GitLab Input Validation Error Vulnerability (CNVD-2021-91185)

GitLab is a self-hosted, Git version control system project repository application developed in Ruby on Rails by GitLab, Inc. GitLab CE/EE is vulnerable to input validation errors, which can be exploited to cause high CPU usage...

GitLab Licensing Issue Vulnerability (CNVD-2021-91181)

GitLab is a self-hosted, Git version control system project repository application developed using Ruby on Rails by GitLab, Inc. The application can be used to access a project's file content, commit history, bug list, etc. An authorization issue vulnerability exists in GitLab CE/EE, which can be...

My Movie Collection Sinatra App Login Cross Site Scripting

Document Title: =============== My Movie Collection Sinatra App - Login XSS Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2293 Release Date: ============= 2021-11-01 Vulnerability Laboratory ID VL-ID: ==================================...

GitLab Access Control Error Vulnerability (CNVD-2021-91187)

GitLab is a self-hosted, Git version control system project repository application developed using Ruby on Rails by GitLab, Inc. The application can be used to access a project's file content, commit history, bug list, etc. An access control error vulnerability exists in GitLab CE/EE, which stems...

My Movie Collection Sinatra App Movie Cross Site Scripting

Document Title: =============== My Movie Collection Sinatra App - Movie XSS Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2294 Release Date: ============= 2021-11-01 Vulnerability Laboratory ID VL-ID: ====================================...

GitLab Access Control Error Vulnerability (CNVD-2021-91178)

GitLab is a self-hosted, Git version control system project repository application developed in Ruby on Rails by GitLab, Inc. The application can be used to access a project's file content, commit history, bug list, etc. An access control error vulnerability exists in GitLab CE/EE, which can be...

GitLab Resource Management Error Vulnerability (CNVD-2021-91188)

GitLab is a self-hosted, Git version control system project repository application developed in Ruby on Rails by GitLab, Inc. GitLab CE/EE is vulnerable to a resource management error that could be exploited to cause memory exhaustion using a misformatted TIFF image...

GitLab Information Disclosure Vulnerability (CNVD-2021-90771)

GitLab is a self-hosted Git version control system project repository application developed by GitLab, Inc. using Ruby on Rails. GitLab Community Edition is vulnerable to an information leak that could be exploited by an attacker with local filesystem access to gain root-level privileges...

GitLab 输入验证错误漏洞

GitLab is a self-hosted, Git version control system project repository application developed in Ruby on Rails by GitLab, Inc. GitLab CE/EE is vulnerable to input validation errors, which can be exploited to cause high CPU usage...

The vulnerability of the Token Authentication logic in the Action Controller component of the actionpack plugin for the Ruby on Rails software framework allows a hacker to cause a service failure due to uncontrolled resource consumption.

The vulnerability of the Token Authentication logic in the Action Controller component of the actionpack plugin for the Ruby on Rails software framework is related to insufficiently strict regular expressions. Exploiting this vulnerability could allow an attacker to cause a service failure...

RHEL 7 : rh-ruby30-ruby (RHSA-2021:3982)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3982 advisory. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system...

Huawei EulerOS: Security Advisory for ruby (EulerOS-SA-2021-2614)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ruby: StartTLS stripping vulnerability in Net::IMAP

Ruby's Net::IMAP module did not raise an exception when receiving an unexpected response to the STARTTLS command and the connection was not upgraded to use TLS. A man-in-the-middle attacker could use this flaw to prevent Ruby applications using Net::IMAP to enable TLS encryption for a connection ...

Important: Red Hat Security Advisory: rh-ruby30-ruby security update

An update for rh-ruby30-ruby is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabili...

ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host

Ruby's Net::FTP module trusted the IP address included in the FTP server's response to the PASV command. A malicious FTP server could use this to make Ruby applications using the Net::FTP module to connect to arbitrary hosts and use this to perform port scanning or information extraction from...

rubygem-rdoc: Command injection vulnerability in RDoc

An operating system command injection flaw was found in RDoc. Using the rdoc command to generate documentation for a malicious Ruby source code could lead to execution of arbitrary commands with the privileges of the user running rdoc...

EulerOS 2.0 SP3 : ruby (EulerOS-SA-2021-2614)

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fai...

Ruby: RDoc::MethodAttr is vulnerable to Regular Expression Denial of Service (ReDoS)

Vulnerability description not provided...

The vulnerability of HTTP servers for Ruby/Rack applications developed with Puma, related to uncontrolled resource consumption, allows attackers to cause service failures.

The vulnerability of HTTP servers for Ruby/Rack applications developed with Puma is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

Insufficient Session Expiration

Overview camaleoncms is a dynamic and advanced content management system based on Ruby on Rails as an alternative to Wordpress. Affected versions of this package are vulnerable to Insufficient Session Expiration when active sessions of the users are not being terminated. Remediation Upgrade...