Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 8

Export CSV
CVE-2006-5467

Ruby CGI multipart parsing DoS

The cgi.rb CGI library for Ruby 1.8 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an HTTP request with a multipart MIME body that contains an invalid boundary specifier, as demonstrated using a specifier that begins with a "-" instead of "--" and contains an inconsistent ID.

CVSS 2.0 · 5.0 Medium EPSS 4.5% KEV · Not listed
Vendors
Redhat Yukihiro Matsumoto
Products
Enterprise Linux Ruby
CVE-2006-6303

ruby's cgi.rb vulnerable infinite loop DoS

The read_multipart function in cgi.rb in Ruby before 1.8.5-p2 does not properly detect boundaries in MIME multipart content, which allows remote attackers to cause a denial of service (infinite loop) via crafted HTTP requests, a different issue than CVE-2006-5467.

CVSS 2.0 · 5.0 Medium EPSS 4.0% KEV · Not listed
Vendors
Redhat Yukihiro Matsumoto
Products
Enterprise Linux Ruby
CVE-2005-1992

security flaw

The XMLRPC server in utils.rb for the ruby library (libruby) 1.8 sets an invalid default value that prevents "security protection" using handlers, which allows remote attackers to execute arbitrary commands.

CVSS 2.0 · 7.5 High EPSS 6.6% KEV · Not listed
Vendors
Redhat Yukihiro Matsumoto
Products
Enterprise Linux Ruby
CVE-2005-2337

security flaw

Ruby 1.6.x up to 1.6.8, 1.8.x up to 1.8.2, and 1.9.0 development up to 2005-09-01 allows attackers to bypass safe level and taint flag protections and execute disallowed code when Ruby processes a program through standard input (stdin).

CVSS 2.0 · 7.5 High EPSS 3.3% KEV · Not listed
Vendors
Redhat Yukihiro Matsumoto
Products
Enterprise Linux Ruby
CVE-2004-0755

security flaw

The FileStore capability in CGI::Session for Ruby before 1.8.1, and possibly PStore, creates files with insecure permissions, which can allow local users to steal session information and hijack sessions.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Redhat Yukihiro Matsumoto
Products
Enterprise Linux Ruby
CVE-2006-3694

security flaw

Multiple unspecified vulnerabilities in Ruby before 1.8.5 allow remote attackers to bypass "safe level" checks via unspecified vectors involving (1) the alias function and (2) "directory operations".

CVSS 2.0 · 6.4 Medium EPSS 5.8% KEV · Not listed
Vendors
Redhat Yukihiro Matsumoto
Products
Enterprise Linux Ruby
CVE-2006-1931

security flaw

The HTTP/XMLRPC server in Ruby before 1.8.2 uses blocking sockets, which allows attackers to cause a denial of service (blocked connections) via a large amount of data.

CVSS 2.0 · 5.0 Medium EPSS 10.4% KEV · Not listed
Vendors
Redhat Yukihiro Matsumoto
Products
Enterprise Linux Ruby