Cookie Prefix Spoofing in CGI::Cookie.parse

The old versions of CGI::Cookie.parse applied URL decoding to cookie names. An attacker could exploit this vulnerability to spoof security prefixes in cookie names, which may be able to trick a vulnerable application. By this fix, CGI::Cookie.parse no longer decodes cookie names. Note that this i...

CVE-2021-41817

A flaw was found in ruby, where the date object was found to be vulnerable to a regular expression denial of service ReDoS during the parsing of dates. This flaw allows an attacker to hang a ruby application by providing a specially crafted date string. The highest threat to this vulnerability is...

Internet Bug Bounty: Ruby - Regular Expression Denial of Service Vulnerability of Date Parsing Methods

Official report: https://www.ruby-lang.org/en/news/2021/11/15/date-parsing-method-regexp-dos-cve-2021-41817/ CVE-2021-41817 Here are the details from the official article: Date’s parsing methods including Date.parse are using Regexps internally, some of which are vulnerable against regular...

Spree 跨站请求伪造漏洞

Spree is an open source mall developed using Ruby on Rails by an individual developer. A cross-site request forgery vulnerability exists in Spree auth devise, which stems from a lack of effective validation of the product's authentication against CSRF. This vulnerability can be exploited to send...

rails: Possible DoS Vulnerability in Action Controller Token Authentication

A flaw was found in RubyGem Actionpack which is framework for handling and responding to web requests in Rails. A possible DoS vulnerability was found in the Token Authentication logic in Action Controller...

rake: OS Command Injection via egrep in Rake::FileList

There is an OS command injection vulnerability in Ruby Rake 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character |...

Regular Expression Denial of Service (ReDoS)

Overview date is a subclass of Object includes Comparable module for handling dates. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS. Date’s parsing methods including Date.parse are using regular expressions internally, some of which are vulnerable...

Shopify: [https://shipit-sox-staging.shopifycloud.com] Presence of multiple vulnerabilities present in Ruby On Rails

https://shipit-sox-staging.shopifycloud.com seems to be running 6.0.0 rails 6.0.3.2 which is prone to multiple vulnerabilities via csrf including open redirect, xss & rce as reported at https://hackerone.com/reports/904059 Impact presence of multiple vulnerabilities can cause wide variety of dama...

PT-2021-7337

Name of the Vulnerable Software and Affected Versions date gem versions prior to 3.2.1 date gem versions prior to 3.1.2 date gem versions prior to 3.0.2 date gem versions prior to 2.0.1 Description The issue is related to a ReDoS regular expression Denial of Service vulnerability in the date gem...

Debian: Security Advisory (DSA-5005-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for ruby (EulerOS-SA-2021-2673)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-5005-1 : ruby-kaminari - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dsa-5005 advisory. - In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code into pages with pagination links. This has been fixed in 1.2.1...

Huawei EulerOS: Security Advisory for ruby (EulerOS-SA-2021-2696)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for ruby (EulerOS-SA-2021-2721)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability in the built-in RDoc documentation generator for the Ruby programming language allows a perpetrator to execute arbitrary commands.

The vulnerability of the RDoc documentation generator for the Ruby programming language is related to the lack of measures taken to clean up data at the control level. Exploiting this vulnerability allows an attacker to execute arbitrary commands...

EulerOS 2.0 SP5 : ruby (EulerOS-SA-2021-2673)

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a...

EulerOS 2.0 SP9 : ruby (EulerOS-SA-2021-2721)

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a...

[SECURITY] [DSA 5005-1] ruby-kaminari security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5005-1 [email protected] https://www.debian.org/security/ Markus Koschany November 10, 2021 https://www.debian.org/security/faq -...

DSA-5005-1 ruby-kaminari - security update

Bulletin has no description...

Security Bulletin: A security vulnerability in Ruby on Rails Action Pack affects IBM Cloud Pak for Multicloud Management Infrastructure Management

Summary A security vulnerability in Ruby on Rails Action Pack affects IBM Cloud Pak for Multicloud Management Infrastructure Management. Vulnerability Details CVEID: CVE-2021-22942 DESCRIPTION: Ruby on Rails Action Pack could allow a remote attacker to conduct phishing attacks, caused by an open...