4343 matches found
Security Bulletin: IBM Security Network Protection System can be affected by vulnerabilities in Ruby on Rails and the Ruby language (CVE-2013-4492, CVE-2013-4164)
Summary IBM Security Network Protection System can be affected by vulnerabilities in Ruby on Rails and the Ruby language. These vulnerabilities include obtaining sensitive information, executing arbitrary code on the system or causing the application to crash. Vulnerability Details VULNERABILITY...
CVE-2018-3759
privateaddresscheck ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use TOCTOU race condition due to the address the socket uses not being checked. DNS entries with a TTL of 0 can trigger this case where the initial resolution is a public address but the subsequent resolution is a...
CVE-2018-3759
privateaddresscheck ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use TOCTOU race condition due to the address the socket uses not being checked. DNS entries with a TTL of 0 can trigger this case where the initial resolution is a public address but the subsequent resolution is a...
CVE-2018-3759
privateaddresscheck ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use TOCTOU race condition due to the address the socket uses not being checked. DNS entries with a TTL of 0 can trigger this case where the initial resolution is a public address but the subsequent resolution is a...
CVE-2018-3759
The CVE concerns the Ruby gem private_address_check (pre-0.5.0). It describes a TOCTOU race condition caused by not checking the socket’s destination address, where a DNS entry with TTL 0 can yield a public address initially and a private address subsequently. Multiple connected sources (GitHub a...
CVE-2018-3759: Concurrent Execution using Shared Resource with Improper Synchronization
privateaddresscheck ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use TOCTOU race condition due to the address the socket uses not being checked. DNS entries with a TTL of 0 can trigger this case where the initial resolution is a public address but the subsequent resolution is a...
PT-2018-16179
Name of the Vulnerable Software and Affected Versions private address check ruby gem versions prior to 0.5.0 Description The issue is related to a time-of-check time-of-use TOCTOU race condition. This occurs because the address the socket uses is not checked. Specifically, DNS entries with a TTL ...
Privilege Escalation Through DLL Preloading Attack
puppet gem is vulnerable to privilege escalation. It does not prevent the loading of DLL modules from the directories created by any authenticated users on Windows, thereby allowing the user to load attacker-controlled DLL modules...
gem-online.de XSS vulnerability
Open Bug Bounty ID: OBB-616548 Description| Value ---|--- Affected Website:| gem-online.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
private_address_check Ruby Gem Time-of-check Time-of-use race condition
privateaddresscheck ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use TOCTOU race condition due to the address the socket uses not being checked. DNS entries with a TTL of 0 can trigger this case where the initial resolution is a public address by the subsequent resolution is a...
rails-html-sanitizer Cross-site Scripting vulnerability
There is a possible XSS vulnerability in all rails-html-sanitizer gem versions below 1.0.4 for Ruby. The gem allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments, and these attributes can lead to an XSS attack on target applications...
GHSA-PX3R-JM9G-C8W8 rails-html-sanitizer Cross-site Scripting vulnerability
There is a possible XSS vulnerability in all rails-html-sanitizer gem versions below 1.0.4 for Ruby. The gem allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments, and these attributes can lead to an XSS attack on target applications...
gem-online.de XSS vulnerability
Open Bug Bounty ID: OBB-607918 Description| Value ---|--- Affected Website:| gem-online.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
CVE-2018-3741
There is a possible XSS vulnerability in all rails-html-sanitizer gem versions below 1.0.4 for Ruby. The gem allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments, and these attributes can lead to an XSS attack on target applications...
Debian: Security Advisory (DLA-1352-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Amazon Linux AMI : ruby20 / ruby22,ruby23,ruby24 (ALAS-2018-983)
Path traversal when writing to a symlinked basedir outside of the root RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal...
PT-2019-4502
Name of the Vulnerable Software and Affected Versions Linux kernel versions 4.14 through 4.14.165 Linux kernel versions 4.19 through 4.19.96 Linux kernel versions 5.x before 5.2 Description The issue is related to a use-after-free in the i915 ppgtt close function in drivers/gpu/drm/i915/i915 gem...
Low: ruby
Issue Overview: Command injection in lib/resolv.rb:lazyinitialize allows arbitrary code execution: The "lazyinitialize" function in lib/resolv.rb did not properly process certain filenames. A remote attacker could possibly exploit this flaw to inject and execute arbitrary commands. CVE-2017-17790...