RubyGems Paperclip Excessive Logging Content Spoofing Vulnerability

RubyGems Paperclip is a plugin for extending ActiveRecord ORM model and providing simple file attachment functionality. A content spoofing vulnerability exists in RubyGems Paperclip versions 4.2.2 through 4.3.5. An attacker can exploit this vulnerability to spoof content...

RubyGems Administrate Cross-Site Request Forgery Vulnerability

RubyGems is a Ruby package manager organized by RubyGems.Administrate is one of the plugins that supports developers to customize the content. A cross-site request forgery vulnerability exists in RubyGems Administrate versions prior to 0.1.5. An attacker could use this vulnerability to perform...

Unspecified vulnerability in RubyGems ruby-saml

RubyGems ruby-saml is a set of SAML Security Assertion Markup Language development toolkits for the Ruby on Rails framework organized by RubyGems. A security vulnerability exists in RubyGems Ruby-saml versions prior to 1.3.0. An attacker could exploit this vulnerability to perform an XML signatur...

Dungeon Gems - Customized SSL, Dangerous filesystem permissions, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application Dungeon Gems published at the 'play' market has multiple vulnerabilities...

Gems Fever - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Gems Fever published at the 'play' market has multiple vulnerabilities...

Jackpot Gems - Customized SSL, Dangerous filesystem permissions, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application Jackpot Gems published at the 'play' market has multiple vulnerabilities...

Rack-Bug - Debugging Toolbar For Rack Applications Implemented As Middleware

Rack::Bug adds a diagnostics toolbar to Rack apps. When enabled, it injects a floating div allowing exploration of logging, database queries, template rendering times, etc. Features Password-based security IP-based security Rack::Bug instrumentation/reporting is broken up into panels. Panels in...

rubygems: DNS hijacking vulnerability in api_endpoint()

A flaw was found in a way rubygems verified the API endpoint hostname retrieved through a DNS SRV record. A man-in-the-middle attacker could use this flaw to force a client to download content from an untrusted domain...

RubyGems Paperclip Input Validation Vulnerability

RubyGems Paperclip is a file attachment management library for Active Record. RubyGems Paperclip fails to adequately filter user-submitted input, allowing remote attackers to manipulate pages and spoof content...

RubyGems Patches Serious Redirection Vulnerability

RubyGems make life easier for developers to distribute software to users. A vulnerability in the Ruby package manager could make life easier for hackers to redirect victims to trouble. Disclosed today by researchers at Trustwave and OpenDNS, the vulnerability, CVE-2015-3900, enables an attacker t...

RubyGems BSON Denial of Service Vulnerability (CNVD-2015-03762)

RubyGems or gems for short is a Ruby packaging system for packaging Ruby components. A denial of service vulnerability exists in RubyGems BSON. This vulnerability allows attackers to launch denial of service attacks...

RubyGems BSON Denial of Service Vulnerability (CNVD-2015-03761)

RubyGems gems is a Ruby packaging system for packaging Ruby components. A denial of service vulnerability exists in RubyGems BSON. This vulnerability can be exploited to launch a denial of service attack...

RubyGems xaviershay-dm-rails 'storage.rb' MySQL Information Disclosure Vulnerability

RubyGems xaviershay-dm-rails is a Ruby application. A security vulnerability in RubyGems xaviershay-dm-rails 'storage.rb' allows remote attackers to exploit a vulnerability to obtain sensitive MySQL authentication credential information...

CVE-2013-0334

Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source...

Code injection

Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source...

CVE-2013-0334

Removed by vendor...

CVE-2013-0334 rubygem-bundler: 'bundle install' may install a gem from a source other than expected

Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source. A flaw was found in the way Bundler handled gems available from multiple sources. An attacker with access...

Adobe Acrobat Reader - ASLR/DEP Bypass Exploit with SANDBOX BYPASS

No description provided by source. CVE-2013-0640/1 Somehow, our script got on to the Russian forums :/ @w3bd3vil and @abh1sek Exploit-DB mirror: http://www.exploit-db.com/sploits/29881.tar.gz Adobe Acrobat Reader ASLR/DEP bypass Exploit with SANDBOX BYPASS...

Different Ruby gems security vulnerabilities

Crossite scripting, code execution, information leakage...

rubygems: version regex algorithmic complexity vulnerability

A denial of service vulnerability exists in the RubyGems versions 2.0.7 or older, such that when RubyGems validates versioning it performs a wrong regular expression causing resource consumption due to algorithmic complexity...