17321 matches found
Critical Photon OS Security Update - PHSA-2022-0199
Updates of 'ruby', 'vim' packages of Photon OS have been released...
Huawei EulerOS: Security Advisory for ruby (EulerOS-SA-2022-1915)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
EulerOS 2.0 SP5 : ruby (EulerOS-SA-2022-1915)
According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float...
Important Photon OS Security Update - PHSA-2022-4.0-0199
Updates of 'vim', 'ruby' packages of Photon OS have been released...
SUSE-SU-2022:2108-1 Security update for rubygem-actionpack-5_1, rubygem-activesupport-5_1
This update for rubygem-actionpack-51 and rubygem-activesupport-51 fixes the following issues: - CVE-2021-22904: Fixed possible DoS Vulnerability in Action Controller Token Authentication bsc1185780 - CVE-2022-23633: Fixed possible exposure of information vulnerability in Action Pack bsc1196182...
CVE-2022-31072
Octokit is a Ruby toolkit for the GitHub API. Versions 4.23.0 and 4.24.0 of the octokit gem were published containing world-writeable files. Specifically, the gem was packed with files having their permissions set to -rw-rw-rw- i.e. 0666 instead of rw-r--r-- i.e. 0644. This means everyone who is...
CVE-2022-31072
Octokit is a Ruby toolkit for the GitHub API. Versions 4.23.0 and 4.24.0 of the octokit gem were published containing world-writeable files. Specifically, the gem was packed with files having their permissions set to -rw-rw-rw- i.e. 0666 instead of rw-r--r-- i.e. 0644. This means everyone who is...
UBUNTU-CVE-2022-31072
Octokit is a Ruby toolkit for the GitHub API. Versions 4.23.0 and 4.24.0 of the octokit gem were published containing world-writeable files. Specifically, the gem was packed with files having their permissions set to -rw-rw-rw- i.e. 0666 instead of rw-r--r-- i.e. 0644. This means everyone who is...
CVE-2022-31072
The CVE affects the Ruby Octokit gem; versions 4.23.0 and 4.24.0 ship world-writable files (permissions 0666) instead of 0644, enabling modification by non-owners in affected environments. The root cause is improper packaging of files during these releases. A fix is available in Octokit 4.25.0. W...
CVE-2022-31072 Octokit gem published with world-writable files
Octokit is a Ruby toolkit for the GitHub API. Versions 4.23.0 and 4.24.0 of the octokit gem were published containing world-writeable files. Specifically, the gem was packed with files having their permissions set to -rw-rw-rw- i.e. 0666 instead of rw-r--r-- i.e. 0644. This means everyone who is...
CVE-2022-31072 Octokit gem published with world-writable files
Octokit is a Ruby toolkit for the GitHub API. Versions 4.23.0 and 4.24.0 of the octokit gem were published containing world-writeable files. Specifically, the gem was packed with files having their permissions set to -rw-rw-rw- i.e. 0666 instead of rw-r--r-- i.e. 0644. This means everyone who is...
CVE-2022-28739 affecting package ruby 2.6.9-1
CVE-2022-28739 affecting package ruby 2.6.9-1. An upgraded version of the package is available that resolves this issue...
Internet Bug Bounty: Rails::Html::SafeListSanitizer vulnerable to xss attack in an environment that allows the style tag
It seems to be a problem caused by a difference between the nokogiri java implementation and the ruby implementation. jruby9.3.3.0 nokogiri java, use Rails::Html::SafeListSanitizer.new.sanitize, allow select/style tag code tags = %wselect style puts...
Metasploit Weekly Wrap-Up
A Confluence of High-Profile Modules This release features modules covering the Confluence remote code execution bug CVE-2022-26134 and the hotly-debated CVE-2022-30190, a file format vulnerability in the Windows Operating System accessible through malicious documents. Both have been all over the...
Amazon Linux AMI : rubygem-nokogiri, rubygem18-nokogiri (ALAS-2022-1595)
The version of rubygem18-nokogiri installed on the remote host is prior to 1.5.11-1.16. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1595 advisory. Nokogiri is an open source XML and HTML library for Ruby. Nokogiri = 1.13.4. There are no known workarounds for this...
Mechanize 信息泄露漏洞
Mechanize is an open source ruby library from Sparkle Motion. It is used to automate interactions with websites. A security vulnerability exists in versions of Mechanize prior to 2.8.5 that stems from an authorization header that leaks after redirecting to a different port on the same site...
Important: rubygem-nokogiri, rubygem18-nokogiri
Issue Overview: Nokogiri is an open source XML and HTML library for Ruby. Nokogiri = 1.13.4. There are no known workarounds for this issue. CVE-2022-24836 Affected Packages: rubygem-nokogiri, rubygem18-nokogiri Issue Correction: Run yum update rubygem-nokogiri or yum update --advisory...
GHSA-5C5F-7VFQ-3732 JMESPath for Ruby uses unsafe JSON.load when safe JSON.parse is preferable
jmespath.rb aka JMESPath for Ruby before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable...
JMESPath for Ruby uses unsafe JSON.load when safe JSON.parse is preferable
jmespath.rb aka JMESPath for Ruby before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable...
