19576 matches found
CVE-2023-51774
The json-jwt aka JSON::JWT gem 1.16.3 for Ruby sometimes allows bypass of identity checks via a sign/encryption confusion attack. For example, JWE can sometimes be used to bypass JSON::JWT.decode...
CVE-2023-51774: Improper Access Control
The json-jwt aka JSON::JWT gem 1.16.3 for Ruby sometimes allows bypass of identity checks via a sign/encryption confusion attack. For example, JWE can sometimes be used to bypass JSON::JWT.decode...
CVE-2023-51774
Removed by vendor...
Active Admin security vulnerability
Active Admin is Active Admin open source a Ruby on Rails framework . It is used to create the backend for website management. A security vulnerability exists in versions prior to Active Admin 3.2.0, which stems from a csv injection vulnerability in the file csvbuilder.rb...
CVE-2023-50727
Resque is a Redis-backed Ruby library for creating background jobs, placing them on multiple queues, and processing them later. Reflected XSS issue occurs when /queues is appended with /". This issue has been patched in version 2.6.0...
Cross site scripting
Resque is a Redis-backed Ruby library for creating background jobs, placing them on multiple queues, and processing them later. Reflected XSS issue occurs when /queues is appended with /". This issue has been patched in version 2.6.0...
CVE-2023-50725
Resque is a Redis-backed Ruby library for creating background jobs, placing them on multiple queues, and processing them later. The following paths in resque-web have been found to be vulnerable to reflected XSS: "/failed/?class=alertdocument.cookie" and "/queues/". This issue has been patched in...
CVE-2023-50727 Resque vulnerable to reflected XSS in Queue Endpoint
Resque is a Redis-backed Ruby library for creating background jobs, placing them on multiple queues, and processing them later. Reflected XSS issue occurs when /queues is appended with /". This issue has been patched in version 2.6.0...
CVE-2023-50727 Resque vulnerable to reflected XSS in Queue Endpoint
Resque is a Redis-backed Ruby library for creating background jobs, placing them on multiple queues, and processing them later. Reflected XSS issue occurs when /queues is appended with /". This issue has been patched in version 2.6.0...
CVE-2023-50727 Resque vulnerable to reflected XSS in Queue Endpoint
Resque is a Redis-backed Ruby library for creating background jobs, placing them on multiple queues, and processing them later. Reflected XSS issue occurs when /queues is appended with /". This issue has been patched in version 2.6.0...
CVE-2023-50727
CVE-2023-50727 concerns a reflected XSS vulnerability in the Resque (Ruby) web interface. The issue arises when the /queues endpoint is appended with a crafted string (for example, current_queue path manipulation like ">). Affected software is Resque prior to version 2.6.0; the vulnerability i...
CVE-2023-50725 Resque vulnerable to reflected XSS in resque-web failed and queues lists
Resque is a Redis-backed Ruby library for creating background jobs, placing them on multiple queues, and processing them later. The following paths in resque-web have been found to be vulnerable to reflected XSS: "/failed/?class=alertdocument.cookie" and "/queues/". This issue has been patched in...
CVE-2023-50725 Resque vulnerable to reflected XSS in resque-web failed and queues lists
Resque is a Redis-backed Ruby library for creating background jobs, placing them on multiple queues, and processing them later. The following paths in resque-web have been found to be vulnerable to reflected XSS: "/failed/?class=alertdocument.cookie" and "/queues/". This issue has been patched in...
CVE-2023-50725
CVE-2023-50725 affects the Resque library’s web UI (resque-web) where two paths, “/failed/?class=” and “/queues/>”, allow reflected XSS. The root cause is improper input validation on those endpoints. Impact stated across sources: remote authenticated attacker could lure a user to click a craf...
ruby-hotels.com Cross Site Scripting vulnerability OBB-3819943
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2023-48795
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted from the extension negotiation message, and a client and server may consequently end up with a connecti...
SUSE CVE-2015-8314
The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persistent application access...
ruby:fuzz_ruby_gems: Heap-use-after-free in iseq_compile_each0
Project: https://github.com/ruby/ruby.git Detailed Report: https://oss-fuzz.com/testcase?key=4605946869186560 Project: ruby Fuzzing Engine: honggfuzz Fuzz Target: fuzzrubygems Job Type: honggfuzzasanruby Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x612000024408 Crash...