Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
784 results · page 7 of 16
Feb 16, 2022Use of Out-of-range Pointer Offset in Homebrew mruby prior to 3.2.CVE-2022-0614 · Other software · mruby · reported by security@huntr.devMedium 5.5
Use of Out-of-range Pointer Offset in Homebrew mruby prior to 3.2.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2022Heap-based Buffer Overflow in Homebrew mruby prior to 3.2.CVE-2022-0570 · Other software · mruby · reported by security@huntr.devCritical 9.8
Heap-based Buffer Overflow in Homebrew mruby prior to 3.2.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2022Puma is a Ruby/Rack web server built for parallelism.CVE-2022-23634 · Other software · puma · reported by GitHubHigh 8
Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Upgrading to a patched Rails _or_ Puma version fixes the vulnerability.
- Product
- puma
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2022Out-of-bounds Read in Homebrew mruby prior to 3.2.CVE-2022-0525 · Other software · mruby · reported by security@huntr.devCritical 9.1
Out-of-bounds Read in Homebrew mruby prior to 3.2.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2022CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows)CVE-2021-41816 · Other software · Ruby-lang · reported by MITRECritical 9.8
CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of bytes. This also affects the CGI gem before 0.3.1 for Ruby.
- Product
- CGI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comlists.fedoraproject.org
Feb 4, 2022NULL Pointer Dereference in Homebrew mruby prior to 3.2.CVE-2022-0481 · Other software · mruby · reported by security@huntr.devHigh 7.5
NULL Pointer Dereference in Homebrew mruby prior to 3.2.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2022NULL Pointer Dereference in Homebrew mruby prior to 3.2.CVE-2022-0326 · Other software · mruby · reported by security@huntr.devMedium 5.5
NULL Pointer Dereference in Homebrew mruby prior to 3.2.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2022mruby is vulnerable to NULL Pointer DereferenceCVE-2022-0240 · Other software · mruby · reported by security@huntr.devHigh 7.5
mruby is vulnerable to NULL Pointer Dereference
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2022An untrusted pointer dereference in mrb_vm_exec() of mruby v3.0.0 can lead to a segmentation fault or application crash.CVE-2021-46020 · Other software · Mruby · reported by MITREHigh 7.5
An untrusted pointer dereference in mrb_vm_exec() of mruby v3.0.0 can lead to a segmentation fault or application crash.
- Product
- Mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2022A open redirect vulnerability exists in Action Pack >= 6.0.0 that could allow an attacker to craft a "X-Forwarded-Host" headers in combination with certain "allCVE-2021-44528 · Other software · Rubyonrails · reported by support@hackerone.comMedium 6.1
A open redirect vulnerability exists in Action Pack >= 6.0.0 that could allow an attacker to craft a "X-Forwarded-Host" headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.
- Product
- Rails
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.netapp.com
Jan 2, 2022mruby is vulnerable to Heap-based Buffer OverflowCVE-2022-0080 · Other software · mruby · reported by security@huntr.devCritical 9.8
mruby is vulnerable to Heap-based Buffer Overflow
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 1, 2022CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names.CVE-2021-41819 · Other software · Ruby-lang · reported by MITREHigh 7.5
CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.
- Product
- CGI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comlists.fedoraproject.org
Jan 1, 2022Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string.CVE-2021-41817 · Other software · Ruby-lang · reported by MITREHigh 7.5
Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.
- Product
- Date
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comlists.fedoraproject.org
Dec 30, 2021mruby is vulnerable to NULL Pointer DereferenceCVE-2021-4188 · Other software · mruby · reported by security@huntr.devHigh 7.5
mruby is vulnerable to NULL Pointer Dereference
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2021message_bus is a messaging bus for Ruby processes and web clients.CVE-2021-43840 · Other software · discourse · reported by GitHubMedium 4.4
message_bus is a messaging bus for Ruby processes and web clients. In versions prior to 3.3.7 users who deployed message bus with diagnostics features enabled (default off) are vulnerable to a path traversal bug, which could lead to disclosure of secret information on a machine if an unintended user were to gain access to the diagnostic route. The impact is also greater if there is no proxy for your web application as the number of steps up the directories is not bounded. For deployments which uses a proxy, the impact varies. For example, If a request goes through a proxy like Nginx with `merge_slashes` enabled, the number of steps up the directories that can be read is limited to 3 levels. This issue has been patched in version 3.3.7. Users unable to upgrade should ensure that MessageBus::Diagnostics is disabled.
- Product
- message_bus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2021mruby is vulnerable to NULL Pointer DereferenceCVE-2021-4110 · Other software · mruby · reported by security@huntr.devHigh 7.5
mruby is vulnerable to NULL Pointer Dereference
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2021`Bundler` is a package for managing application dependencies in Ruby.CVE-2021-43809 · Other software · rubygems · reported by GitHubMedium 6.7
`Bundler` is a package for managing application dependencies in Ruby. In `bundler` versions before 2.2.33, when working with untrusted and apparently harmless `Gemfile`'s, it is not expected that they lead to execution of external code, unless that's explicit in the ruby code inside the `Gemfile` itself. However, if the `Gemfile` includes `gem` entries that use the `git` option with invalid, but seemingly harmless, values with a leading dash, this can be false. To handle dependencies that come from a Git repository instead of a registry, Bundler uses various commands, such as `git clone`. These commands are being constructed using user input (e.g. the repository URL). When building the commands, Bundler versions before 2.2.33 correctly avoid Command Injection vulnerabilities by passing an array of arguments instead of a command string. However, there is the possibility that a user input starts with a dash (`-`) and is therefore treated as an optional argument instead of a positional one. This can lead to Code Execution because some of the commands have options that can be leveraged to run arbitrary executables. Since this value comes from the `Gemfile` file, it can contain any char
- Product
- rubygems
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2021A cross-site scripting vulnerability flaw was found in the auto_link function in Rails before version 3.0.6.CVE-2011-1497 · Other software · Rubyonrails · reported by Red HatMedium 6.1
A cross-site scripting vulnerability flaw was found in the auto_link function in Rails before version 3.0.6.
- Product
- Rails
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comopenwall.com
Oct 18, 2021A possible open redirect vulnerability in the Host Authorization middleware in Action Pack >= 6.0.0 that could allow attackers to redirect users to a malicious CVE-2021-22942 · Other software · Rubyonrails · reported by support@hackerone.comMedium 6.1
A possible open redirect vulnerability in the Host Authorization middleware in Action Pack >= 6.0.0 that could allow attackers to redirect users to a malicious website.
- Product
- Rails
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurity.netapp.com
Oct 12, 2021Puma is a HTTP 1.1 server for Ruby/Rack applications.CVE-2021-41136 · Other software · puma · reported by GitHubLow 3.7
Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using `puma` with a proxy which forwards HTTP header values which contain the LF character could allow HTTP request smugggling. A client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. The only proxy which has this behavior, as far as the Puma team is aware of, is Apache Traffic Server. If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request, send back a response that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send another request for a different client, the second response from the first client will be sent to the second client. This vulnerability was patched in Puma 5.5.1 and 4.3.9. As a workaround, do not use Apache Traffic Server with `puma`.
- Product
- puma
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2021A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE/EE all versions starting from 11.9 before 14.0.9, all versions starting fromCVE-2021-39880 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.5
A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE/EE all versions starting from 11.9 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all versions starting from 14.2 before 14.2.2 allows an attacker to deny access to all users via specially crafted requests to the apollo_upload_server middleware.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2021Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support.CVE-2021-41098 · Other software · sparklemotion · reported by GitHubHigh 7.5
Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parser resolves external entities by default. Users of Nokogiri on JRuby who parse untrusted documents using any of these classes are affected: Nokogiri::XML::SAX::Parse, Nokogiri::HTML4::SAX::Parser or its alias Nokogiri::HTML::SAX::Parser, Nokogiri::XML::SAX::PushParser, and Nokogiri::HTML4::SAX::PushParser or its alias Nokogiri::HTML::SAX::PushParser. JRuby users should upgrade to Nokogiri v1.12.5 or later to receive a patch for this issue. There are no workarounds available for v1.12.4 or earlier. CRuby users are not affected.
- Product
- nokogiri
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2021In JetBrains RubyMine before 2021.1.1, code execution without user confirmation was possible for untrusted projects.CVE-2021-37543 · Other software · Jetbrains · reported by MITREHigh 8.8
In JetBrains RubyMine before 2021.1.1, code execution without user confirmation was possible for untrusted projects.
- Product
- Rubymine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.jetbrains.comblog.jetbrains.com
Aug 1, 2021An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1.CVE-2021-32066 · Other software · Ruby-lang · reported by MITREHigh 7.4
An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."
- Product
- Ruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhackerone.com
Jul 30, 2021In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.CVE-2021-31799 · Other software · Debian · reported by MITREHigh 7
In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.
- Product
- Debian Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgsecurity-tracker.debian.org
Jul 30, 2021In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.CVE-2021-28966 · Other software · Ruby-lang · reported by MITREHigh 7.5
In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.
- Product
- Ruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comsecurity.netapp.com
Jul 18, 2021uBlock Origin before 1.36.2 and nMatrix before 4.4.9 support an arbitrary depth of parameter nesting for strict blocking, which allows crafted web sites to causCVE-2021-36773 · Other software · Sciruby · reported by MITREHigh 7.5
uBlock Origin before 1.36.2 and nMatrix before 4.4.9 support an arbitrary depth of parameter nesting for strict blocking, which allows crafted web sites to cause a denial of service (unbounded recursion that can trigger memory consumption and a loss of all blocking functionality).
- Product
- Nmatrix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Jul 13, 2021An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1.CVE-2021-31810 · Other software · Ruby-lang · reported by MITREMedium 5.8
An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions).
- Product
- Ruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comlists.debian.org
Jul 6, 2021Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library.CVE-2021-32740 · Other software · sporkmonger · reported by GitHubHigh 7.5
Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. An uncontrolled resource consumption vulnerability exists after version 2.3.0 through version 2.7.0. Within the URI template implementation in Addressable, a maliciously crafted template may result in uncontrolled resource consumption, leading to denial of service when matched against a URI. In typical usage, templates would not normally be read from untrusted user input, but nonetheless, no previous security advisory for Addressable has cautioned against doing this. Users of the parsing capabilities in Addressable but not the URI template capabilities are unaffected. The vulnerability is patched in version 2.8.0. As a workaround, only create Template objects from trusted sources that have been validated not to produce catastrophic backtracking.
- Product
- addressable
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2021mruby 2.1.2 has a double free in mrb_default_allocf (called from mrb_free and obj_free).CVE-2020-36401 · Other software · Mruby · reported by MITREHigh 7.8
mruby 2.1.2 has a double free in mrb_default_allocf (called from mrb_free and obj_free).
- Product
- Mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orggithub.com
Jun 28, 2021Narou (aka Narou.rb) before 3.8.0 allows Ruby Code Injection via the title name or author name of a novel.CVE-2021-35514 · Other software · Narou Project · reported by MITRECritical 9.8
Narou (aka Narou.rb) before 3.8.0 allows Ruby Code Injection via the title name or author name of a novel.
- Product
- Narou
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvuln.ryotak.me
Jun 23, 2021In the bindata RubyGem before version 2.4.10 there is a potential denial-of-service vulnerability.CVE-2021-32823 · Other software · dmendel · reported by GitHubLow 3.7
In the bindata RubyGem before version 2.4.10 there is a potential denial-of-service vulnerability. In affected versions it is very slow for certain classes in BinData to be created. For example BinData::Bit100000, BinData::Bit100001, BinData::Bit100002, BinData::Bit<N>. In combination with <user_input>.constantize there is a potential for a CPU-based DoS. In version 2.4.10 bindata improved the creation time of Bits and Integers.
- Product
- bindata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordabout.gitlab.comgithub.com
Jun 11, 2021The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authentication logic in ActCVE-2021-22904 · Other software · Rubyonrails · reported by support@hackerone.comHigh 7.5
The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authentication logic in Action Controller due to a too permissive regular expression. Impacted code uses `authenticate_or_request_with_http_token` or `authenticate_with_http_token` for request authentication.
- Product
- Rails
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.rubyonrails.orghackerone.com
Jun 11, 2021The actionpack ruby gem before 6.1.3.2 suffers from a possible open redirect vulnerability.CVE-2021-22903 · Other software · Rubyonrails · reported by support@hackerone.comMedium 6.1
The actionpack ruby gem before 6.1.3.2 suffers from a possible open redirect vulnerability. Specially crafted Host headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. This is similar to CVE-2021-22881. Strings in config.hosts that do not have a leading dot are converted to regular expressions without proper escaping. This causes, for example, `config.hosts << "sub.example.com"` to permit a request with a Host header value of `sub-example.com`.
- Product
- Rails
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.rubyonrails.orghackerone.com
Jun 11, 2021The actionpack ruby gem (a framework for handling and responding to web requests in Rails) before 6.0.3.7, 6.1.3.2 suffers from a possible denial of service vulCVE-2021-22902 · Other software · Rubyonrails · reported by support@hackerone.comHigh 7.5
The actionpack ruby gem (a framework for handling and responding to web requests in Rails) before 6.0.3.7, 6.1.3.2 suffers from a possible denial of service vulnerability in the Mime type parser of Action Dispatch. Carefully crafted Accept headers can cause the mime type parser in Action Dispatch to do catastrophic backtracking in the regular expression engine.
- Product
- Rails
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.rubyonrails.orghackerone.com
May 29, 2021An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL whCVE-2021-33564 · Other software · Dragonfly Project · reported by MITRECritical 9.8
An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL when the verify_url option is disabled. This may lead to code execution. The problem occurs because the generate and process features mishandle use of the ImageMagick convert utility.
- Product
- Dragonfly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2021A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the `redirect_to` or `polymorphic_url`helper wiCVE-2021-22885 · Other software · Rubyonrails · reported by support@hackerone.comHigh 7.5
A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the `redirect_to` or `polymorphic_url`helper with untrusted user input.
- Product
- Rails
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comsecurity.netapp.com
May 25, 2021The Pixar ruby-jss gem before 1.6.0 allows remote attackers to execute arbitrary code because of the Plist gem's documented behavior of using Marshal.load durinCVE-2021-33575 · Other software · Pixar · reported by MITRECritical 9.8
The Pixar ruby-jss gem before 1.6.0 allows remote attackers to execute arbitrary code because of the Plist gem's documented behavior of using Marshal.load during XML document processing.
- Product
- Ruby-jss
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2021Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications.CVE-2021-29509 · Other software · puma · reported by GitHubHigh 7.5
Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same process. However, new connections may still be starved by greedy persistent-connections saturating all threads in all processes in the cluster. A `puma` server which received more concurrent `keep-alive` connections than the server had threads in its threadpool would service only a subset of connections, denying service to the unserved connections. This problem has been fixed in `puma` 4.3.8 and 5.3.1. Setting `queue_requests false` also fixes the issue. This is not advised when using `puma` without a reverse proxy, such as `nginx` or `apache`, because you will open yourself to slow client attacks (e.g. slowloris). The fix is very small and a git patch is available for those using unsupported versions of Puma.
- Product
- puma
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Apr 21, 2021The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues.CVE-2021-28965 · Other software · Ruby-lang · reported by MITREHigh 7.5
The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.
- Product
- Rexml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgsecurity.netapp.com
Apr 8, 2021A flaw was found in Red Hat Satellite in tfm-rubygem-foreman_azure_rm in versions before 2.2.0.CVE-2021-3413 · Other software · Theforeman · reported by Red HatMedium 6.3
A flaw was found in Red Hat Satellite in tfm-rubygem-foreman_azure_rm in versions before 2.2.0. A credential leak was identified which will expose Azure Resource Manager's secret key through JSON of the API output. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
- Product
- Foreman Azurerm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Mar 5, 2021The activerecord-session_store (aka Active Record Session Store) component through 1.1.3 for Ruby on Rails does not use a constant-time approach when deliveringCVE-2019-25025 · Other software · Rubyonrails · reported by MITREMedium 5.3
The activerecord-session_store (aka Active Record Session Store) component through 1.1.3 for Ruby on Rails does not use a constant-time approach when delivering information about whether a guessed session ID is valid. Consequently, remote attackers can leverage timing discrepancies to achieve a correct guess in a relatively short amount of time. This is a related issue to CVE-2019-16782.
- Product
- Active Record Session Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2021The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability.CVE-2021-22881 · Other software · Rubyonrails · reported by support@hackerone.comMedium 6.1
The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted `Host` header can be used to redirect to a malicious website.
- Product
- Rails
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Feb 11, 2021The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability.CVE-2021-22880 · Other software · Rubyonrails · reported by support@hackerone.comHigh 7.5
The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the `money` type of the PostgreSQL adapter in Active Record to spend too much time in a regular expression, resulting in the potential for a DoS attack. This only impacts Rails applications that are using PostgreSQL along with money type columns that take user input.
- Product
- Rails
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.rubyonrails.orghackerone.com
Feb 8, 2021CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications.CVE-2021-21305 · Other software · carrierwaveuploader · reported by GitHubHigh 7.4
CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1, there is a code injection vulnerability. The "#manipulate!" method inappropriately evals the content of mutation option(:read/:write), allowing attackers to craft a string that can be executed as a Ruby code. If an application developer supplies untrusted inputs to the option, it will lead to remote code execution(RCE). This is fixed in versions 1.3.2 and 2.1.1.
- Product
- carrierwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2021CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications.CVE-2021-21288 · Other software · carrierwaveuploader · reported by GitHubMedium 4.3
CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1 the download feature has an SSRF vulnerability, allowing attacks to provide DNS entries or IP addresses that are intended for internal use and gather information about the Intranet infrastructure of the platform. This is fixed in versions 1.3.2 and 2.1.1.
- Product
- carrierwave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2021Mechanize is an open-source ruby library that makes automated web interaction easy.CVE-2021-21289 · Other software · sparklemotion · reported by GitHubHigh 7.4
Mechanize is an open-source ruby library that makes automated web interaction easy. In Mechanize from version 2.0.0 and before version 2.7.7 there is a command injection vulnerability. Affected versions of mechanize allow for OS commands to be injected using several classes' methods which implicitly use Ruby's Kernel.open method. Exploitation is possible only if untrusted input is used as a local filename and passed to any of these calls: Mechanize::CookieJar#load, Mechanize::CookieJar#save_as, Mechanize#download, Mechanize::Download#save, Mechanize::File#save, and Mechanize::FileResponse#read_body. This is fixed in version 2.7.7.
- Product
- mechanize
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2021The ftpd gem 0.2.1 for Ruby allows remote attackers to execute arbitrary OS commands via shell metacharacters in a LIST or NLST command argument within FTP protCVE-2013-2512 · Other software · Ftpd Project · reported by MITRECritical 9.8
The ftpd gem 0.2.1 for Ruby allows remote attackers to execute arbitrary OS commands via shell metacharacters in a LIST or NLST command argument within FTP protocol traffic.
- Product
- Ftpd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvapidlabs.comvapidlabs.com
Jan 11, 2021Redcarpet is a Ruby library for Markdown processing.CVE-2020-26298 · Other software · vmg · reported by GitHubMedium 6.8
Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the `:escape_html` option was being used. This is fixed in version 3.5.1 by the referenced commit.
- Product
- redcarpet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2021In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in anoCVE-2020-8264 · Other software · Rubyonrails · reported by support@hackerone.comMedium 6.1
In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware.
- Product
- Rails
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgroups.google.comhackerone.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.