CVSS: 3.3EPSS: 0%CPEs: 1EXPL: 0CVE-2013-1945
https://notcve.org/view.php?id=CVE-2013-1945
ruby193 uses an insecure LD_LIBRARY_PATH setting. ruby193 usa una configuración de LD_LIBRARY_PATH no segura. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1945 • CWE-829: Inclusion of Functionality from Untrusted Control Sphere •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-11879
https://notcve.org/view.php?id=CVE-2019-11879
The WEBrick gem 1.4.2 for Ruby allows directory traversal if the attacker once had local access to create a symlink to a location outside of the web root directory. NOTE: The vendor states that this is analogous to Options FollowSymlinks in the Apache HTTP Server, and therefore it is "not a problem. ** EN DISPUTA ** La WEBrick gem versión 1.4.2 para Ruby permite salto de directorio si el atacante alguna vez tuvo acceso local para crear un enlace simbólico a una ubicación fuera del directorio web root. NOTA: El proveedor declara que esto es similar a las Opciones FollowSymlinks en el Servidor HTTP de Apache, y por lo tanto "no es un problema". • https://bugs.ruby-lang.org/issues/15835 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 9.8EPSS: 0%CPEs: 13EXPL: 0CVE-2018-16395 – ruby: OpenSSL::X509:: Name equality check does not work correctly
https://notcve.org/view.php?id=CVE-2018-16395
An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return true. When the first argument is one character longer than the second, or the second argument contains a character that is one less than a character in the same position of the first argument, the result of == will be true. This could be leveraged to create an illegitimate certificate that may be accepted as legitimate and then used in signing or encryption operations. Se ha descubierto un problema en la biblioteca OpenSSL en Ruby, en versiones anteriores a la 2.3.8, versiones 2.4.x anteriores a la 2.4.5, versiones 2.5.x anteriores a la 2.5.2 y versiones 2.6.x anteriores a la 2.6.0-preview3. • http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html http://www.securitytracker.com/id/1042105 https://access.redhat.com/errata/RHSA-2018:3729 https://access.redhat.com/errata/RHSA-2018:3730 https://access.redhat.com/errata/RHSA-2018:3731 https://access.redhat.com/errata/RHSA-2018:3738 https://access.redhat.com/errata/RHSA-2019:1948 https://access.redhat.com/errata/RHSA-2019:2565 https://hackerone.com/reports/387250 https://lists.debian.org/debian-lts • CWE-295: Improper Certificate Validation •
CVSS: 8.1EPSS: 0%CPEs: 16EXPL: 0CVE-2018-16396 – ruby: Tainted flags are not propagated in Array#pack and String#unpack with some directives
https://notcve.org/view.php?id=CVE-2018-16396
An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats. Se ha descubierto un problema en Ruby, en versiones anteriores a la 2.3.8, versiones 2.4.x anteriores a la 2.4.5, versiones 2.5.x anteriores a la 2.5.2 y versiones 2.6.x anteriores a la 2.6.0-preview3. No contamina las cadenas que resultan de desempaquetar cadenas contaminadas con algunos formatos. • http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html http://www.securitytracker.com/id/1042106 https://access.redhat.com/errata/RHSA-2018:3729 https://access.redhat.com/errata/RHSA-2018:3730 https://access.redhat.com/errata/RHSA-2018:3731 https://access.redhat.com/errata/RHSA-2019:2028 https://hackerone.com/reports/385070 https://lists.debian.org/debian-lts-announce/2018/10/msg00020.html https://security.netapp.com/advisory/ntap-20190221-0002 https://usn • CWE-20: Improper Input Validation •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-3769
https://notcve.org/view.php?id=CVE-2018-3769
ruby-grape ruby gem suffers from a cross-site scripting (XSS) vulnerability via "format" parameter. La gema de ruby ruby-grape sufre de una vulnerabilidad de Cross-Site Scripting (XSS) mediante el parámetro "format". • https://github.com/ruby-grape/grape/commit/6876b71efc7b03f7ce1be3f075eaa4e7e6de19af https://github.com/ruby-grape/grape/issues/1762 https://github.com/ruby-grape/grape/pull/1763 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •