4275 matches found
PT-2013-3399
Name of the Vulnerable Software and Affected Versions crack gem versions 0.3.1 and earlier Description The issue is related to the improper restriction of casts of string values, which could allow remote attackers to conduct object-injection attacks, execute arbitrary code, or cause a denial of...
PT-2013-3401
Name of the Vulnerable Software and Affected Versions extlib gem versions 0.9.15 and earlier Description The issue is related to the improper restriction of casts of string values, which could allow remote attackers to conduct object-injection attacks, execute arbitrary code, or cause a denial of...
PT-2013-2217
Name of the Vulnerable Software and Affected Versions nori gem versions 1.0.x through 1.0.2 nori gem versions 1.1.x through 1.1.3 nori gem versions 2.0.x through 2.0.1 Description The issue allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial o...
CVE-2013-1800: Undefined Security Weakness
The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service memory and CPU consumption by leveraging Action Pack support for 1 YAML type...
CVE-2013-1898: Improper Control of Generation of Code
lib/thumbshooter.rb in the Thumbshooter 0.1.5 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL...
Karteek Docsplit Gem for Ruby text_extractor.rb File Name Shell Metacharacter Injection Arbitrary Command Execution
Karteek Docsplit Gem for Ruby contains a flaw that is due to the program failing to properly sanitize input passed to textextractor.rb. With a specially crafted file name that contains shell metacharacters, a context-dependent attacker can execute arbitrary commands...
kelredd-pruview Gem for Ruby /lib/pruview/document.rb File Name Shell Metacharacter Injection Arbitrary Command Execution
kelredd-pruview Gem for Ruby contains a flaw in /lib/pruview/document.rb. The issue is triggered during the handling of a specially crafted file name that contains injected shell metacharacters. This may allow a context-dependent attacker to potentially execute arbitrary commands...
PT-2013-3464
Name of the Vulnerable Software and Affected Versions ldoce gem version 0.0.2 Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in an mp3 URL or file name. This is possible due to a flaw in the lib/ldoce/word.rb file of the ldoce gem for Ruby...
CVE-2013-1911
The CVE refers to the Ruby Gem ldoce (0.0.2). It explains that lib/ldoce/word.rb accepts an mp3 URL or filename and, if it contains shell metacharacters, can lead to remote command execution. The issue is triggered during handling of MP3 URLs/filenames, potentially allowing an attacker to run arb...
CVE-2013-1911: Improper Input Validation
lib/ldoce/word.rb in the ldoce 0.0.2 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in 1 an mp3 URL or 2 file name...
CVE-2013-1911
lib/ldoce/word.rb in the ldoce 0.0.2 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in 1 an mp3 URL or 2 file name...
rubygem-json: Denial of Service and SQL Injection
The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service resource consumption or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain...
Ruby Gem ldoce 0.0.2 Command Execution Vulnerability
Ruby Gem ldoce version 0.0.2 suffers from a command execution vulnerability. Remote command execution in Ruby Gem ldoce 0.0.2 Larry W. Cashdollar @larry0 3/25/2013 Ldoce Ruby Gem: Easily interface with the Longman Dictionary of Contemporary English API from Ruby: NB currently mac only as it depen...
Ruby Gem ldoce 0.0.2 Command Execution
Remote command execution in Ruby Gem ldoce 0.0.2 Larry W. Cashdollar @larry0 3/25/2013 Ldoce Ruby Gem: Easily interface with the Longman Dictionary of Contemporary English API from Ruby: NB currently mac only as it depends on the afplay command. https://github.com/markburns/ldoce Ldoce passes an...
ldoce Gem for Ruby MP3 URL Shell Metacharacter Injection Arbitrary Command Execution
ldoce Gem for Ruby contains a flaw that is triggered during the handling of a specially crafted URL or filename for MP3 files that have shell metacharacters injected in to it. This may allow a context-dependent attacker to execute arbitrary commands...
Ruby Thumbshooter Gem 0.1.5 Remote Command Execution
Ruby gem Thumbshooter 0.1.5 remote command execution 3/25/2013 Generates thumbshots of URLs by using Webkit and QT4. https://github.com/digineo/thumbshooter Specially crafted URLs can result in remote code execution if the URL contains shell metacharacters. We see that the url is passed directly ...
Thumbshooter Gem for Ruby thumbshooter.rb URL Shell Metacharacter Injection Arbitrary Command Execution
Thumbshooter Gem for Ruby contains a flaw that is due to the program failing to properly sanitize input passed to thumbshooter.rb. With a specially crafted URL that contains shell metacharacters, a context-dependent attacker can execute arbitrary commands...
CVE-2013-2617
lib/curl.rb in the Curl Gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL...
