38 matches found
GHSA-GWRJ-88FP-5M36 Code injection in Narou
Narou aka Narou.rb before 3.8.0 allows Ruby Code Injection via the title name or author name of a novel...
CVE-2021-35514
Narou aka Narou.rb before 3.8.0 allows Ruby Code Injection via the title name or author name of a novel...
CVE-2021-35514
Narou aka Narou.rb before 3.8.0 allows Ruby Code Injection via the title name or author name of a novel...
CVE-2021-35514
Narou aka Narou.rb before 3.8.0 allows Ruby Code Injection via the title name or author name of a novel...
CVE-2021-35514
Narou aka Narou.rb before 3.8.0 allows Ruby Code Injection via the title name or author name of a novel...
CVE-2021-35514
Narou aka Narou.rb before 3.8.0 allows Ruby Code Injection via the title name or author name of a novel...
CVE-2021-35514
Narou (aka Narou.rb) up to version 3.8.0 is vulnerable to Ruby code injection via the title or author name fields of a novel. The underlying issue is untrusted code execution through these inputs, enabling code execution on the affected system. Affected software: Narou.rb (Ruby-based Narou). Root...
CVE-2021-35514: Improper Control of Generation of Code
Narou aka Narou.rb before 3.8.0 allows Ruby Code Injection via the title name or author name of a novel...
PT-2021-20949
Name of the Vulnerable Software and Affected Versions: Narou aka Narou.rb versions prior to 3.8.0 Description: The issue allows Ruby Code Injection via the title name or author name of a novel. Recommendations: For versions prior to 3.8.0, update to version 3.8.0 or later to resolve the issue...
CVE-2021-32096
The ConsoleAction component of U.S. National Security Agency NSA Emissary 5.9.0 allows a CSRF attack that results in injecting arbitrary Ruby code for an eval call via the CONSOLECOMMANDSTRING parameter...
CVE-2021-32096: Cross-Site Request Forgery (CSRF)
The ConsoleAction component of U.S. National Security Agency NSA Emissary 5.9.0 allows a CSRF attack that results in injecting arbitrary Ruby code for an eval call via the CONSOLECOMMANDSTRING parameter...
PT-2021-19664
Name of the Vulnerable Software and Affected Versions: Emissary version 5.9.0 Description: The issue allows for a CSRF attack, which can result in injecting arbitrary Ruby code via the CONSOLE COMMAND STRING parameter. This can lead to an eval call, potentially allowing an attacker to execute...
ClusterLabs Hawk Code Injection Vulnerability
Clusterlabs Crmsh is a command line software for GNU/Linux systems for high availability cluster management from the ClusterLabs Clusterlabs team. A code injection vulnerability exists in ClusterLabs Hawk 2.x through 2.3.0-x, which stems from a Ruby code injection in hawkremembermeid in the...
EulerOS Virtualization 3.0.6.0 : ruby (EulerOS-SA-2020-1717)
According to the versions of the ruby packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in Oniguruma 6.x before 6.9.4rc2. In the function fetchintervalquantifier formerly known as...
DEBIAN-CVE-2019-16255
Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument aka the "command" argument to Shell or Shelltest in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method...
PT-2016-3337
Name of the Vulnerable Software and Affected Versions Bundler versions 1.x Description The issue is related to a gem name collision on a secondary source, which could allow remote attackers to inject arbitrary Ruby code into an application. This might lead to unauthorized access to confidential...
