Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 28

Export CSV
CVE-2013-0162

rubygem-ruby_parser: incorrect temporary file usage

The diff_pp function in lib/gauntlet_rubyparser.rb in the ruby_parser gem 3.1.1 and earlier for Ruby allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Cloudforms Cloudengine Redhat Rhel Sam and 1 more
Products
1 Openshift 1.2 and 1 more
CVE-2013-0155

rubygem-activerecord: Unsafe Query Generation Risk in Ruby on Rails

Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660 and CVE-2012-2694.

CVSS 2.0 · 6.4 Medium EPSS 8.2% KEV · Not listed
Vendors
Cloudforms Cloudengine Debian Redhat and 2 more
Products
1 Debian Linux Openshift and 3 more
CVE-2013-0156

rubygem-activesupport: Multiple vulnerabilities in parameter parsing in ActionPack

active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.

CVSS 2.0 · 7.5 High EPSS 99.0% KEV · Not listed
Vendors
Cloudforms Cloudengine Debian Redhat and 2 more
Products
1 Debian Linux Openshift and 3 more
CVE-2013-0183

rubygem-rack: receiving excessively long lines triggers out-of-memory error

multipart/parser.rb in Rack 1.3.x before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to cause a denial of service (memory consumption and out-of-memory error) via a long string in a Multipart HTTP packet.

CVSS 2.0 · 5.0 Medium EPSS 3.8% KEV · Not listed
Vendors
Cloudforms Cloudengine Rack Project Rhel Sam
Products
1 Rack 1.2
CVE-2013-0184

rubygem-rack: Rack::Auth:: AbstractRequest DoS

Unspecified vulnerability in Rack::Auth::AbstractRequest in Rack 1.1.x before 1.1.5, 1.2.x before 1.2.7, 1.3.x before 1.3.9, and 1.4.x before 1.4.4 allows remote attackers to cause a denial of service via unknown vectors related to "symbolized arbitrary strings."

CVSS 2.0 · 4.3 Medium EPSS 2.4% KEV · Not listed
Vendors
Cloudforms Cloudengine Rack Project Rhel Sam
Products
1 Rack 1.2
CVE-2013-0256

rubygem-rdoc: Cross-site scripting in the documentation created by Darkfish Rdoc HTML generator / template

darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.

CVSS 2.0 · 4.3 Medium EPSS 3.0% KEV · Not listed
Vendors
Canonical Cloudforms Cloudengine Redhat and 2 more
Products
Ubuntu Linux 1 Openshift and 3 more
CVE-2012-1986

puppet: Filebucket arbitrary file read

Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with an authorized SSL key and certain permissions on the puppet master to read arbitrary files via a symlink attack in conjunction with a crafted REST request for a file in a filebucket.

CVSS 2.0 · 2.1 Low EPSS 1.5% KEV · Not listed
Vendors
Cloudforms Cloudengine Puppet Puppetlabs
Products
1 Puppet Puppet Enterprise and 2 more
CVE-2013-0333

rubygem-activesupport: json to yaml parsing

lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.

CVSS 2.0 · 7.5 High EPSS 95.6% KEV · Not listed
Vendors
Cloudforms Cloudengine Redhat Rhel Sam and 1 more
Products
1 Openshift 1.1 and 2 more