CVE-2014-5000

The CVE-2014-5000 issue affects the lawn-login Ruby gem (version 0.0.7), where the login function in lib/lawn.rb places credentials on the curl command line. This exposes sensitive information to local users who can enumerate the process list, enabling local plaintext password disclosure. The roo...

CVE-2014-4998

test/tcdatabase.rb in the lean-ruport gem 0.3.8 for Ruby places the mysql user password on the mysqldump command line, which allows local users to obtain sensitive information by listing the process...

CVE-2014-4994

lib/gyazo/client.rb in the gyazo gem 1.0.0 for Ruby allows local users to write to arbitrary files via a symlink attack on a temporary file, related to time-based filenames...

CVE-2014-4994

CVE-2014-4994 affects the gyazo Ruby gem (v1.0.0). The issue is in lib/gyazo/client.rb, where a symlink attack on a time-based temporary file allows local users to write to arbitrary files. The impact stated in connected sources is local access with partial integrity impact and no confidentiality...

CVE-2014-5003

chef/travis-cookbooks/cienvironment/perlbrew/recipes/default.rb in the ciborg gem 3.0.0 for Ruby allows local users to write to arbitrary files and gain privileges via a symlink attack on /tmp/perlbrew-installer...

CVE-2014-5003

The ciborg gem for Ruby (version 3.0.0) contains a local file-write race condition in /tmp/perlbrew-installer. A local attacker can exploit a symlink attack against the temporary file to overwrite arbitrary files with the ciborg process’ privileges. This is a local, low- to medium-severity issue ...

CVE-2014-4998

test/tcdatabase.rb in the lean-ruport gem 0.3.8 for Ruby places the mysql user password on the mysqldump command line, which allows local users to obtain sensitive information by listing the process...

CVE-2014-5001

CVE-2014-5001 affects the Ruby gem kcapifony (version 2.1.6) via the file lib/ksymfony1.rb . The underlying issue is that the program places database user passwords on the command line for the tools mysqldump , pg_dump , mysql , and psql , which allows local users to obtain sensitive information ...

PT-2018-4241

Name of the Vulnerable Software and Affected Versions kajam gem version 1.0.3.rc2 Description The issue allows local users to obtain sensitive information by listing the process, as the mysql user password is placed on the command line in the capture function and the mysql command line in the...

PT-2018-4236

Name of the Vulnerable Software and Affected Versions gyazo gem version 1.0.0 Description The issue allows local users to write to arbitrary files via a symlink attack on a temporary file, related to time-based filenames. This is due to a problem in the lib/gyazo/client.rb file. Recommendations F...

PT-2018-4244

Name of the Vulnerable Software and Affected Versions lynx gem versions prior to 1.0.0 Description The issue allows local users to obtain sensitive information by listing processes because the configured password is placed on command lines. As of version 1.0.0, the --password option is no longer...

CVE-2014-5002: Undefined Security Weakness

The lynx gem before 1.0.0 for Ruby places the configured password on command lines, which allows local users to obtain sensitive information by listing processes...

PT-2018-4239

Name of the Vulnerable Software and Affected Versions point-cli gem version 0.0.1 Description The issue allows local users to obtain sensitive information by listing the process, as credentials are placed on the curl command line in the lib/commands/setup.rb file of the point-cli gem for Ruby...

PT-2018-4245

Name of the Vulnerable Software and Affected Versions ciborg gem version 3.0.0 Description The issue concerns a /tmp file race condition in the chef/travis-cookbooks/ci environment/perlbrew/recipes/default.rb file of the ciborg gem. This allows a malicious local user to create a symlink attack on...

PT-2018-4234

Name of the Vulnerable Software and Affected Versions cap-strap gem version 0.1.5 Description The issue allows local users to obtain sensitive information by listing the process, as credentials are placed on the useradd command line in the lib/cap-strap/helpers.rb file of the cap-strap gem for...

PT-2018-4243

Name of the Vulnerable Software and Affected Versions kcapifony gem version 2.1.6 Description The issue allows local users to obtain sensitive database user passwords by listing the processes, as the passwords are placed on the command lines of mysqldump, pg dump, mysql, and psql. Recommendations...

PT-2018-4246

Name of the Vulnerable Software and Affected Versions brbackup gem version 0.1.1 Description The issue allows local users to obtain sensitive information, specifically the database password, by listing the process. This is because the database password is placed on the mysql command line in the...

PT-2018-4233

Name of the Vulnerable Software and Affected Versions codders-dataset gem version 1.3.2.1 Description The issue affects the lib/dataset/database/mysql.rb and lib/dataset/database/postgresql.rb files in the codders-dataset gem for Ruby. It allows local users to obtain sensitive information by...

Command injection vulnerability

VladTheEnterprising Gem for Ruby contains a flaw as the program creates temporary files insecurely. It is possible for a local attacker to use a symlink attack against the /tmp/my.cnf.targethost file they can overwrite arbitrary files, gain access to the MySQL root password, or inject arbitrary...

rails_admin ruby gem XSS vulnerability

An exploitable cross site scripting XSS vulnerability exists in the add filter functionality of the railsadmin rails gem version 1.2.0. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim's browser. An attacker can phish ...