Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via unsanitized interpolation of the branch setting in the Gemfile generation process. An attacker can execute arbitrary Ruby code by crafting a malicious .vscode/settings.json or equivalent workspace...

PT-2026-28598

Name of the Vulnerable Software and Affected Versions ruby-lsp versions prior to 0.10.2 ruby-lsp gem versions prior to 0.26.9 Description The rubyLsp.branch VS Code workspace setting was used in generating a Gemfile without proper sanitization, potentially allowing arbitrary Ruby code execution...

Ruby LSP has arbitrary code execution through branch setting

Summary The rubyLsp.branch VS Code workspace setting was interpolated without sanitization into a generated Gemfile, allowing arbitrary Ruby code execution when a user opens a project containing a malicious .vscode/settings.json. Other editors that support workspace setting that get automatically...

EUVD-2021-2513

Malware in sbrugna...

rubygem-bundler: unexpected code execution in Gemfiles

Bundler is a package for managing application dependencies in Ruby. In bundler versions before 2.2.33, when working with untrusted and apparently harmless Gemfile's, it is not expected that they lead to execution of external code, unless that's explicit in the ruby code inside the Gemfile itself...

Linux Distros Unpatched Vulnerability : CVE-2021-43809

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bundler is a package for managing application dependencies in Ruby. In bundler versions before 2.2.33, when working with untrusted and apparently harmless...

SUSE: Security Advisory (SUSE-SU-2024:3873-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security update for rubygem-bundler

This update for rubygem-bundler fixes the following issues: CVE-2021-43809: Fixed remote execution via Gemfile argument injection bsc1193578 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you ca...

SUSE-SU-2024:3873-1 Security update for rubygem-bundler

This update for rubygem-bundler fixes the following issues: - CVE-2021-43809: Fixed remote execution via Gemfile argument injection bsc1193578...

Webpay E-Commerce 1.0 Directory Traversal

============================================================================================================================================= | Title : Webpay E-Commerce v1.0 Directory traversal Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox...

StringIO buffer overread vulnerability

An issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return the memory value. This vulnerability is not affected...

RCE vulnerability with .rdoc_options in RDoc

An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. When parsing .rdocoptions used for configuration in RDoc as a YAML file, object injection and resultant remote code execution are possible because there are no restrictions on the classes that can be...

Humhub 1.3.13 Directory Traversal

==================================================================================================================================== | Title : Humhub v1.3.13 Directory traversal Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 67.032-bit |...

SUSE CVE-2021-43809

Bundler is a package for managing application dependencies in Ruby. In bundler versions before 2.2.33, when working with untrusted and apparently harmless Gemfile's, it is not expected that they lead to execution of external code, unless that's explicit in the ruby code inside the Gemfile itself...

OESA-2022-1934 rubygem-bundler security update

Security Fixes: Bundler is a package for managing application dependencies in Ruby. In bundler versions before 2.2.33, when working with untrusted and apparently harmless Gemfile's, it is not expected that they lead to execution of external code, unless that's explicit in the ruby code inside the...

CVE-2022-29176 Unauthorized gem takeover for some gems on rubygems.org

Rubygems is a package registry used to supply software for the Ruby language ecosystem. Due to a bug in the yank action, it was possible for any RubyGems.org user to remove and replace certain gems even if that user was not authorized to do so. To be vulnerable, a gem needed: one or more dashes i...

Bundler code injection vulnerability

Bundler is a package for managing application dependencies in Ruby. It provides a consistent environment for Ruby projects by tracking and installing the exact gem and version required. Bundler suffers from a code injection vulnerability that stems from the fact that when using Gemfile, an attack...

Arbitrary Code Execution

Overview Affected versions of this package are vulnerable to Arbitrary Code Execution via a Gemfile that includes gem entries that use the git option with invalid values with a leading dash. The attacker has to craft a directory containing a Gemfile file that declares a dependency that is located...

Arbitrary Code Execution

bundler is vulnerable to arbitrary code execution. An attacker can execute malicious code through the argument injection via a dash leading git URL parameter in Gemfile...

Local Code Execution through Argument Injection via dash leading git url parameter in Gemfile.

In bundler versions before 2.2.33, when working with untrusted and apparently harmless Gemfile's, it is not expected that they lead to execution of external code, unless that's explicit in the ruby code inside the Gemfile itself. However, if the Gemfile includes gem entries that use the git optio...