19605 matches found
ruby:fuzz_ruby_gems: Crash with empty stacktrace
Detailed Report: https://oss-fuzz.com/testcase?key=4979504053092352 Project: ruby Fuzzing Engine: afl Fuzz Target: fuzzrubygems Job Type: aflasanruby Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7ffd41e60198 Crash State: NULL Sanitizer: address ASAN Recommended Security Severity:...
ruby:fuzz_ruby_gems: Crash in rb_raw_obj_info
Project: https://github.com/ruby/ruby.git Detailed Report: https://oss-fuzz.com/testcase?key=4684012786155520 Project: ruby Fuzzing Engine: libFuzzer Fuzz Target: fuzzrubygems Job Type: libfuzzerasanruby Platform Id: linux Crash Type: UNKNOWN Crash Address: 0x7e82d35e51f8 Crash State: rbrawobjinf...
rubygem-actionpack: Denial of Service in Action Dispatch
A flaw was found in the rubygem-actionpack. RubyGem's actionpack gem is vulnerable to a denial of service caused by a regular expression denial of service ReDoS flaw in the Action Dispatch module. By sending specially-crafted cookies with an XFORWARDEDHOST header, a remote attacker could exploit...
ruby-git: code injection vulnerability
A flaw was found in the ruby-git package, which allows a remote authenticated attacker to execute arbitrary code on the system, caused by a code injection flaw. An attacker can execute arbitrary code on the system by using a specially-crafted filename in the repository...
rubygem-activerecord: SQL Injection
A flaw was found in RubyGem's activerecord gem, which is vulnerable to SQL injection. This flaw allows a remote attacker to send specially-crafted SQL statements to the comments, allowing the attacker to view, add, modify, or delete information in the back-end database...
rubygem-rack: Denial of service in Multipart MIME parsing
A flaw was found in rubygem-rack. This issue occurs in the Multipart MIME parsing code in Rack, which limits the number of file parts but does not limit the total number of parts that can be uploaded. Carefully crafted requests can abuse this and cause multipart parsing to take longer than...
ruby-git: code injection vulnerability
A code injection flaw was found in the ruby-git package. This issue may allow a remote authenticated attacker to execute arbitrary code on the system by using a specially-crafted filename in the repository...
ruby:fuzz_ruby_gems: Use-after-poison in iseq_peephole_optimize
Project: https://github.com/ruby/ruby.git Detailed Report: https://oss-fuzz.com/testcase?key=6723950385954816 Project: ruby Fuzzing Engine: honggfuzz Fuzz Target: fuzzrubygems Job Type: honggfuzzasanruby Platform Id: linux Crash Type: Use-after-poison READ 8 Crash Address: 0x7fffc3d7eec8 Crash...
ruby:fuzz_ruby_gems: Use-after-poison in rb_fstring
Project: https://github.com/ruby/ruby.git Detailed Report: https://oss-fuzz.com/testcase?key=5028660658438144 Project: ruby Fuzzing Engine: honggfuzz Fuzz Target: fuzzrubygems Job Type: honggfuzzasanruby Platform Id: linux Crash Type: Use-after-poison READ 8 Crash Address: 0x7fffc3d7eb58 Crash...
Fedora 39 : rubygem-actioncable / rubygem-actionmailbox / rubygem-actionmailer / etc (2023-4f0bb4ff5e)
The remote Fedora 39 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-4f0bb4ff5e advisory. Ruby on Rails security upgrade: https://rubyonrails.org/2023/8/22/Rails-Versions-7-0-7-2-6-1-7-6-have- been-released - incorrect file permissions on encrypte...
Rocky Linux 8 : ruby:2.5 (RLSA-2022:5779)
The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:5779 advisory. - Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS regular expression Denial of Service via a long string. The fixed versions are 3.2.1,...
Rocky Linux 8 : ruby:2.6 (RLSA-2022:0543)
The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:0543 advisory. - Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that...
Exploit for SQL Injection in Spiceworks Help_Desk_Server
Spiceworks Sort SQLi There's a SQLi in a sort parameter of...
Rocky Linux 9 : ruby (RLSA-2022:6585)
The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:6585 advisory. - A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2. If a victim attempts to create a Regexp from untrusted...
Rocky Linux 8 : ruby:2.5 (RLSA-2022:0672)
The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:0672 advisory. - In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename...
Rocky Linux 8 : ruby:2.5 (RLSA-2022:0545)
The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:0545 advisory. - Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue...
Rocky Linux 8 : ruby:2.6 (RLSA-2022:5338)
The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:5338 advisory. - There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion,...
GHSA-FRGF-8JR5-J2JV memory leak flaw was found in ruby-magick
A memory leak flaw was found in ruby-magick, an interface between Ruby and ImageMagick. This issue can lead to a denial of service DOS by memory exhaustion...
memory leak flaw was found in ruby-magick
A memory leak flaw was found in ruby-magick, an interface between Ruby and ImageMagick. This issue can lead to a denial of service DOS by memory exhaustion...
