLinux advisory AXSA:2015-789 fixes Bundler by upgrading Bundler to...
PT-2014-2451
Name of the Vulnerable Software and Affected Versions Bundler versions prior to 1.7 Description The issue allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source when multiple top-level source lines are used. Recommendations For...
Rejetto HTTP File Server (HFS) - Remote Command Execution (Metasploit)
This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "Rejetto HttpFileServer Remote Command Execution", 'Description' = %q Rejetto HttpFileServer HFS is vulnerable to remote command...
Dragonfly 1.0.5 Remote Code Execution
RCE in the Dragonfly gem for image uploading & processing in rails/sinatra, in version 1.0.5. https://github.com/markevans/dragonfly The underlaying vulnerability is that you can pass arbitrary commands to imagemagicks convert, thus granting arbitrary read/write for the filesystem. Additionally t...
Fat Free CRM Gem contains a javascript cross-site scripting (XSS) vulnerability
Fat Free CRM Gem contains a javascript cross-site scripting XSS vulnerability. When a user is created/updated using a specifically crafted username, first name or last name, it is possible for arbitrary javascript to be executed on all Fat Free CRM pages. This code would be executed for all logge...
CVE-2013-0334 rubygem-bundler: 'bundle install' may install a gem from a source other than expected
Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source. A flaw was found in the way Bundler handled gems available from multiple sources. An attacker with access...
brbackup Gem for Ruby Process List Local Plaintext Password Disclosure
brbackup Gem for Ruby contains a flaw that is due to the program exposing password information in plaintext in the process list. This may allow a local attacker to gain access to password information...
Yoxel <= 1.23beta (itpm_estimate.php a) Remote Code Execution Vuln
No description provided by source. :::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP YmmMMMM MMM YM Discovered by dun \ dunatstrcpy.pl Yoxel = 1.23beta PHP code Injection Vulnerability Script: Yoxel is a hidden gem. This Open Source...
backup_checksum Gem for Ruby /lib/backup/cli/utility.rb Process List Local Plaintext Password Disclosure
backupchecksum Gem for Ruby contains a flaw in /lib/backup/cli/utility.rb that is triggered as the program displays password information in plaintext in the process list. This may allow a local attacker to gain access to password information...
VladTheEnterprising Gem for Ruby /tmp/my.cnf.#{target_host} Symlink Multiple Impact
VladTheEnterprising Gem for Ruby contains a flaw as the program creates temporary files insecurely. It is possible for a local attacker to use a symlink attack against the /tmp/my.cnf.targethost file they can overwrite arbitrary files, gain access to the MySQL root password, or inject arbitrary...
karo Gem for Ruby db.rb Metacharacter Handling Remote Command Execution
The karo gem 2.3.8 for Ruby allows Remote command injection via the host field. karo Gem for Ruby contains a flaw in db.rb that is triggered when handling metacharacters. This may allow a remote attacker to execute arbitrary commands. CWE-77 - Improper Neutralization of Special Elements used in a...
codders-dataset Gem for Ruby lib/dataset/database/mysql.rb and lib/dataset/database/postgresql.rb Process Table Local Plaintext Credential Disclosure
"1 lib/dataset/database/mysql.rb and 2 lib/dataset/database/postgresql.rb in the codders-dataset gem 1.3.2.1 for Ruby place credentials on the mysqldump command line, which allows local users to obtain sensitive information by listing the process."...
kajam Gem for Ruby /dataset/lib/dataset/database/postgresql.rb Process List Local Plaintext Password Disclosure
kajam Gem for Ruby contains a flaw in /dataset/lib/dataset/database/postgresql.rb that is triggered as the program exposes the MySQL or PostgreSQL password in the process list. This may allow a local attacker to gain access to password information...
ciborg Gem for Ruby default.rb /tmp/perlbrew-installer Local Symlink File Overwrite
ciborg Gem for Ruby contains a flaw as default.rb creates temporary files insecurely. It is possible for a local attacker to use a symlink attack against the /tmp/perlbrew-installer file to cause the program to unexpectedly overwrite an arbitrary file...
openSUSE Security Update : rubygems (openSUSE-SU-2014:0332-1)
This update fixes the following issue with some rubygems : - bnc864873: fix rubygem patches are not applied to the gem but only to the tree. Packages embedding rubygems via their .gem files were not receiving security updates. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...
openSUSE Security Update : ruby19 (openSUSE-SU-2013:0376-1)
ruby19 was updated to fix various bugs and security issues: Update to 1.9.3 p385 bnc802406 - XSS exploit of RDoc documentation generated by rdoc CVE-2013-0256 - for other changes see /usr/share/doc/packages/ruby19/Changelog Update to 1.9.3 p327 bnc789983 - CVE-2012-5371 and plenty of other fixes...
openSUSE Security Update : rubygem-actionpack/activerecord-2_3 (openSUSE-SU-2012:0978-1)
3 Security issues were fixed in rails 2.3 core components. 2 NULL query issues where fixed in the actionpack gem. 1 SQL injection was fixed in the activerecord gem. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...
openSUSE Security Update : ruby (openSUSE-SU-2013:1393-1)
The ruby gemrc configured the gem installation source as http source, allowing man in the middle attacks if someone could provide a different address for rubygems.org. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...
