19321 matches found
CVE-2023-23752
CVE-2023-23752 Joomla! v4.2.8 - Unauthenticated information disclosure To execute this script, we need to install few missing gems: sudo gem install httpx sudo gem install docopt sudo gem install paint ruby exploit.rb http://dev.devvortex.htb...
json_cve_2020_10663
Workaround for CVE-2020-10663 vulnerability in json gem The json gem has a security vulnerability CVE-2020-10663. When parsing certain JSON documents, the json gem can be coerced into creating arbitrary objects in the target system. Users are strongly advised to upgrade to json 2.3.0 or later. Fo...
CVE-2013-0156
Rails YAML deserialization RCE CVE-2013-0156 - PentesterLab Compatible Ronin-free, Ruby 3.x compatible version of https://gist.github.com/postmodern/4499206 Usage: ruby railsrce.rb http://target/ "system'/usr/local/bin/score UUID'" ⚠️ LEGAL DISCLAIMER ⚠️ This script is for EDUCATIONAL PURPOSES ONLY...
CVE-RUBY
cve-id Donate Support the maintenance of this project with PayPal or by scanning the QR code below. ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing environments Example...
scanner-cli
Deprecation Notice: Hawkeye has reached its end of life. There are more modern options out there for you and your project. If you wish to pick up maintenance of the project, please feel free to contact me. You'll find means of reaching out to me on my personal homepage. . . . . . . The Hawkeye...
Ruby on Rails - Open Redirect via Host Header Injection
Ruby on Rails action pack before 6.1.2.1, 6.0.3.5 contains an open redirect caused by special crafted Host headers in combination with allowed host formats, letting attackers redirect users to malicious websites, exploit requires attacker to control Host headers. id: CVE-2021-22881 info: name: Ru...
RHEL 10 : ruby (RHSA-2026:83570)
The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:83570 advisory. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management...
Unity Linux 20.1070e Security Update: ruby (UTSA-2026-130360)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130360 advisory. An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.getclass, Resolv::DNS::Resource::Generic.create, and...
RHEL 9 : ruby (RHSA-2026:83574)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:83574 advisory. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management task...
RHEL 9 : ruby (RHSA-2026:83571)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:83571 advisory. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management task...
MySQL-Fu.rb
MySQL-Fu.rb MySQL-Fu is a Ruby based MySQL Client Script I wrote. It does most of the stuff a normal MySQL client might do: SQL Shell, Update/Delete/Drop Database/Table, Add/Delete Users, Dump Databases/Table w/ option for gzip...... Plus a few extra options to make life a little easier for...
CVE-2019-5420
CVE-2019-5420 Ruby-on-Rails offers three different environments it can run in: development, test and production. You should obviously not have code running in development or test available on the internet but it as always happens for example in staging environments. Ruby-on-Rails uses...
upb-any-recursion-audit
upb Any-recursion audit Ruby / PHP / C bindings Status: Complete. Six recursion-guard checks across three independent implementations Ruby/PHP shared upb core, C's separate managed implementation, all falsified except the one already-public, already-patched Python CVE this audit was checking...
manageengine-auditad-cve-2022-28219
Code to support my CVE-2022-28219 analysis. To execute, with Ruby and Rubygems installed: gem install httparty ruby ./manageengine-poc.rb This is designed as a proof of concept, not a stable exploit. It only runs calc. :...
Rainstorm
================================================================================================ BadBash is a CVE-2014-6271 RCE exploit tool. The basic version only checks for the HTTP CGI site and only provides netcat reverse shell on port 1234. Developer : Andy Yang Version : 0.1.0 License :...
CVE-2026-110222
Razorpay IFSC Ruby gem through 2.0.62 contains a server-side request forgery vulnerability that allows attackers to redirect API requests by supplying a crafted IFSC code to IFSC.find or IFSCget. Attackers can submit network-path references or absolute URIs that URI.join resolves as a new host,...
CVE-2026-110222 Razorpay IFSC Ruby gem through 2.0.62 SSRF via IFSC lookup
Razorpay IFSC Ruby gem through 2.0.62 contains a server-side request forgery vulnerability that allows attackers to redirect API requests by supplying a crafted IFSC code to IFSC.find or IFSCget. Attackers can submit network-path references or absolute URIs that URI.join resolves as a new host,...
CVE-2026-110222
The Razorpay IFSC Ruby gem versions up to and including 2.0.62 is vulnerable to a Server-Side Request Forgery (SSRF) . The flaw exists in the IFSC.find or IFSC#get methods, where a crafted IFSC code can be used to supply network-path references or absolute URIs. Because URI.join may resolve these...
CVE-2026-110222 Razorpay IFSC Ruby gem through 2.0.62 SSRF via IFSC lookup
Razorpay IFSC Ruby gem through 2.0.62 contains a server-side request forgery vulnerability that allows attackers to redirect API requests by supplying a crafted IFSC code to IFSC.find or IFSCget. Attackers can submit network-path references or absolute URIs that URI.join resolves as a new host,...
