17251 matches found
CVE-2022-45301
CVE-2022-45301 affects Chocolatey Ruby package versions 3.1.2.1 and earlier, where the directory C:\tools\ruby31 and all files within are writable by all users in the Authenticated Users group due to insecure permissions. The connected sources (Red Hat, CNVD/CNNVD, NVD, CVE listing, and vulnerabi...
CVE-2022-45442
Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download RFD attack that sets the Content-Disposition header of a response when the filename is...
Input validation
Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download RFD attack that sets the Content-Disposition header of a response when the filename is...
CVE-2022-45442
Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download RFD attack that sets the Content-Disposition header of a response when the filename is...
UBUNTU-CVE-2022-45442
Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download RFD attack that sets the Content-Disposition header of a response when the filename is...
Sinatra 安全漏洞
Sinatra is a DSL for easily creating web applications in Ruby. A security vulnerability exists in Sinatra version 2.0 up to and including version 2.2.3, and version 3.0 up to and including version 3.0.4, which stems from an application being vulnerable to a Reflected File Download RFD attack when...
CVE-2022-45442
Sinatra (Ruby) suffers a reflected file download (RFD) vulnerability where a response’s Content-Disposition header is derived from user-supplied input. Affected versions are 2.0.x before 2.2.3 and 3.0.x before 3.0.4; patches exist in 2.2.3 and 3.0.4. Remediation is to upgrade to those fixed relea...
CVE-2022-45442 Sinatra vulnerable to Reflected File Download attack
Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download RFD attack that sets the Content-Disposition header of a response when the filename is...
Slackware Linux 15.0 / current ruby Vulnerability (SSA:2022-328-01)
The version of ruby installed on the remote host is prior to 3.0.5 / 3.1.3. It is, therefore, affected by a vulnerability as referenced in the SSA:2022-328-01 advisory. - The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is releva...
Slackware: Security Advisory (SSA:2022-328-01)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[slackware-security] ruby
New ruby packages are available for Slackware 15.0 and -current to fix a security issue. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/ruby-3.0.5-i586-1slack15.0.txz: Upgraded. This release includes a security fix: HTTP response splitting in CGI. For more information,...
Oracle Linux 9 : yajl (ELSA-2022-8252)
The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-8252 advisory. - yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of yajl contain an integer overflow which leads to...
pcs security update
0.11.3-4 - Fixed ruby socket permissions - Resolves: rhbz2116841 0.11.3-3 - Fixed booth ticket mode value case insensitive - Fixed booth sync check whether /etc/booth exists - Resolves: rhbz2026725 rhbz2058243 0.11.3-2 - Fixed 'pcs resource restart' traceback - Resolves: rhbz2102663 0.11.3-1 -...
GHSA-VC47-6RQG-C7F5 vulnerabilities
Vulnerabilities for packages: ruby...
GHSA-VC47-6RQG-C7F5 vulnerabilities
Vulnerabilities for packages: ruby...
GHSA-VC47-6RQG-C7F5 HTTP response splitting in CGI
Ruby gem cgi.rb prior to versions 0.3.5, 0.2.2 and 0.1.0.2 allow HTTP header injection. If a CGI application using the CGI library inserts untrusted input into the HTTP response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to...
HTTP response splitting in CGI
Ruby gem cgi.rb prior to versions 0.3.5, 0.2.2 and 0.1.0.2 allow HTTP header injection. If a CGI application using the CGI library inserts untrusted input into the HTTP response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to...
Dalli 注入漏洞
Dalli is a high-performance pure Ruby client for accessing memcached servers by Peter Goldstein, a personal developer. Dalli suffers from an injection vulnerability that stems from an affected self.metaset function in the lib/dalli/protocol/meta/requestformatter.rb file of the component Meta...
CVE-2021-33621
The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object...