19331 matches found
CVE-2019-18409
The rubyparser-legacy aka legacy gem 1.0.0 for Ruby allows local privilege escalation because of world-writable files. For example, if the brakeman gem which has a legacy dependency 4.5.0 through 4.7.0 is used, a local user can insert malicious code into the...
CVE-2022-31115
opensearch-ruby is a community-driven, open source fork of elasticsearch-ruby. In versions prior to 2.0.1 the ruby YAML.load function was used instead of YAML.safeload. As a result opensearch-ruby 2.0.0 and prior can lead to unsafe deserialization using YAML.load if the response is of type YAML. ...
CVE-2024-41961
Elektra is an opinionated Openstack Dashboard for Operators and Consumers of Openstack Services. A code injection vulnerability was found in the live search functionality of the Ruby on Rails based Elektra web application. An authenticated user can craft a search term containing Ruby code, which...
CVE-2024-39906
A command injection vulnerability was found in the IndieAuth functionality of the Ruby on Rails based Haven blog web application. The affected functionality requires authentication, but an attacker can craft a link that they can pass to a logged in administrator of the blog software. This leads t...
ruby:fuzz_regex: Use-after-poison in rb_ary_push
Project: https://github.com/ruby/ruby.git Detailed Report: https://oss-fuzz.com/testcase?key=5107851600396288 Project: ruby Fuzzing Engine: honggfuzz Fuzz Target: fuzzregex Job Type: honggfuzzasanruby Platform Id: linux Crash Type: Use-after-poison READ 8 Crash Address: 0x7eedc8583830 Crash State...
Moderate Photon OS Security Update - PHSA-2026-5.0-91-0733
Updates of 'samba-client', 'rubygem-aws-sdk-s3' packages of Photon OS have been released...
CVE-2026-22588
Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Authenticated Insecure Direct Object Reference IDOR vulnerability was identified that allows an authenticated user to retrieve other users’ address information by modifying ...
CVE-2026-22588 Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification
Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Authenticated Insecure Direct Object Reference IDOR vulnerability was identified that allows an authenticated user to retrieve other users’ address information by modifying ...
ruby:fuzz_ruby_parser: Crash in literal_hash
Project: https://github.com/ruby/ruby.git Detailed Report: https://oss-fuzz.com/testcase?key=5328702033690624 Project: ruby Fuzzing Engine: libFuzzer Fuzz Target: fuzzrubyparser Job Type: libfuzzerubsanruby Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7aa28f9efc08 Crash State:...
GHSA-J4PR-3WM6-XX2R vulnerabilities
Vulnerabilities for packages: ruby, jruby...
CVE-2025-61594 vulnerabilities
Vulnerabilities for packages: ruby, jruby...
GHSA-J4PR-3WM6-XX2R vulnerabilities
Vulnerabilities for packages: truffleruby, jruby, logstash, ruby...
CVE-2025-61594 vulnerabilities
Vulnerabilities for packages: truffleruby, jruby, logstash, ruby...
Moderate Photon OS Security Update - PHSA-2026-4.0-0942
Updates of 'aws-sdk-cpp', 'rubygem-aws-sdk-s3' packages of Photon OS have been released...
CVE-2026-22588: Authorization Bypass Through User-Controlled Key
Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 4.10.2, 5.0.7, 5.1.9, and 5.2.5, an Authenticated Insecure Direct Object Reference IDOR vulnerability was identified that allows an authenticated user to retrieve other users’ address information by modifying ...
CVE-2019-16060
The Airbrake Ruby notifier 4.2.3 for Airbrake mishandles the blacklistkeys configuration option and consequently may disclose passwords to unauthorized actors. This is fixed in 4.2.4 also, 4.2.2 and earlier are unaffected...
AlmaLinux 8 : ruby:3.3 (ALSA-2025:23062)
The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:23062 advisory. resolv: Denial of Service in resolv gem CVE-2025-24294 rexml: REXML denial of service CVE-2025-58767 Tenable has extracted the preceding description bloc...
AlmaLinux 9 : ruby:3.3 (ALSA-2025:23063)
The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:23063 advisory. resolv: Denial of Service in resolv gem CVE-2025-24294 rexml: REXML denial of service CVE-2025-58767 Tenable has extracted the preceding description bloc...
Debian: Security Advisory (DLA-4433-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...