2198 matches found
CVE-2020-5247
In Puma RubyGem before 4.3.2 and before 3.12.3, if an application using Puma allows untrusted input in a response header, an attacker can use newline characters i.e. CR, LF or/r, /n to end the header and inject malicious content, such as additional headers or an entirely new response body. This...
CVE-2020-5247
CVE-2020-5247 is a HTTP Response Splitting vulnerability affecting Puma (RubyGem) in versions prior to 4.3.2 and 3.12.3 when untrusted input reaches response headers. An attacker could inject CR/LF sequences to terminate a header and inject new headers or a response body. The issue is mitigated b...
CVE-2020-5247 HTTP Response Splitting in Puma
In Puma RubyGem before 4.3.2 and before 3.12.3, if an application using Puma allows untrusted input in a response header, an attacker can use newline characters i.e. CR, LF or/r, /n to end the header and inject malicious content, such as additional headers or an entirely new response body. This...
GHSA-84J7-475P-HP8V HTTP Response Splitting in Puma
In Puma RubyGem before 4.3.2 and 3.12.3, if an application using Puma allows untrusted input in a response header, an attacker can use newline characters i.e. CR, LF or/r, /n to end the header and inject malicious content, such as additional headers or an entirely new response body. This...
HTTP Response Splitting in Puma
In Puma RubyGem before 4.3.2 and 3.12.3, if an application using Puma allows untrusted input in a response header, an attacker can use newline characters i.e. CR, LF or/r, /n to end the header and inject malicious content, such as additional headers or an entirely new response body. This...
PT-2020-18343 · Ruby +1 · Puma +1
Name of the Vulnerable Software and Affected Versions: Puma RubyGem versions prior to 4.3.3 Puma RubyGem versions prior to 3.12.4 Description: The issue allows an attacker to inject malicious content, such as additional headers or an entirely new response body, by using a carriage return characte...
CVE-2015-4410
The Moped::BSON::ObjecId.legal? method in rubygem-moped before commit dd5a7c14b5d2e466f7875d079af71ad19774609b allows remote attackers to cause a denial of service worker resource consumption or perform a cross-site scripting XSS attack via a crafted string...
CVE-2015-4410
The Moped::BSON::ObjecId.legal? method in rubygem-moped before commit dd5a7c14b5d2e466f7875d079af71ad19774609b allows remote attackers to cause a denial of service worker resource consumption or perform a cross-site scripting XSS attack via a crafted string...
CVE-2015-4411
The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped allows remote attackers to cause a denial of service worker resource consumption via a crafted string. NOTE: This issue is due to an incomplete fix to CVE-2015-4410...
CVE-2015-4410
The Moped::BSON::ObjecId.legal? method in rubygem-moped before commit dd5a7c14b5d2e466f7875d079af71ad19774609b allows remote attackers to cause a denial of service worker resource consumption or perform a cross-site scripting XSS attack via a crafted string...
CVE-2015-4410
CVE-2015-4410 affects rubygem-moped via the Moped::BSON::ObjecId.legal? method. Connected sources confirm that before commit dd5a7c14b5d2e466f7875d079af71ad19774609b, remote attackers could trigger a denial of service (worker resource consumption) or execute a cross-site scripting (XSS) attack by...
CVE-2015-4411
The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped allows remote attackers to cause a denial of service worker resource consumption via a crafted string. NOTE: This issue is due to an incomplete fix to CVE-2015-4410...
CVE-2015-4411
CVE-2015-4411 affects the MongoDB Ruby stack: the Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 (used by rubygem-moped) allows remote denial of service via a crafted string, due to an incomplete fix to CVE-2015-4410. Impact is a targeted DoS via resource consumption; no exp...
CVE-2020-5241
matestack-ui-core RubyGem before 0.7.4 is vulnerable to XSS/Script injection. This vulnerability is patched in version 0.7.4...
CVE-2020-5241
matestack-ui-core RubyGem before 0.7.4 is vulnerable to XSS/Script injection. This vulnerability is patched in version 0.7.4...
Code injection
matestack-ui-core RubyGem before 0.7.4 is vulnerable to XSS/Script injection. This vulnerability is patched in version 0.7.4...
openSUSE Security Update : rubygem-rack (openSUSE-2020-214)
This update for rubygem-rack to version 2.0.8 fixes the following issues : - CVE-2018-16471: Fixed a cross-site scripting XSS flaw via the scheme method on Rack::Request bsc1116600. - CVE-2019-16782: Fixed a possible information leak and session hijack vulnerability bsc1159548. This update was...
CVE-2020-5241 XSS/Script injection vulnerability in matestack
matestack-ui-core RubyGem before 0.7.4 is vulnerable to XSS/Script injection. This vulnerability is patched in version 0.7.4...
CVE-2020-5241
CVE-2020-5241 affects matestack-ui-core (RubyGem) up to version 0.7.3; the vulnerability is Cross‑Site Scripting (XSS) / Script injection due to strings not being escaped by default. The issue is fixed in 0.7.4. Public sources from NVD, Red Hat, Veracode, and CVE records consistently describe the...