Security Bulletin: Vulnerabilities in Ruby on Rails affect IBM License Metric Tool v9 and IBM BigFix Inventory v9 (CVE-2016-2098 CVE-2016-2097)

Summary Vulnerabilities discovered in Ruby on Rails component affect IBM License Metric Tool v9 and IBM BigFix Inventory v9. Vulnerability Details CVEID: CVE-2016-2098 DESCRIPTION: Ruby on Rails could allow a remote attacker to execute arbitrary code on the system, caused by improper validation o...

Security Bulletin: Vulnerabilities in Ruby on Rails affect IBM License Metric Tool and IBM Endpoint Manager for Software Use Analysis (CVE-2015-3226)

Summary A vulnerability in ActiveSupport component of Ruby on Rails framework used by IBM License Metric Tool and IBM Endpoint Manager for Software Use Analysis allows for stealing authentication cookies with cross-site scripting attack . Vulnerability Details CVEID: CVE-2015-3226 DESCRIPTION:...

[SECURITY] [DLA 3077-1] ruby-tzinfo security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3077-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb August 18, 2022 https://wiki.debian.org/LTS -...

Huawei EulerOS: Security Advisory for ruby (EulerOS-SA-2022-2248)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for ruby (EulerOS-SA-2022-2261)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DLA-3077-1 : ruby-tzinfo - LTS security update

The remote Debian 10 host has a package installed that is affected by a vulnerability as referenced in the dla-3077 advisory. - TZInfo is a Ruby library that provides access to time zone data and allows times to be converted using time zone rules. Versions prior to 0.36.1, as well as those prior ...

DLA-3077-1 ruby-tzinfo - security update

Bulletin has no description...

EulerOS 2.0 SP10 : ruby (EulerOS-SA-2022-2248)

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float...

EulerOS 2.0 SP10 : ruby (EulerOS-SA-2022-2261)

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float...

CVE-2022-36006

Arvados is an open source platform for managing, processing, and sharing genomic and other large scientific and biomedical data. A remote code execution RCE vulnerability in the Arvados Workbench allows authenticated attackers to execute arbitrary code via specially crafted JSON payloads. This...

Remote code execution

Arvados is an open source platform for managing, processing, and sharing genomic and other large scientific and biomedical data. A remote code execution RCE vulnerability in the Arvados Workbench allows authenticated attackers to execute arbitrary code via specially crafted JSON payloads. This...

GLSA-202208-28 : Puma: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202208-28 Puma: Multiple Vulnerabilities - Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been...

Mageia: Security Advisory (MGASA-2022-0280)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-36006

CVE-2022-36006 affects Arvados Workbench (Ruby on Rails Workbench 1). The vulnerability allows an authenticated attacker to execute arbitrary code via specially crafted JSON payloads, affecting all Arvados versions up to 2.4.1 and fixed in 2.4.2. Affected component is the Workbench 1 app; Workben...

CVE-2022-36006 Authenticated remote code execution due to insecure deserialization (GHSL-2022-063)

Arvados is an open source platform for managing, processing, and sharing genomic and other large scientific and biomedical data. A remote code execution RCE vulnerability in the Arvados Workbench allows authenticated attackers to execute arbitrary code via specially crafted JSON payloads. This...

CVE-2022-36006 Authenticated remote code execution due to insecure deserialization (GHSL-2022-063)

Arvados is an open source platform for managing, processing, and sharing genomic and other large scientific and biomedical data. A remote code execution RCE vulnerability in the Arvados Workbench allows authenticated attackers to execute arbitrary code via specially crafted JSON payloads. This...

PT-2022-23105 · Unknown +1 · Ruby On Rails +1

Name of the Vulnerable Software and Affected Versions: Arvados versions prior to 2.4.2 Description: Arvados is an open source platform for managing, processing, and sharing genomic and other large scientific and biomedical data. A remote code execution vulnerability in the Arvados Workbench allow...

Puma: Multiple Vulnerabilities

Background Puma is a simple, fast, threaded, and highly concurrent HTTP 1.1 server for Ruby/Rack. Description Multiple vulnerabilities have been discovered in Puma. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details...

MGASA-2022-0280 Updated ruby-sinatra packages fix security vulnerability

Sinatra before 2.2.0 does not validate that the expanded path matches publicdir when serving static files. CVE-2022-29970...

Activerecord update_by_case SQL注入漏洞

Activerecord updatebycase is a Ruby on Rails tool for updating many records with case values from a single database hit. A SQL injection vulnerability exists in Activerecord updatebycase prior to version 0.1.3, which stems from updatebycase using a customized sql string that is not cleaned up...