CVE-2013-1800

The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service memory and CPU consumption by leveraging Action Pack support for 1 YAML type...

CVE-2013-1802

CVE-2013-1802 concerns the extlib gem for Ruby (0.9.15 and earlier). The vulnerability arises from improper restriction of casts of string values, allowing object-injection and potentially arbitrary code execution or denial of service via YAML type conversion or Symbol type conversion, similar to...

CVE-2013-0285

The CVE-2013-0285 entry concerns the nori gem for Ruby. Affected versions: nori 2.0.x before 2.0.2, 1.1.x before 1.1.4, and 1.0.x before 1.0.3. Root cause: improper restriction of casts for string values during YAML type conversion or Symbol type conversion, enabling remote object-injection attac...

CVE-2013-0285

The nori gem 2.0.x before 2.0.2, 1.1.x before 1.1.4, and 1.0.x before 1.0.3 for Ruby does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service memory and CPU consumption involving...

CVE-2013-1800

CVE-2013-1800 concerns the crack gem for Ruby (0.3.1 and earlier). The issue arises from improper restriction of casts of string values, enabling potential object-injection and arbitrary code execution, or a denial of service, via Action Pack support for YAML type conversion or Symbol type conver...

CVE-2013-1801

The httparty gem 0.9.0 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service memory and CPU consumption by leveraging Action Pack support for YAML type...

CVE-2013-1802

The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service memory and CPU consumption by leveraging Action Pack support for 1 YAML typ...

CVE-2012-6134

CVE-2012-6134: CSRF vulnerability in the Ruby gem omniauth-oauth2 (versions 1.1.1 and earlier) allows remote attackers to hijack user authentication for requests that modify session state. Affected component is the omniauth-oauth2 gem for Ruby; root cause is cross-site request forgery. Connected ...

CVE-2013-1801

Technical details for CVE-2013-1801 are not publicly available in the provided documents. No vendor/product/version specifics or remediation are disclosed here. Monitor for updates from official sources to obtain concrete details and fixes.

CVE-2013-1898

CVE-2013-1898 affects the Ruby Thumbshooter gem (version 0.1.5) via thumbshooter.rb. The flaw is an input sanitization issue where a URL containing shell metacharacters enables a remote attacker to execute arbitrary commands. The vulnerability arises from insufficient sanitization of URL input, a...

CVE-2013-1802

The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service memory and CPU consumption by leveraging Action Pack support for 1 YAML typ...

PT-2013-3400

Name of the Vulnerable Software and Affected Versions httparty gem version 0.9.0 and earlier Description The issue is related to the improper restriction of casts of string values, which could allow remote attackers to conduct object-injection attacks. This might lead to the execution of arbitrar...

Karteek Docsplit Gem for Ruby text_extractor.rb File Name Shell Metacharacter Injection Arbitrary Command Execution

Karteek Docsplit Gem for Ruby contains a flaw that is due to the program failing to properly sanitize input passed to textextractor.rb. With a specially crafted file name that contains shell metacharacters, a context-dependent attacker can execute arbitrary commands...

kelredd-pruview Gem for Ruby /lib/pruview/document.rb File Name Shell Metacharacter Injection Arbitrary Command Execution

kelredd-pruview Gem for Ruby contains a flaw in /lib/pruview/document.rb. The issue is triggered during the handling of a specially crafted file name that contains injected shell metacharacters. This may allow a context-dependent attacker to potentially execute arbitrary commands...

CVE-2013-1911

lib/ldoce/word.rb in the ldoce 0.0.2 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in 1 an mp3 URL or 2 file name...

CVE-2013-1911

The CVE refers to the Ruby Gem ldoce (0.0.2). It explains that lib/ldoce/word.rb accepts an mp3 URL or filename and, if it contains shell metacharacters, can lead to remote command execution. The issue is triggered during handling of MP3 URLs/filenames, potentially allowing an attacker to run arb...

rubygem-json: Denial of Service and SQL Injection

The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service resource consumption or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain...

Ruby Gem ldoce 0.0.2 Command Execution Vulnerability

Ruby Gem ldoce version 0.0.2 suffers from a command execution vulnerability. Remote command execution in Ruby Gem ldoce 0.0.2 Larry W. Cashdollar @larry0 3/25/2013 Ldoce Ruby Gem: Easily interface with the Longman Dictionary of Contemporary English API from Ruby: NB currently mac only as it depen...

Ruby Gem ldoce 0.0.2 Command Execution

Remote command execution in Ruby Gem ldoce 0.0.2 Larry W. Cashdollar @larry0 3/25/2013 Ldoce Ruby Gem: Easily interface with the Longman Dictionary of Contemporary English API from Ruby: NB currently mac only as it depends on the afplay command. https://github.com/markburns/ldoce Ldoce passes an...

ldoce Gem for Ruby MP3 URL Shell Metacharacter Injection Arbitrary Command Execution

ldoce Gem for Ruby contains a flaw that is triggered during the handling of a specially crafted URL or filename for MP3 files that have shell metacharacters injected in to it. This may allow a context-dependent attacker to execute arbitrary commands...