PT-2019-6955

Name of the Vulnerable Software and Affected Versions omniauth-facebook affected versions not specified Description The RubyGem omniauth-facebook has an access token security issue. Recommendations At the moment, there is no information about a newer version that contains a fix for this...

Command injection

rubygem-openshift-origin-controller: API can be used to create applications via cartridgecache.rb URI.prase to perform command injection...

CVE-2013-2095

rubygem-openshift-origin-controller: API can be used to create applications via cartridgecache.rb URI.prase to perform command injection...

CVE-2013-2095

CVE-2013-2095 affects rubygem openshift-origin-controller. The vulnerability allows command injection through the API by crafting a cartridge_cache.rb URI.parse() payload to create applications. PoC demonstrates the exploit; multiple advisories confirm the issue. Remediation: there is no fixed ve...

PT-2019-6876

Name of the Vulnerable Software and Affected Versions rubygem-openshift-origin-controller versions affected versions not specified Description The issue allows the API to be used for creating applications via cartridge cache.rb, where the URI.prase function can be exploited to perform command...

CVE-2013-2095: Improper Neutralization of Special Elements in Output Used by a Downstream Component

rubygem-openshift-origin-controller: API can be used to create applications via cartridgecache.rb URI.prase to perform command injection...

Fedora Update for rubygem-rmagick FEDORA-2019-4504010099

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

rack -- information leak / session hijack vulnerability

National Vulnerability Database: There's a possible information leak / session hijack vulnerability in Rack RubyGem rack. This vulnerability is patched in versions 1.6.12 and 2.0.8. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are...

Fedora 30 : 1:ImageMagick / rubygem-rmagick (2019-4504010099)

Numerous security and bug fixes. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network...

Fedora 31 : 1:ImageMagick / rubygem-rmagick (2019-ba7247edcf)

Numerous security and bug fixes. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network...

Fedora 29 : rubygem-rubyzip (2019-52445dce42)

Fix CVE-2019-16892 denial of service via crafted ZIP file. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

Fedora 30 : rubygem-rubyzip (2019-0182d0b304)

Fix CVE-2019-16892 denial of service via crafted ZIP file. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

Fedora Update for rubygem-rubyzip FEDORA-2019-52445dce42

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

The rack-cors rubygem may allow directory traveral

An issue was discovered in the rack-cors aka Rack CORS Middleware gem before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...

GHSA-PF8F-W267-MQ2H The rack-cors rubygem may allow directory traveral

An issue was discovered in the rack-cors aka Rack CORS Middleware gem before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...

SUSE-SU-2019:2932-1 Security update for rubygem-haml

This update for rubygem-haml fixes the following issue: - CVE-2017-1002201: Fixed an insufficient character escape that could have led to arbitrary code execution bsc1155089...

CVE-2019-5418

A content disclosure flaw was found in rubygem-actionview. Specially crafted accept headers, in combination with calls to 'render file:', can cause arbitrary files on the target server to be rendered, disclosing the file contents. Code execution cannot be ruled out if the attacker is able to gain...

Fedora 31 : 1:ImageMagick / rubygem-rmagick (2019-27b9b94805)

Bug fixes and security fixes. Better threading compile time option set. See: https://src.fedoraproject.org/rpms/ImageMagick/pull-request/2 Additional formats enabled. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website...

Fedora 30 : 1:ImageMagick / rubygem-rmagick (2019-612d4f64dd)

Bug fixes and security fixes. Better threading compile time option set. See: https://src.fedoraproject.org/rpms/ImageMagick/pull-request/2 Additional formats enabled. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website...

Fedora Update for rubygem-rmagick FEDORA-2019-612d4f64dd

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...