Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
784 results · page 9 of 16
Dec 16, 2019In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would lCVE-2019-16779 · Other software · excon · reported by GitHubMedium 5.8
In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition window appears to be short, and it would be difficult to purposefully exploit this.
- Product
- excon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Dec 13, 2019rubygem-hammer_cli_foreman: File /etc/hammer/cli.modules.d/foreman.yml world readableCVE-2014-0241 · Other software · rubygem-hammer_cli_foreman · reported by Red HatMedium 5.5
rubygem-hammer_cli_foreman: File /etc/hammer/cli.modules.d/foreman.yml world readable
- Product
- rubygem-hammer_cli_foreman
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Dec 11, 2019RubyGem omniauth-facebook has an access token security vulnerabilityCVE-2013-4593 · Other software · omniauth-facebook · reported by Red HatHigh 7.5
RubyGem omniauth-facebook has an access token security vulnerability
- Product
- omniauth-facebook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comaccess.redhat.com
Dec 10, 2019rubygem-openshift-origin-controller: API can be used to create applications via cartridge_cache.rb URI.prase() to perform command injectionCVE-2013-2095 · Other software · rubygem-openshift-origin-controller · reported by Red HatCritical 9.8
rubygem-openshift-origin-controller: API can be used to create applications via cartridge_cache.rb URI.prase() to perform command injection
- Product
- rubygem-openshift-origin-controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Nov 29, 2019verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate CVE-2015-1855 · Other software · Ruby · reported by Red HatMedium 5.9
verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to (1) multiple wildcards, (1) wildcards in IDNA names, (3) case sensitivity, and (4) non-ASCII characters.
- Product
- Ruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2019Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#tCVE-2019-16255 · Other software · Ruby-lang · reported by MITREHigh 8.1
Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method.
- Product
- Ruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orghackerone.com
Nov 26, 2019Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting.CVE-2019-16254 · Other software · Ruby-lang · reported by MITREMedium 5.3
Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. NOTE: this issue exists because of an incomplete fix for CVE-2017-17742, which addressed the CRLF vector, but did not address an isolated CR or an isolated LF.
- Product
- Ruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orghackerone.com
Nov 26, 2019WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/baCVE-2019-16201 · Other software · Ruby-lang · reported by MITREHigh 7.5
WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server that uses DigestAuth to the Internet or a untrusted network.
- Product
- Ruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orghackerone.com
Nov 26, 2019Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions.CVE-2019-15845 · Other software · Ruby-lang · reported by MITREMedium 6.5
Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions.
- Product
- Ruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orghackerone.com
Nov 26, 2019The OpenSSL extension of Ruby (Git trunk) versions after 2011-09-01 up to 2011-11-03 always generated an exponent value of '1' to be used for private RSA key geCVE-2011-4121 · Websites & servers · OpenSSL · reported by Red HatCritical 9.8
The OpenSSL extension of Ruby (Git trunk) versions after 2011-09-01 up to 2011-11-03 always generated an exponent value of '1' to be used for private RSA key generation. A remote attacker could use this flaw to bypass or corrupt integrity of services, depending on strong private RSA keys generation mechanism.
- Product
- OpenSSL extension of Ruby (Git trunk)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comaccess.redhat.com
Nov 25, 2019Various methods in WEBrick::HTTPRequest in Ruby 1.9.2 and 1.8.7 and earlier do not validate the X-Forwarded-For, X-Forwarded-Host and X-Forwarded-Server headersCVE-2011-3624 · Other software · Ruby · reported by Red HatMedium 5.3
Various methods in WEBrick::HTTPRequest in Ruby 1.9.2 and 1.8.7 and earlier do not validate the X-Forwarded-For, X-Forwarded-Host and X-Forwarded-Server headers in requests, which might allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header.
- Product
- Ruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Nov 21, 2019Ruby gem openshift-origin-node before 2014-02-14 does not contain a cronjob timeout which could result in a denial of service in cron.daily and cron.weekly.CVE-2014-0084 · Other software · rubygem-openshift-origin-node · reported by Red HatMedium 5.5
Ruby gem openshift-origin-node before 2014-02-14 does not contain a cronjob timeout which could result in a denial of service in cron.daily and cron.weekly.
- Product
- rubygem-openshift-origin-node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Nov 21, 2019The Ruby net-ldap gem before 0.11 uses a weak salt when generating SSHA passwords.CVE-2014-0083 · Other software · ruby-net-ldap · reported by Red HatMedium 5.5
The Ruby net-ldap gem before 0.11 uses a weak salt when generating SSHA passwords.
- Product
- ruby-net-ldap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.suse.com
Nov 19, 2019RubyGems passenger 4.0.0 betas 1 and 2 allows remote attackers to delete arbitrary files during the startup process.CVE-2012-6135 · Other software · ruby-passenger · reported by Red HatHigh 7.5
RubyGems passenger 4.0.0 betas 1 and 2 allows remote attackers to delete arbitrary files during the startup process.
- Product
- ruby-passenger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.combugzilla.redhat.com
Nov 18, 2019Distributed Ruby (aka DRuby) 1.8 mishandles instance_eval.CVE-2011-5331 · Other software · Distributed Ruby Project · reported by MITRECritical 9.8
Distributed Ruby (aka DRuby) 1.8 mishandles instance_eval.
- Product
- Distributed Ruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Nov 18, 2019Distributed Ruby (aka DRuby) 1.8 mishandles the sending of syscalls.CVE-2011-5330 · Other software · Distributed Ruby Project · reported by MITRECritical 9.8
Distributed Ruby (aka DRuby) 1.8 mishandles the sending of syscalls.
- Product
- Distributed Ruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Nov 14, 2019An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem before 1.0.4 for Ruby.CVE-2019-18978 · Other software · Rack-cors Project · reported by MITREMedium 5.3
An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.
- Product
- Rack-cors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2019The encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks.CVE-2010-3299 · Other software · rails · reported by Red HatMedium 6.5
The encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks.
- Product
- rails
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comseclists.org
Nov 12, 2019The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string.CVE-2019-18848 · Other software · Json-jwt Project · reported by MITREHigh 7.5
The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string.
- Product
- Json-jwt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2019Chartkick.js 3.1.0 through 3.1.3, as used in the Chartkick gem before 3.3.0 for Ruby, allows prototype pollution.CVE-2019-18841 · Other software · Chartkick · reported by MITREHigh 7.3
Chartkick.js 3.1.0 through 3.1.3, as used in the Chartkick gem before 3.3.0 for Ruby, allows prototype pollution.
- Product
- Chartkick.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchartkick.comgithub.com
Nov 8, 2019It was discovered that the C++ implementation (which underlies the R, Python and Ruby implementations) of Apache Arrow 0.14.0 to 0.14.1 had a uninitialized memoCVE-2019-12408 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
It was discovered that the C++ implementation (which underlies the R, Python and Ruby implementations) of Apache Arrow 0.14.0 to 0.14.1 had a uninitialized memory bug when building arrays with null values in some cases. This can lead to uninitialized memory being unintentionally shared if Arrow Arrays are transmitted over the wire (for instance with Flight) or persisted in the streaming IPC and file formats.
- Product
- Apache Arrow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Nov 6, 2019Rbot Reaction plugin allows command executionCVE-2010-2446 · Other software · Ruby-rbot · reported by MITRECritical 9.8
Rbot Reaction plugin allows command execution
- Product
- Rbot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-tracker.debian.orgsecurityfocus.com
Nov 5, 2019Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limitsCVE-2013-6461 · Other software · Ruby · reported by Red HatMedium 6.5
Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits
- Product
- Nokogiri gem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Nov 5, 2019Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documentsCVE-2013-6460 · Other software · Ruby · reported by Red HatMedium 6.5
Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents
- Product
- Nokogiri gem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Oct 31, 2019ruby193 uses an insecure LD_LIBRARY_PATH setting.CVE-2013-1945 · Other software · ruby193 · reported by Red HatLow 3.3
ruby193 uses an insecure LD_LIBRARY_PATH setting.
- Product
- ruby193
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Oct 24, 2019The ruby_parser-legacy (aka legacy) gem 1.0.0 for Ruby allows local privilege escalation because of world-writable files.CVE-2019-18409 · Other software · Zenspider · reported by MITREHigh 7.8
The ruby_parser-legacy (aka legacy) gem 1.0.0 for Ruby allows local privilege escalation because of world-writable files. For example, if the brakeman gem (which has a legacy dependency) 4.5.0 through 4.7.0 is used, a local user can insert malicious code into the ruby_parser-legacy-1.0.0/lib/ruby_parser/legacy/ruby_parser.rb file.
- Product
- Ruby Parser-legacy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2019In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.CVE-2019-15587 · Other software · Loofah Project · reported by support@hackerone.comMedium 5.4
In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.
- Product
- Loofah
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhackerone.com
Oct 9, 2019The netaddr gem before 2.0.4 for Ruby has misconfigured file permissions, such that a gem install may result in 0777 permissions in the target filesystem.CVE-2019-17383 · Other software · Netaddr Project · reported by MITRECritical 9.8
The netaddr gem before 2.0.4 for Ruby has misconfigured file permissions, such that a gem install may result in 0777 permissions in the target filesystem.
- Product
- Netaddr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comrubygems.org
Sep 25, 2019In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed.CVE-2019-16892 · Other software · Rubyzip Project · reported by MITREMedium 5.5
In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption).
- Product
- Rubyzip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Sep 23, 2019The makandra consul gem through 1.0.2 for Ruby has Incorrect Access Control.CVE-2019-16377 · Other software · Makandra · reported by MITRECritical 9.8
The makandra consul gem through 1.0.2 for Ruby has Incorrect Access Control.
- Product
- Consul
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comrubygems.org
Sep 6, 2019The Airbrake Ruby notifier 4.2.3 for Airbrake mishandles the blacklist_keys configuration option and consequently may disclose passwords to unauthorized actors.CVE-2019-16060 · Other software · Airbrake · reported by MITRECritical 9.8
The Airbrake Ruby notifier 4.2.3 for Airbrake mishandles the blacklist_keys configuration option and consequently may disclose passwords to unauthorized actors. This is fixed in 4.2.4 (also, 4.2.2 and earlier are unaffected).
- Product
- Airbrake Ruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2019The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.CVE-2019-15224 · Other software · Rest-client Project · reported by MITRECritical 9.8
The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Versions <=1.6.9 and >=1.6.14 are unaffected.
- Product
- Rest-client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comrubygems.org
Aug 16, 2019A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` method.CVE-2019-5477 · Other software · Nokogiri · reported by support@hackerone.comCritical 9.8
A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input as the filename. This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.
- Product
- Nokogiri
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2019A TLS certificate validation flaw was found in Elastic APM agent for Ruby versions before 2.9.0.CVE-2019-7615 · Other software · Elastic · reported by security@elastic.coHigh 7.4
A TLS certificate validation flaw was found in Elastic APM agent for Ruby versions before 2.9.0. When specifying a trusted server CA certificate via the 'server_ca_cert' setting, the Ruby agent would not properly verify the certificate returned by the APM server. This could result in a man in the middle style attack against the Ruby agent.
- Product
- Elastic APM agent for Ruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2019The simple_captcha2 gem 0.2.3 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.CVE-2019-14282 · Other software · Simple Captcha2 Project · reported by MITRECritical 9.8
The simple_captcha2 gem 0.2.3 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.
- Product
- Simple Captcha2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comrubygems.org
Jul 26, 2019The datagrid gem 1.0.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.CVE-2019-14281 · Other software · Datagrid Project · reported by MITRECritical 9.8
The datagrid gem 1.0.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.
- Product
- Datagrid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comrubygems.org
Jul 14, 2019The paranoid2 gem 1.1.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.CVE-2019-13589 · Other software · Anjlab · reported by MITRECritical 9.8
The paranoid2 gem 1.1.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1.1.5.
- Product
- Paranoid2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Jul 9, 2019The field_test gem 0.3.0 for Ruby has unvalidated input.CVE-2019-13146 · Other software · Field Test Project · reported by MITREMedium 5.3
The field_test gem 0.3.0 for Ruby has unvalidated input. A method call that is expected to return a value from a certain set of inputs can be made to return any input, which can be dangerous depending on how applications use it. If an application treats arbitrary variants as trusted, this can lead to a variety of potential vulnerabilities like SQL injection or cross-site scripting (XSS).
- Product
- Field Test
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Jul 8, 2019The strong_password gem 0.0.7 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.CVE-2019-13354 · Other software · Strong Password Project · reported by MITRECritical 9.8
The strong_password gem 0.0.7 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 0.0.6.
- Product
- Strong Password
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbenjamin-bouchet.comgithub.com
Jun 17, 2019An issue was discovered in RubyGems 2.6 and later through 3.0.2.CVE-2019-8323 · Other software · Rubygems · reported by MITREHigh 7.5
An issue was discovered in RubyGems 2.6 and later through 3.0.2. Gem::GemcutterUtilities#with_response may output the API response to stdout as it is. Therefore, if the API side modifies the response, escape sequence injection may occur.
- Product
- Rubygems
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orghackerone.com
Jun 17, 2019An issue was discovered in RubyGems 2.6 and later through 3.0.2.CVE-2019-8322 · Other software · Rubygems · reported by MITREHigh 7.5
An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur.
- Product
- Rubygems
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orghackerone.com
Jun 17, 2019An issue was discovered in RubyGems 2.6 and later through 3.0.2.CVE-2019-8321 · Other software · Rubygems · reported by MITREHigh 7.5
An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteraction#verbose calls say without escaping, escape sequence injection is possible.
- Product
- Rubygems
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orghackerone.com
Jun 17, 2019An issue was discovered in RubyGems 2.6 and later through 3.0.2.CVE-2019-8325 · Other software · Rubygems · reported by MITREHigh 7.5
An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::CommandManager#run calls alert_error without escaping, escape sequence injection is possible. (There are many ways to cause an error.)
- Product
- Rubygems
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orghackerone.com
Jun 17, 2019An issue was discovered in RubyGems 2.6 and later through 3.0.2.CVE-2019-8324 · Other software · Rubygems · reported by MITREHigh 8.8
An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could inject arbitrary code to the stub line of gemspec, which is eval-ed by code in ensure_loadable_spec during the preinstall check.
- Product
- Rubygems
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgaccess.redhat.com
Jun 10, 2019Ruby OpenID (aka ruby-openid) through 2.8.0 has a remotely exploitable flaw.CVE-2019-11027 · Other software · Openid · reported by MITRECritical 9.8
Ruby OpenID (aka ruby-openid) through 2.8.0 has a remotely exploitable flaw. This library is used by Rails web applications to integrate with OpenID Providers. Severity can range from medium to critical, depending on how a web application developer chose to employ the ruby-openid library. Developers who based their OpenID integration heavily on the "example app" provided by the project are at highest risk.
- Product
- Ruby-openid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Jun 6, 2019A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2.CVE-2019-8320 · Other software · Rubygems · reported by MITREHigh 7.4
A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. Before making new directories or touching files (which now include path-checking code for symlinks), it would delete the target destination. If that destination was hidden behind a symlink, a malicious gem could delete arbitrary files on the user's machine, presuming the attacker could guess at paths. Given how frequently gem is run as sudo, and how predictable paths are on modern systems (/tmp, /usr, etc.), this could likely lead to data loss or an unusable system.
- Product
- Rubygems
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgaccess.redhat.com
Jun 6, 2019The Chartkick gem through 3.1.0 for Ruby allows XSS.CVE-2019-12732 · Other software · Chartkick Project · reported by MITREMedium 4.7
The Chartkick gem through 3.1.0 for Ruby allows XSS.
- Product
- Chartkick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2019The WEBrick gem 1.4.2 for Ruby allows directory traversal if the attacker once had local access to create a symlink to a location outside of the web root directCVE-2019-11879 · Other software · Ruby-lang · reported by MITREMedium 5.5
The WEBrick gem 1.4.2 for Ruby allows directory traversal if the attacker once had local access to create a symlink to a location outside of the web root directory. NOTE: The vendor states that this is analogous to Options FollowSymlinks in the Apache HTTP Server, and therefore it is "not a problem.
- Product
- Webrick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.ruby-lang.orgbugs.ruby-lang.org
Apr 26, 2019The request phase of the OmniAuth Ruby gem (1.9.1 and earlier) is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, allCVE-2015-9284 · Other software · Omniauth · reported by support@hackerone.comHigh 8.8
The request phase of the OmniAuth Ruby gem (1.9.1 and earlier) is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, allowing accounts to be connected without user intent, user interaction, or feedback to the user. This permits a secondary account to be able to sign into the web application as the primary account.
- Product
- Omniauth
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2019OneLogin Ruby-SAML 1.6.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be abCVE-2017-11428 · Other software · OneLogin · reported by security@duo.comHigh 7.7
OneLogin Ruby-SAML 1.6.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.
- Product
- Ruby-SAML
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.