4343 matches found
UBUNTU-CVE-2018-1000078
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripting XSS vulnerability in gem server display of homepage attribute that can...
rack-protection gem timing attack vulnerability when validating CSRF token
Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to hav...
bson is vulnerable to denial of service due to incorrect regex validation
BSON injection vulnerability in the legal function in BSON bson-ruby gem before 3.0.4 for Ruby allows remote attackers to cause a denial of service resource consumption or inject arbitrary data via a crafted string...
GHSA-PXR8-W3JQ-RCWJ rails_admin ruby gem XSS
An exploitable cross site scripting XSS vulnerability exists in the add filter functionality of the railsadmin rails gem version 1.2.0. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim's browser. An attacker can phish ...
rails_admin ruby gem XSS
An exploitable cross site scripting XSS vulnerability exists in the add filter functionality of the railsadmin rails gem version 1.2.0. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim's browser. An attacker can phish ...
GHSA-VQCM-7F7F-R539 brbackup exposes database password to unauthorized users
lib/brbackup.rb in the brbackup gem 0.1.1 for Ruby places the database password on the mysql command line, which allows local users to obtain sensitive information by listing the process...
brbackup exposes database password to unauthorized users
lib/brbackup.rb in the brbackup gem 0.1.1 for Ruby places the database password on the mysql command line, which allows local users to obtain sensitive information by listing the process...
delayed_job_web Cross-site Scripting vulnerability
An exploitable cross site scripting XSS vulnerability exists in the filter functionality of the delayedjobweb rails gem versions 1.2.9 before 1.4.2. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim's browser. An attack...
GHSA-W7Q9-XR2X-WH7X delayed_job_web Cross-site Scripting vulnerability
An exploitable cross site scripting XSS vulnerability exists in the filter functionality of the delayedjobweb rails gem versions 1.2.9 before 1.4.2. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim's browser. An attack...
Ox gem stack overflow in sax_parse
In the Ox gem 2.8.1 for Ruby, the process crashes with a stack-based buffer over-read in the readfromstr function in saxbuf.c when a crafted input is supplied to saxparse...
GHSA-WFWM-CHJ7-W59R Ox gem stack overflow in sax_parse
In the Ox gem 2.8.1 for Ruby, the process crashes with a stack-based buffer over-read in the readfromstr function in saxbuf.c when a crafted input is supplied to saxparse...
rubygem-i18n: cross-site scripting flaw in exception handling
Cross-site scripting XSS vulnerability in exceptions.rb in the i18n gem before 0.6.6 for Ruby allows remote attackers to inject arbitrary web script or HTML via a crafted I18n::MissingTranslationData.new call...
RHEL 7 : ruby (RHSA-2018:0378)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0378 advisory. - ruby: Buffer underrun vulnerability in Kernel.sprintf CVE-2017-0898 - rubygems: Escape sequence in the summary field of gemspec...
rubygems: Arbitrary file overwrite due to incorrect validation of specification name
It was found that rubygems did not sanitize gem names during installation of a given gem. A specially crafted gem could use this flaw to install files outside of the regular directory...
rubygems: No size limit in summary length of gem spec
It was found that rubygems could use an excessive amount of CPU while parsing a sufficiently long gem summary. A specially crafted gem from a gem repository could freeze gem commands attempting to parse its summary...
rubygems: Unsafe object deserialization through YAML formatted gem specifications
A vulnerability was found where the rubygems module was vulnerable to an unsafe YAML deserialization when inspecting a gem. Applications inspecting gem files without installing them can be tricked to execute arbitrary code in the context of the ruby interpreter...
CVE-2017-16229
In the Ox gem 2.8.1 for Ruby, the process crashes with a stack-based buffer over-read in the readfromstr function in saxbuf.c when a crafted input is supplied to saxparse...
CVE-2017-16229
In the Ox gem 2.8.1 for Ruby, the process crashes with a stack-based buffer over-read in the readfromstr function in saxbuf.c when a crafted input is supplied to saxparse...
CVE-2017-16229
In the Ox gem 2.8.1 for Ruby, the process crashes with a stack-based buffer over-read in the readfromstr function in saxbuf.c when a crafted input is supplied to saxparse...
Stack overflow
In the Ox gem 2.8.1 for Ruby, the process crashes with a stack-based buffer over-read in the readfromstr function in saxbuf.c when a crafted input is supplied to saxparse...