CVE-2013-0175

CVE-2013-0175 affects the multi_xml gem (v0.5.2) used by Grape prior to v0.2.6. The vulnerability stems from improper restriction of string casts, allowing remote object-injection and potential code execution, or DoS via nested XML entity refs, leveraging YAML type conversion or Symbol type conve...

CVE-2013-0233

CVE-2013-0233 concerns the Devise gem for Ruby. Affected versions (2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4) may mishandle type conversion during database queries when used with certain databases, potentially allowing remote attackers to obtain incorrect ...

CVE-2013-0233

Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass...

PT-2013-2146

Name of the Vulnerable Software and Affected Versions multi xml gem version 0.5.2 Grape versions prior to 0.2.6 Description The issue allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service involving nested XML entity references. This c...

PT-2013-3482

Name of the Vulnerable Software and Affected Versions kelredd-pruview gem version 0.3.8 Description The issue allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument to files such as document.rb, video.rb, or video image.rb. Recommendations...

Ruby Gem md2pdf Command Injection Vulnerability

Ruby Gem md2pdf suffers from a remote command injection vulnerability. Remote command injection md2pdf ruby gem 4/10/2013 Description: "creates pdf documents from markdown documents" https://rubygems.org/gems/md2pdf In md2pdf/converter.rb we see user supplied input being passed to the command lin...

Ruby Gem md2pdf Command Injection

Remote command injection md2pdf ruby gem 4/10/2013 Description: "creates pdf documents from markdown documents" https://rubygems.org/gems/md2pdf In md2pdf/converter.rb we see user supplied input being passed to the command line with out proper sanitization. 12 shell.exec"pandocoptions inputfilena...

Ruby Gem kelredd-pruview 0.3.8 Command Injection Vulnerability

Ruby Gem kelredd-pruview version 0.3.8 suffers from a remote command injection vulnerability. Remote command injection in Ruby Gem kelredd-pruview 0.3.8 Larry W. Cashdollar 4/4/2013 @larry0 Description: "A gem to ease generating image previews thumbnails of various files."...

Ruby Gem kelredd-pruview 0.3.8 Command Injection

Remote command injection in Ruby Gem kelredd-pruview 0.3.8 Larry W. Cashdollar 4/4/2013 @larry0 Description: "A gem to ease generating image previews thumbnails of various files." https://rubygems.org/gems/kelredd-pruview Remote commands can be executed if the file name contains shell meta...

Ruby Gem Karteek Docsplit 0.5.4 Command Injection Vulnerability

Ruby Gem Karteek Docsplit version 0.5.4 fails to sanitize user-supplied input. If a user is tricked into extracting a file with shell characters in the name, code can be executed remotely. Remote Command Injection Ruby Gem Karteek Docsplit 0.5.4 4/1/2013 Larry W. Cashdollar @larry0 User supplied...

Ruby Gem Karteek Docsplit 0.5.4 Command Injection

Remote Command Injection Ruby Gem Karteek Docsplit 0.5.4 4/1/2013 Larry W. Cashdollar @larry0 User supplied input isn't sanitized against shell metacharacters and is fed directly to the shell. If the user is tricked into extracting a file with shell characters in the name code can be executed...

CVE-2013-1800

The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service memory and CPU consumption by leveraging Action Pack support for 1 YAML type...

CVE-2013-1802

The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service memory and CPU consumption by leveraging Action Pack support for 1 YAML typ...

DEBIAN-CVE-2013-1800

The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service memory and CPU consumption by leveraging Action Pack support for 1 YAML type...

DEBIAN-CVE-2013-1802

The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service memory and CPU consumption by leveraging Action Pack support for 1 YAML typ...

CVE-2013-1802

The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service memory and CPU consumption by leveraging Action Pack support for 1 YAML typ...

CVE-2013-0285

The nori gem 2.0.x before 2.0.2, 1.1.x before 1.1.4, and 1.0.x before 1.0.3 for Ruby does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service memory and CPU consumption involving...

UBUNTU-CVE-2013-0285

The nori gem 2.0.x before 2.0.2, 1.1.x before 1.1.4, and 1.0.x before 1.0.3 for Ruby does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service memory and CPU consumption involving...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the omniauth-oauth2 gem 1.1.1 and earlier for Ruby allows remote attackers to hijack the authentication of users for requests that modify session state...

UBUNTU-CVE-2013-1802

The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service memory and CPU consumption by leveraging Action Pack support for 1 YAML typ...