16883 matches found
There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character `|`.
...
GHSA-MR3Q-G2MV-MR4Q Sinatra is vulnerable to ReDoS through ETag header value generation
Summary There is a denial of service vulnerability in the If-Match and If-None-Match header parsing component of Sinatra, if the etag method is used when constructing the response and you are using Ruby = 3.2...
Sinatra is vulnerable to ReDoS through ETag header value generation
Summary There is a denial of service vulnerability in the If-Match and If-None-Match header parsing component of Sinatra, if the etag method is used when constructing the response and you are using Ruby = 3.2...
EUVD-2025-33767
Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there is a denial of service vulnerability in the If-Match and If-None-Match header parsing component of Sinatra, if the etag method is used when constructing the response. Carefully crafted...
ruby3.4-rubygem-rack-2.2-2.2.19-1.1 on GA media (moderate)
ruby3.4-rubygem-rack-2.2-2.2.19-1.1 on GA media Announcement ID: openSUSE-SU-2025:15621-1 Rating: moderate Cross-References: CVE-2025-61770 CVE-2025-61771 CVE-2025-61772 CVSS scores: CVE-2025-61770 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61770 SUSE : 8.7...
Sinatra is vulnerable to ReDoS through ETag header value generation
Summary There is a denial of service vulnerability in the If-Match and If-None-Match header parsing component of Sinatra, if the etag method is used when constructing the response and you are using Ruby = 3.2...
OPENSUSE-SU-2025:15623-1 ruby3.4-rubygem-rack-session-2.1.1-1.1 on GA media
These are all security issues fixed in the ruby3.4-rubygem-rack-session-2.1.1-1.1 package on the GA media of openSUSE Tumbleweed...
GHSA-W9PC-FMGC-VXVW vulnerabilities
Vulnerabilities for packages: ruby4.0-rack, ruby3.4-rack, ruby3.2-rack, ruby3.3-rack, gitlab-cng...
CVE-2025-61770 vulnerabilities
Vulnerabilities for packages: ruby4.0-rack, ruby3.4-rack, ruby3.2-rack, ruby3.3-rack, gitlab-cng...
CVE-2025-61771 vulnerabilities
Vulnerabilities for packages: ruby4.0-rack, ruby3.4-rack, ruby3.2-rack, ruby3.3-rack, gitlab-cng...
GHSA-P543-XPFM-54CP vulnerabilities
Vulnerabilities for packages: ruby4.0-rack, ruby3.4-rack, ruby3.2-rack, ruby3.3-rack, gitlab-cng...
Fedora 44 : rubygem-actioncable / rubygem-actionmailbox / rubygem-actionmailer / etc (2025-6e5c27d218)
The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2025-6e5c27d218 advisory. Update to Ruby on Rails 8.0.3 Fix CVE-2025-24293: Active Storage allowed transformation methods potentially unsafe Fix CVE-2025-55193: ANSI escape...
libruby3_4-3_4-3.4.7-1.1 on GA media (moderate)
libruby34-34-3.4.7-1.1 on GA media Announcement ID: openSUSE-SU-2025:15614-1 Rating: moderate Cross-References: CVE-2025-61594 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...
OPENSUSE-SU-2025:15621-1 ruby3.4-rubygem-rack-2.2-2.2.19-1.1 on GA media
These are all security issues fixed in the ruby3.4-rubygem-rack-2.2-2.2.19-1.1 package on the GA media of openSUSE Tumbleweed...
Security Bulletin: Multiple vulnerabilities in IBM Aspera Faspex
Summary Multiple vulnerabilities were addressed in IBM Aspera Faspex version 5.0.14. Vulnerability Details CVEID:CVE-2025-55193 DESCRIPTION: Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may ...
rexml: REXML ReDoS vulnerability
A flaw was found in the ReXML XML toolkit for Ruby. Parsing XML data containing a large number of digits between & and x...; in a hex numeric character reference &x...; can trigger a regular expression denial of service ReDoS condition, leading to a denial of service...
rexml: REXML: Denial of Service via inefficient regex parsing
A flaw was found in REXML. A remote attacker could exploit inefficient regular expression regex parsing when processing hex numeric character references &x...; in XML documents. This could lead to a Regular Expression Denial of Service ReDoS, impacting the availability of the affected component...
rexml: REXML: Denial of Service via inefficient regex parsing
A flaw was found in REXML. A remote attacker could exploit inefficient regular expression regex parsing when processing hex numeric character references &x...; in XML documents. This could lead to a Regular Expression Denial of Service ReDoS, impacting the availability of the affected component...
Malicious Package
Overview concurrent-ruby is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...