Malicious code in ruby-style-guide (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 89cf2431bf1e33c39071abae67176324ffcd08f4b09f2abacaac469dd4c41f4c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5861 Malicious code in ruby-style-guide (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 89cf2431bf1e33c39071abae67176324ffcd08f4b09f2abacaac469dd4c41f4c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

[SECURITY] Fedora 35 Update: rubygem-jmespath-1.6.1-1.fc35

Implements JMESPath for Ruby...

[SECURITY] Fedora 36 Update: rubygem-jmespath-1.6.1-1.fc36

Implements JMESPath for Ruby...

Critical Photon OS Security Update - PHSA-2022-0199

Updates of 'ruby', 'vim' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2022-4.0-0199

Updates of 'vim', 'ruby' packages of Photon OS have been released...

Huawei EulerOS: Security Advisory for ruby (EulerOS-SA-2022-1915)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP5 : ruby (EulerOS-SA-2022-1915)

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float...

SUSE-SU-2022:2108-1 Security update for rubygem-actionpack-5_1, rubygem-activesupport-5_1

This update for rubygem-actionpack-51 and rubygem-activesupport-51 fixes the following issues: - CVE-2021-22904: Fixed possible DoS Vulnerability in Action Controller Token Authentication bsc1185780 - CVE-2022-23633: Fixed possible exposure of information vulnerability in Action Pack bsc1196182...

CVE-2022-31072

Octokit is a Ruby toolkit for the GitHub API. Versions 4.23.0 and 4.24.0 of the octokit gem were published containing world-writeable files. Specifically, the gem was packed with files having their permissions set to -rw-rw-rw- i.e. 0666 instead of rw-r--r-- i.e. 0644. This means everyone who is...

CVE-2022-31072

Octokit is a Ruby toolkit for the GitHub API. Versions 4.23.0 and 4.24.0 of the octokit gem were published containing world-writeable files. Specifically, the gem was packed with files having their permissions set to -rw-rw-rw- i.e. 0666 instead of rw-r--r-- i.e. 0644. This means everyone who is...

UBUNTU-CVE-2022-31072

Octokit is a Ruby toolkit for the GitHub API. Versions 4.23.0 and 4.24.0 of the octokit gem were published containing world-writeable files. Specifically, the gem was packed with files having their permissions set to -rw-rw-rw- i.e. 0666 instead of rw-r--r-- i.e. 0644. This means everyone who is...

CVE-2022-31072

The CVE affects the Ruby Octokit gem; versions 4.23.0 and 4.24.0 ship world-writable files (permissions 0666) instead of 0644, enabling modification by non-owners in affected environments. The root cause is improper packaging of files during these releases. A fix is available in Octokit 4.25.0. W...

CVE-2022-31072 Octokit gem published with world-writable files

Octokit is a Ruby toolkit for the GitHub API. Versions 4.23.0 and 4.24.0 of the octokit gem were published containing world-writeable files. Specifically, the gem was packed with files having their permissions set to -rw-rw-rw- i.e. 0666 instead of rw-r--r-- i.e. 0644. This means everyone who is...

CVE-2022-31072 Octokit gem published with world-writable files

Octokit is a Ruby toolkit for the GitHub API. Versions 4.23.0 and 4.24.0 of the octokit gem were published containing world-writeable files. Specifically, the gem was packed with files having their permissions set to -rw-rw-rw- i.e. 0666 instead of rw-r--r-- i.e. 0644. This means everyone who is...

CVE-2022-28739 affecting package ruby 2.6.9-1

CVE-2022-28739 affecting package ruby 2.6.9-1. An upgraded version of the package is available that resolves this issue...

Internet Bug Bounty: Rails::Html::SafeListSanitizer vulnerable to xss attack in an environment that allows the style tag

It seems to be a problem caused by a difference between the nokogiri java implementation and the ruby implementation. jruby9.3.3.0 nokogiri java, use Rails::Html::SafeListSanitizer.new.sanitize, allow select/style tag code tags = %wselect style puts...

Metasploit Weekly Wrap-Up

A Confluence of High-Profile Modules This release features modules covering the Confluence remote code execution bug CVE-2022-26134 and the hotly-debated CVE-2022-30190, a file format vulnerability in the Windows Operating System accessible through malicious documents. Both have been all over the...

Amazon Linux AMI : rubygem-nokogiri, rubygem18-nokogiri (ALAS-2022-1595)

The version of rubygem18-nokogiri installed on the remote host is prior to 1.5.11-1.16. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1595 advisory. Nokogiri is an open source XML and HTML library for Ruby. Nokogiri = 1.13.4. There are no known workarounds for this...

Mechanize 信息泄露漏洞

Mechanize is an open source ruby library from Sparkle Motion. It is used to automate interactions with websites. A security vulnerability exists in versions of Mechanize prior to 2.8.5 that stems from an authorization header that leaks after redirecting to a different port on the same site...