Ruby Gem Arabic Prawn 0.0.1 Command Injection

Title: Remote Command Injection in Arabic Prawn 0.0.1 Ruby Gem Author: Larry W. Cashdollar, @larry0 Download Site: http://rubygems.org/gems/Arabic-Prawn CVE: 2014-2322 Date: 12/17/2013 In Arabic-Prawn-0.0.1/lib/stringutfsupport.rb, the following lines pass unsanitized input to the shell. 426 var ...

CVE-2013-4413

Directory traversal vulnerability in controller/concerns/renderredirect.rb in the Wicked gem before 1.0.1 for Ruby allows remote attackers to read arbitrary files via a %2E%2E%2F encoded dot dot slash in the step...

CVE-2013-4413

Directory traversal vulnerability in controller/concerns/renderredirect.rb in the Wicked gem before 1.0.1 for Ruby allows remote attackers to read arbitrary files via a %2E%2E%2F encoded dot dot slash in the step...

CVE-2013-4413

The Wicked gem for Ruby is affected by a directory traversal in controller/concerns/render_redirect.rb before version 1.0.1, where an attacker can read arbitrary files by sending a URL with encoded "../" sequences (via the_step parameter). Impact is reading arbitrary files; no exploitation detail...

Arabic Prawn Gem for Ruby lib/string_utf_support.rb User Input Handling Remote Command Injection

Arabic Prawn Gem for Ruby contains a flaw in the lib/stringutfsupport.rb file. The issue is due to the program failing to sanitize user input. This may allow a remote attacker to inject arbitrary commands. "lib/stringutfsupport.rb" in the Arabic Prawn 0.0.1 gem for Ruby allows remote attackers to...

Active Record: SQL injection

Background Active Record is a Ruby gem that allows database entries to be manipulated as objects. Description An Active Record method parameter can mistakenly be used as a scope. Impact A remote attacker could use specially crafted input to execute arbitrary SQL statements. Workaround The...

echor Gem for Ruby Process Listing Local Plaintext Credential Disclosure

echor Gem for Ruby contains a flaw that is due to the program exposing credential information in the system process listing. This may allow a local attacker to gain access to plaintext credential information...

echor Gem for Ruby backplane.rb perform_request Function Arbitrary Command Execution

Echor Gem for Ruby contains a flaw in backplane.rb in the performrequest function that is triggered when a semi-colon ; is injected into a username or password. This may allow a context-dependent attacker to inject arbitrary commands if the gem is used in a rails application...

CVE-2014-1234

CVE-2014-1234 affects the paratrooper-newrelic gem (Ruby) v1.0.1. A local attacker can obtain the X-Api-Key by listing the curl process, due to leakage in the process tree. Impact is local exposure of the API key. Public patches or mitigations are not detailed in the provided documents; refer to ...

CVE-2014-1233

The CVE-2014-1233 vulnerability affects the paratrooper-pingdom gem for Ruby (version 1.0.0). The exposed code path demonstrates that setup/teardown routines invoke curl to Pingdom API, passing App-Key and basic auth (username:password) in commands. This enables a local attacker to monitor the pr...

Command injection in Ruby Gem Webbynode 1.0.5.3

Title: Command injection in Ruby Gem Webbynode 1.0.5.3 Date: 11/11/2013 Author: Larry W. Cashdollar, @larry0 Download: http://rubygems.org/gems/webbynode Vulnerability Description: The following code located in: ./webbynode-1.0.5.3/lib/webbynode/notify.rb doesn't fully sanitize user supplied inpu...

Command injection vulnerability in Ruby Gem sprout 0.7.246

Title: Command injection vulnerability in Ruby Gem sprout 0.7.246 Date: 11/14/2013 Download: http://rubygems.org/gems/sprout, http://projectsprouts.org/ Vulnerability: The unpackzip function contains the following code: sprout-0.7.246/lib/sprout/archiveunpacker.rb 60 zipdir =...

[SECURITY] [DSA 2830-1] ruby-i18n security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2830-1 [email protected] http://www.debian.org/security/ Florian Weiemr December 30, 2013 http://www.debian.org/security/faq -...

Ruby will_paginate Gem跨站脚本漏洞

CVE ID:CVE-2013-6459 Ruby是跨平台、面向对象的动态类型编程语言。willpaginate是一个分页插件，提供将搜索结果进行分页显示的功能。 willpaginate gem for Ruby存在跨站脚本漏洞。远程攻击者可通过与生成的分页链接相关的输入利用该漏洞注入任意Web脚本或HTML。 0 willpaginate gem for Ruby 3.x 厂商补丁： Ruby ----- 厂商已经发布了升级补丁以修复此安全问题，补丁获取链接： https://github.com/mislav/willpaginate/releases/tag/v3.0.5...

CVE-2013-2119

Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service prevent application start or gain privileges by pre-creating a temporary "config" file in a directory with a predictable name in /tmp/ before it is used by the gem...

UBUNTU-CVE-2013-2119

Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service prevent application start or gain privileges by pre-creating a temporary "config" file in a directory with a predictable name in /tmp/ before it is used by the gem...

flukso4r Gem for Ruby /lib/flukso/R.rb任意命令执行漏洞

flukso4r Gem for Ruby是一款Flukso API库。 flukso4r Gem for Ruby /lib/flukso/R.rb不正确过滤用户提交的输入，允许远程攻击者利用漏洞提交特意输入，并以应用程序上下文执行。 0 flukso4r Gem for Ruby 0.3.8 目前没有详细解决方案提供： http://rubygems.org/gems/flukso4r...

CVE-2013-2119

Phusion Passenger gem vulnerability (CVE-2013-2119) affects Phusion Passenger for Ruby, specifically the gem versions before 3.0.21 and 4.0.x before 4.0.5. The issue arises from insecure handling of temporary directories/files in /tmp, where a local attacker can pre-create a predictable temporary...

CVE-2013-6459

Cross-site scripting XSS vulnerability in the willpaginate gem before 3.0.5 for Ruby allows remote attackers to inject arbitrary web script or HTML via vectors involving generated pagination links...

DEBIAN-CVE-2013-6459

Cross-site scripting XSS vulnerability in the willpaginate gem before 3.0.5 for Ruby allows remote attackers to inject arbitrary web script or HTML via vectors involving generated pagination links...