Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
784 results · page 6 of 16
Feb 9, 2023A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header.CVE-2023-22795 · Other software · Rubyonrails · reported by support@hackerone.comHigh 7.5
A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Match header can cause the regular expression engine to enter a state of catastrophic backtracking, when on a version of Ruby below 3.2.0. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.
- Product
- Rails
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.rubyonrails.orgsecurity.netapp.com
Feb 9, 2023A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1.CVE-2023-22792 · Other software · Rubyonrails · reported by support@hackerone.comHigh 7.5
A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1. Specially crafted cookies, in combination with a specially crafted X_FORWARDED_HOST header can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.
- Product
- Rails
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.rubyonrails.orgsecurity.netapp.com
Jan 17, 2023ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a sCVE-2022-47318 · Other software · ruby-git · reported by vultures@jpcert.or.jpHigh 8
ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-46648.
- Product
- ruby-git
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a sCVE-2022-46648 · Other software · ruby-git · reported by vultures@jpcert.or.jpHigh 8
ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-47318.
- Product
- ruby-git
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2022Nokogiri is an open source XML and HTML library for the Ruby programming language.CVE-2022-23476 · Other software · sparklemotion · reported by GitHubHigh 7.5
Nokogiri is an open source XML and HTML library for the Ruby programming language. Nokogiri `1.13.8` and `1.13.9` fail to check the return value from `xmlTextReaderExpand` in the method `Nokogiri::XML::Reader#attribute_hash`. This can lead to a null pointer exception when invalid markup is being parsed. For applications using `XML::Reader` to parse untrusted inputs, this may potentially be a vector for a denial of service attack. Users are advised to upgrade to Nokogiri `>= 1.13.10`. Users may be able to search their code for calls to either `XML::Reader#attributes` or `XML::Reader#attribute_hash` to determine if they are affected.
- Product
- nokogiri
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2022Insecure permissions in Chocolatey Ruby package v3.1.2.1 and below grants all users in the Authenticated Users group write privileges for the path C:\tools\rubyCVE-2022-45301 · Other software · Chocolatey · reported by MITREMedium 4.3
Insecure permissions in Chocolatey Ruby package v3.1.2.1 and below grants all users in the Authenticated Users group write privileges for the path C:\tools\ruby31 and all files located in that folder.
- Product
- Chocolatey Ruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2022Sinatra is a domain-specific language for creating web applications in Ruby.CVE-2022-45442 · Other software · sinatra · reported by GitHubHigh 8.8
Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.
- Product
- sinatra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2022The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting.CVE-2021-33621 · Other software · Ruby-lang · reported by MITREHigh 8.8
The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object.
- Product
- CGI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orglists.fedoraproject.org
Oct 26, 2022A vulnerability classified as problematic has been found in Ruby on Rails.CVE-2022-3704 · Other software · unspecified · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in Ruby on Rails. This affects an unknown part of the file actionpack/lib/action_dispatch/middleware/templates/routes/_table.html.erb. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The real existence of this vulnerability is still doubted at the moment. The name of the patch is be177e4566747b73ff63fd5f529fab564e475ed4. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-212319. NOTE: Maintainer declares that there isn’t a valid attack vector. The issue was wrongly reported as a security vulnerability by a non-member of the Rails team.
- Product
- Ruby on Rails
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2022fat_free_crm is a an open source, Ruby on Rails customer relationship management platform (CRM).CVE-2022-39281 · Other software · fatfreecrm · reported by GitHubMedium 6.5
fat_free_crm is a an open source, Ruby on Rails customer relationship management platform (CRM). In versions prior to 0.20.1 an authenticated user can perform a remote Denial of Service attack against Fat Free CRM via bucket access. The vulnerability has been patched in commit `c85a254` and will be available in release `0.20.1`. Users are advised to upgrade or to manually apply patch `c85a254`. There are no known workarounds for this issue.
- Product
- fat_free_crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2022An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function of Ruby.CVE-2016-2338 · Other software · Ruby-lang · reported by cret@cert.orgCritical 9.8
An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function of Ruby. In Psych::Emitter start_document function heap buffer "head" allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase this array size after mentioned allocation and cause heap overflow.
- Product
- Ruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comlists.debian.org
Sep 21, 2022Arr-pm is an RPM reader/writer library written in Ruby.CVE-2022-39224 · Other software · jordansissel · reported by GitHubHigh 7
Arr-pm is an RPM reader/writer library written in Ruby. Versions prior to 0.0.12 are subject to OS command injection resulting in shell execution if the RPM contains a malicious "payload compressor" field. This vulnerability impacts the `extract` and `files` methods of the `RPM::File` class of this library. Version 0.0.12 patches these issues. A workaround for this issue is to ensure any RPMs being processed contain valid/known payload compressor values such as gzip, bzip2, xz, zstd, and lzma. The payload compressor field in an rpm can be checked by using the rpm command line tool.
- Product
- ruby-arr-pm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2022RubyGems.org is the Ruby community gem host.CVE-2022-36073 · Other software · rubygems · reported by GitHubHigh 8.3
RubyGems.org is the Ruby community gem host. A bug in password & email change confirmation code allowed an attacker to change their RubyGems.org account's email to an unowned email address. Having access to an account whose email has been changed could enable an attacker to save API keys for that account, and when a legitimate user attempts to create an account with their email (and has to reset password to gain access) and is granted access to other gems, the attacker would then be able to publish and yank versions of those gems. Commit number 90c9e6aac2d91518b479c51d48275c57de492d4d contains a patch for this issue.
- Product
- rubygems.org
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2022Incorrect access control in the install directory (C:\RailsInstaller) of Rubyinstaller2 v3.1.2 and below allows authenticated attackers to execute arbitrary codCVE-2022-36563 · Other software · Rubyinstaller · reported by MITREHigh 8.8
Incorrect access control in the install directory (C:\RailsInstaller) of Rubyinstaller2 v3.1.2 and below allows authenticated attackers to execute arbitrary code via overwriting binaries located in the directory.
- Product
- Rubyinstaller2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2022Incorrect access control in the install directory (C:\Ruby31-x64) of Rubyinstaller2 v3.1.2 and below allows authenticated attackers to execute arbitrary code viCVE-2022-36562 · Other software · Rubyinstaller · reported by MITREHigh 8.8
Incorrect access control in the install directory (C:\Ruby31-x64) of Rubyinstaller2 v3.1.2 and below allows authenticated attackers to execute arbitrary code via overwriting binaries located in the directory.
- Product
- Rubyinstaller2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2022TZInfo is a Ruby library that provides access to time zone data and allows times to be converted using time zone rules.CVE-2022-31163 · Other software · tzinfo · reported by GitHubHigh 7.5
TZInfo is a Ruby library that provides access to time zone data and allows times to be converted using time zone rules. Versions prior to 0.36.1, as well as those prior to 1.2.10 when used with the Ruby data source tzinfo-data, are vulnerable to relative path traversal. With the Ruby data source, time zones are defined in Ruby files. There is one file per time zone. Time zone files are loaded with `require` on demand. In the affected versions, `TZInfo::Timezone.get` fails to validate time zone identifiers correctly, allowing a new line character within the identifier. With Ruby version 1.9.3 and later, `TZInfo::Timezone.get` can be made to load unintended files with `require`, executing them within the Ruby process. Versions 0.3.61 and 1.2.10 include fixes to correctly validate time zone identifiers. Versions 2.0.0 and later are not vulnerable. Version 0.3.61 can still load arbitrary files from the Ruby load path if their name follows the rules for a valid time zone identifier and the file has a prefix of `tzinfo/definition` within a directory in the load path. Applications should ensure that untrusted files are not placed in a directory on the load path. As a workaround, the time
- Product
- tzinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2022opensearch-ruby is a community-driven, open source fork of elasticsearch-ruby.CVE-2022-31115 · Other software · opensearch-project · reported by GitHubHigh 8.8
opensearch-ruby is a community-driven, open source fork of elasticsearch-ruby. In versions prior to 2.0.1 the ruby `YAML.load` function was used instead of `YAML.safe_load`. As a result opensearch-ruby 2.0.0 and prior can lead to unsafe deserialization using YAML.load if the response is of type YAML. An attacker must be in control of an opensearch server and convince the victim to connect to it in order to exploit this vulnerability. The problem has been patched in opensearch-ruby gem version 2.0.1. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- opensearch-ruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2022A malicious MySQL server can request local file content from a client using ruby-mysql prior to version 2.10.0 without explicit authorization from the user.CVE-2021-3779 · Other software · Tomita Masahiro · reported by cve@rapid7.comMedium 6.5
A malicious MySQL server can request local file content from a client using ruby-mysql prior to version 2.10.0 without explicit authorization from the user. This issue was resolved in version 2.10.0 and later.
- Product
- ruby-mysql
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2022# Possible XSS Vulnerability in Rails::Html::SanitizerThere is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.This vulnerabiCVE-2022-32209 · Other software · Rubyonrails · reported by support@hackerone.comMedium 6.1
# Possible XSS Vulnerability in Rails::Html::SanitizerThere is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.This vulnerability has been assigned the CVE identifier CVE-2022-32209.Versions Affected: ALLNot affected: NONEFixed Versions: v1.4.3## ImpactA possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags to allow both `select` and `style` elements.Code is only impacted if allowed tags are being overridden. This may be done via application configuration:```ruby# In config/application.rbconfig.action_view.sanitized_allowed_tags = ["select", "style"]```see https://guides.rubyonrails.org/configuring.html#configuring-action-viewOr it may be done with a `:tags` option to the Action View helper `sanitize`:```<%= sanitize @comment.body, tags: ["select", "style"] %>```see https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitizeOr it may be done with Rails::Html::SafeListSanitizer directly:```ruby# class-level optionRails::Html::SafeListSanitizer.allowed_tags = ["select", "style"]`
- Product
- Rails Html Sanitizers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comlists.debian.org
Jun 15, 2022Octokit is a Ruby toolkit for the GitHub API.CVE-2022-31072 · Other software · octokit · reported by GitHubLow 2.5
Octokit is a Ruby toolkit for the GitHub API. Versions 4.23.0 and 4.24.0 of the octokit gem were published containing world-writeable files. Specifically, the gem was packed with files having their permissions set to `-rw-rw-rw-` (i.e. 0666) instead of `rw-r--r--` (i.e. 0644). This means everyone who is not the owner (Group and Public) with access to the instance where this release had been installed could modify the world-writable files from this gem. This issue is patched in Octokit 4.25.0. Two workarounds are available. Users can use the previous version of the gem, v4.22.0. Alternatively, users can modify the file permissions manually until they are able to upgrade to the latest version.
- Product
- octokit.rb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2022jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable.CVE-2022-32511 · Other software · Jmespath · reported by MITRECritical 9.8
jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable.
- Product
- Jmespath
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022An argument injection vulnerability in Dragonfly Ruby Gem v1.3.0 allows attackers to read and write arbitrary files when the verify_url option is disabled.CVE-2021-33473 · Other software · Dragonfly Project · reported by MITRECritical 9.1
An argument injection vulnerability in Dragonfly Ruby Gem v1.3.0 allows attackers to read and write arbitrary files when the verify_url option is disabled. This vulnerability is exploited via a crafted URL.
- Product
- Dragonfly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2022Use After Free in GitHub repository mruby/mruby prior to 3.2.CVE-2022-1934 · Other software · mruby · reported by security@huntr.devHigh 7.8
Use After Free in GitHub repository mruby/mruby prior to 3.2.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022A XSS Vulnerability in Action View tag helpers >= 5.2.0 and < 5.2.0 which would allow an attacker to inject content if able to control input into specific attriCVE-2022-27777 · Other software · Rubyonrails · reported by support@hackerone.comMedium 6.1
A XSS Vulnerability in Action View tag helpers >= 5.2.0 and < 5.2.0 which would allow an attacker to inject content if able to control input into specific attributes.
- Product
- Actionpack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.rubyonrails.orglists.debian.org
May 26, 2022An XSS Vulnerability in Action Pack >= 5.2.0 and < 5.2.0 that could allow an attacker to bypass CSP for non HTML like responses.CVE-2022-22577 · Other software · Rubyonrails · reported by support@hackerone.comMedium 6.1
An XSS Vulnerability in Action Pack >= 5.2.0 and < 5.2.0 that could allow an attacker to bypass CSP for non HTML like responses.
- Product
- Actionpack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.rubyonrails.orglists.debian.org
May 26, 2022A code injection vulnerability exists in the Active Storage >= v5.2.0 that could allow an attacker to execute code via image_processing arguments.CVE-2022-21831 · Other software · Rubyonrails · reported by support@hackerone.comCritical 9.8
A code injection vulnerability exists in the Active Storage >= v5.2.0 that could allow an attacker to execute code via image_processing arguments.
- Product
- Active Storage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
May 20, 2022Nokogiri is an open source XML and HTML library for Ruby.CVE-2022-29181 · Other software · sparklemotion · reported by GitHubHigh 8.2
Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors (segfault) or reads from unrelated memory. Version 1.13.6 contains a patch for this issue. As a workaround, ensure the untrusted input is a `String` by calling `#to_s` or equivalent.
- Product
- nokogiri
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2022The random_password_generator (aka RandomPasswordGenerator) gem through 1.0.0 for Ruby uses Kernel#rand to generate passwords, which, due to its cyclic nature, CVE-2019-25061 · Other software · Random Password Generator Project · reported by MITREHigh 7.5
The random_password_generator (aka RandomPasswordGenerator) gem through 1.0.0 for Ruby uses Kernel#rand to generate passwords, which, due to its cyclic nature, can facilitate password prediction.
- Product
- Random Password Generator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2022RubyGems is a package registry used to supply software for the Ruby language ecosystem.CVE-2022-29218 · Other software · rubygems · reported by GitHubHigh 7.7
RubyGems is a package registry used to supply software for the Ruby language ecosystem. An ordering mistake in the code that accepts gem uploads allowed some gems (with platforms ending in numbers, like `arm64-darwin-21`) to be temporarily replaced in the CDN cache by a malicious package. The bug has been patched, and is believed to have never been exploited, based on an extensive review of logs and existing gems by rubygems. The easiest way to ensure that an application has not been exploited by this vulnerability is to verify all downloaded .gems checksums match the checksum recorded in the RubyGems.org database. RubyGems.org has been patched and is no longer vulnerable to this issue.
- Product
- rubygems.org
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.netapp.com
May 9, 2022There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2.CVE-2022-28739 · Other software · Ruby-lang · reported by MITREHigh 7.5
There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion, including Kernel#Float and String#to_f.
- Product
- Ruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
May 9, 2022A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2.CVE-2022-28738 · Other software · Ruby-lang · reported by MITRECritical 9.8
A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2. If a victim attempts to create a Regexp from untrusted user input, an attacker may be able to write to unexpected memory locations.
- Product
- Ruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comsecurity-tracker.debian.org
May 5, 2022Rubygems is a package registry used to supply software for the Ruby language ecosystem.CVE-2022-29176 · Other software · rubygems · reported by GitHubCritical 9.9
Rubygems is a package registry used to supply software for the Ruby language ecosystem. Due to a bug in the yank action, it was possible for any RubyGems.org user to remove and replace certain gems even if that user was not authorized to do so. To be vulnerable, a gem needed: one or more dashes in its name creation within 30 days OR no updates for over 100 days At present, we believe this vulnerability has not been exploited. RubyGems.org sends an email to all gem owners when a gem version is published or yanked. We have not received any support emails from gem owners indicating that their gem has been yanked without authorization. An audit of gem changes for the last 18 months did not find any examples of this vulnerability being used in a malicious way. A deeper audit for any possible use of this exploit is ongoing, and we will update this advisory once it is complete. Using Bundler in --frozen or --deployment mode in CI and during deploys, as the Bundler team has always recommended, will guarantee that your application does not silently switch to versions created using this exploit. To audit your application history for possible past exploits, review your Gemfile.lock and look f
- Product
- rubygems.org
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhackerone.com
Apr 22, 2022Out-of-bounds Read in mrb_obj_is_kind_of in in GitHub repository mruby/mruby prior to 3.2.CVE-2022-1427 · Other software · mruby · reported by security@huntr.devHigh 7.8
Out-of-bounds Read in mrb_obj_is_kind_of in in GitHub repository mruby/mruby prior to 3.2. # Impact: Possible arbitrary code execution if being exploited.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2022Nokogiri is an open source XML and HTML library for Ruby.CVE-2022-24836 · Other software · sparklemotion · reported by GitHubHigh 7.5
Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokogiri `>= 1.13.4`. There are no known workarounds for this issue.
- Product
- nokogiri
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orggithub.com
Apr 10, 2022heap-buffer-overflow in mrb_vm_exec in mruby/mruby in GitHub repository mruby/mruby prior to 3.2.CVE-2022-1286 · Other software · mruby · reported by security@huntr.devCritical 9.8
heap-buffer-overflow in mrb_vm_exec in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2022Out-of-bounds Read in mrb_get_args in GitHub repository mruby/mruby prior to 3.2.CVE-2022-1276 · Other software · mruby · reported by security@huntr.devCritical 9.8
Out-of-bounds Read in mrb_get_args in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2022yajl-ruby is a C binding to the YAJL JSON parsing and generation library.CVE-2022-24795 · Other software · brianmario · reported by GitHubMedium 5.9
yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of `yajl` contain an integer overflow which leads to subsequent heap memory corruption when dealing with large (~2GB) inputs. The reallocation logic at `yajl_buf.c#L64` may result in the `need` 32bit integer wrapping to 0 when `need` approaches a value of 0x80000000 (i.e. ~2GB of data), which results in a reallocation of buf->alloc into a small heap chunk. These integers are declared as `size_t` in the 2.x branch of `yajl`, which practically prevents the issue from triggering on 64bit platforms, however this does not preclude this issue triggering on 32bit builds on which `size_t` is a 32bit integer. Subsequent population of this under-allocated heap chunk is based on the original buffer size, leading to heap memory corruption. This vulnerability mostly impacts process availability. Maintainers believe exploitation for arbitrary code execution is unlikely. A patch is available and anticipated to be part of yajl-ruby version 1.4.2. As a workaround, avoid passing large inputs to YAJL.
- Product
- yajl-ruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2022Use-After-Free in str_escape in mruby/mruby in GitHub repository mruby/mruby prior to 3.2.CVE-2022-1212 · Other software · mruby · reported by security@huntr.devCritical 9.8
Use-After-Free in str_escape in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2022NULL Pointer Dereference in mrb_vm_exec with super in GitHub repository mruby/mruby prior to 3.2.CVE-2022-1201 · Other software · mruby · reported by security@huntr.devMedium 6.5
NULL Pointer Dereference in mrb_vm_exec with super in GitHub repository mruby/mruby prior to 3.2. This vulnerability is capable of making the mruby interpreter crash, thus affecting the availability of the system.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2022Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications.CVE-2022-24790 · Other software · puma · reported by GitHubCritical 9.1
Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on where a request starts and ends. This would allow requests to be smuggled via the front-end proxy to Puma. The vulnerability has been fixed in 5.6.4 and 4.3.12. Users are advised to upgrade as soon as possible. Workaround: when deploying a proxy in front of Puma, turning on any and all functionality to make sure that the request matches the RFC7230 standard.
- Product
- puma
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2022use after free in mrb_vm_exec in GitHub repository mruby/mruby prior to 3.2.CVE-2022-1106 · Other software · mruby · reported by security@huntr.devCritical 9.1
use after free in mrb_vm_exec in GitHub repository mruby/mruby prior to 3.2.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2022User after free in mrb_vm_exec in GitHub repository mruby/mruby prior to 3.2.CVE-2022-1071 · Other software · mruby · reported by security@huntr.devHigh 8.2
User after free in mrb_vm_exec in GitHub repository mruby/mruby prior to 3.2.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2022A flaw was found in all versions of kubeclient up to (but not including) v4.9.3, the Ruby client for Kubernetes REST API, in the way it parsed kubeconfig files.CVE-2022-0759 · Other software · Redhat · reported by Red HatHigh 8.1
A flaw was found in all versions of kubeclient up to (but not including) v4.9.3, the Ruby client for Kubernetes REST API, in the way it parsed kubeconfig files. When the kubeconfig file does not configure custom CA to verify certs, kubeclient ends up accepting any certificate (it wrongly returns VERIFY_NONE). Ruby applications that leverage kubeclient to parse kubeconfig files are susceptible to Man-in-the-middle attacks (MITM).
- Product
- Kubeclient
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2022NULL Pointer Dereference in GitHub repository mruby/mruby prior to 3.2.CVE-2022-0890 · Other software · mruby · reported by security@huntr.devMedium 5.5
NULL Pointer Dereference in GitHub repository mruby/mruby prior to 3.2.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2022VIewComponent is a framework for building view components in Ruby on Rails.CVE-2022-24722 · Other software · github · reported by GitHubHigh 8.1
VIewComponent is a framework for building view components in Ruby on Rails. Versions prior to 2.31.2 and 2.49.1 contain a cross-site scripting vulnerability that has the potential to impact anyone using translations with the view_component gem. Data received via user input and passed as an interpolation argument to the `translate` method is not properly sanitized before display. Versions 2.31.2 and 2.49.1 have been released and fully mitigate the vulnerability. As a workaround, avoid passing user input to the `translate` function, or sanitize the inputs before passing them.
- Product
- view_component
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2022Out-of-bounds Read in GitHub repository mruby/mruby prior to 3.2.CVE-2022-0717 · Other software · mruby · reported by security@huntr.devCritical 9.1
Out-of-bounds Read in GitHub repository mruby/mruby prior to 3.2.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2022NULL Pointer Dereference in Homebrew mruby prior to 3.2.CVE-2022-0632 · Other software · mruby · reported by security@huntr.devMedium 5.5
NULL Pointer Dereference in Homebrew mruby prior to 3.2.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2022Out-of-bounds Read in Homebrew mruby prior to 3.2.CVE-2022-0630 · Other software · mruby · reported by security@huntr.devHigh 7.1
Out-of-bounds Read in Homebrew mruby prior to 3.2.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2022Heap-based Buffer Overflow in Homebrew mruby prior to 3.2.CVE-2022-0631 · Other software · mruby · reported by security@huntr.devCritical 9.8
Heap-based Buffer Overflow in Homebrew mruby prior to 3.2.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2022Out-of-bounds Read in Homebrew mruby prior to 3.2.CVE-2022-0623 · Other software · mruby · reported by security@huntr.devCritical 9.1
Out-of-bounds Read in Homebrew mruby prior to 3.2.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.