MGASA-2022-0102 Updated ruby packages fix security vulnerability

Command injection in ruby bundler. CVE-2021-43809...

Command Injection

Overview git is a Ruby library that can be used to create, read and manipulate Git repositories by wrapping system calls to the git binary. Affected versions of this package are vulnerable to Command Injection via git argument injection. When calling the fetchremote = 'origin', opts = function, t...

Debian: Security Advisory (DLA-2943-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

AlmaLinux 8 : ruby:2.5 (ALSA-2022:0672)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:0672 advisory. rubygem-rdoc: Command injection vulnerability in RDoc CVE-2021-31799 ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host...

AlmaLinux 8 : ruby:2.5 (ALSA-2022:0545)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:0545 advisory. rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source CVE-2020-36327 Tenable has extracted the preceding description...

AlmaLinux 8 : ruby:2.6 (ALSA-2022:0543)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:0543 advisory. rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source CVE-2020-36327 rubygem-rdoc: Command injection...

Debian DLA-2943-1 : ruby-sidekiq - LTS security update

The remote Debian 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-2943 advisory. - Sidekiq through 5.1.3 and 6.x through 6.2.0 allows XSS via the queue name of the live-poll feature when Internet Explorer is used. CVE-2021-30151 - In api.rb in...

[SECURITY] [DLA 2943-1] ruby-sidekiq security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-2943-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta March 10, 2022 https://wiki.debian.org/LTS -...

DLA-2943-1 ruby-sidekiq - security update

Bulletin has no description...

mruby 代码问题漏洞

mruby is a lightweight implementation of the Ruby language. mruby suffers from a buffer overflow vulnerability that stems from the presence of null pointer dereference in mruby, which could be exploited by an attacker to crash the mruby interpreter, thereby impacting system availability...

USN-5235-1: Ruby vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 18.04 Description It was discovered that Ruby incorrectly handled certain HTML files. An attacker could possibly use this issue to cause a crash. This issue only affected Ubuntu 20.04 LTS, Ubuntu 21.04, and Ubuntu 21.10...

Ruby on Rails 代码注入漏洞

Ruby on Rails is a set of open source web application frameworks based on the Ruby language from the Rails team. Ruby on Rails suffers from a code injection vulnerability that stems from incorrect input validation in the Active Storage module. A remote attacker can exploit the vulnerability to se...

Oracle Linux 8 : ELSA-2022-0672-1: / ruby:2.5 (ELSA-2022-06721)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-06721 advisory. - Properly fix command injection vulnerability in Rdoc. Related: CVE-2021-31799 - Fix command injection vulnerability in RDoc. Resolves: CVE-2021-3179...

Exploit for Path Traversal in Apache Http_Server

CVE-2021-41773 Description This script exploits CVE-2021-...

Exploit for Path Traversal in Apache Http_Server

CVE-2021-42013 Description This script exploits CVE-2021-...

ruby:2.5 security update

ruby 2.5.9-109.0.1 - Rebuild with a dependency containing fix for Orabug: 33921593 2.5.9-109 - Properly fix command injection vulnerability in Rdoc. Related: CVE-2021-31799 2.5.9-108 - Fix command injection vulnerability in RDoc. Resolves: CVE-2021-31799 - Fix StartTLS stripping vulnerability in...

PT-2022-1849 · Ruby +2 · Ruby On Rails Active Storage +2

Name of the Vulnerable Software and Affected Versions: Ruby on Rails Active Storage versions 5.2.0 through 5.2.6.2 Ruby on Rails Active Storage versions 6.0.0 through 6.0.4.6 Ruby on Rails Active Storage versions 6.1.0 through 6.1.4.6 Ruby on Rails Active Storage versions 7.0.0 through 7.0.2.2...

Exploit for Use After Free in Microsoft

CVE-2021-31166 Why I recently wrote an exploit for CVE-20...

VIewComponent Cross-Site Scripting Vulnerability

VIewComponent is a framework for building reusable, testable and encapsulated view components in Ruby on Rails. VIewComponent suffers from a cross-site scripting vulnerability that stems from data received via user input and passed as interpolated parameters to the translat method not being clean...

CVE-2022-24722

VIewComponent is a framework for building view components in Ruby on Rails. Versions prior to 2.31.2 and 2.49.1 contain a cross-site scripting vulnerability that has the potential to impact anyone using translations with the viewcomponent gem. Data received via user input and passed as an...