CVSS: 8.4EPSS: 0%CPEs: 14EXPL: 0CVE-2015-7551 – ruby: DL:: dlopen could open a library with tainted library name
https://notcve.org/view.php?id=CVE-2015-7551
22 Mar 2016 — The Fiddle::Handle implementation in ext/fiddle/handle.c in Ruby before 2.0.0-p648, 2.1 before 2.1.8, and 2.2 before 2.2.4, as distributed in Apple OS X before 10.11.4 and other products, mishandles tainting, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted string, related to the DL module and the libffi library. NOTE: this vulnerability exists because of a CVE-2009-5147 regression. La implementación Fiddle::Handle en ext/fiddl... • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=796344 • CWE-20: Improper Input Validation CWE-267: Privilege Defined With Unsafe Actions •
CVSS: 8.6EPSS: 2%CPEs: 42EXPL: 0CVE-2015-3900 – rubygems: DNS hijacking vulnerability in api_endpoint()
https://notcve.org/view.php?id=CVE-2015-3900
24 Jun 2015 — RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack." RubyGems 2.0.x en versiones anteriores a 2.0.16, 2.2.x en versiones anteriores a 2.2.4 y 2.4.x en versiones anteriores a 2.4.7 no valida el nombre de host al recuperar gemas o hacer solicitudes de API, lo que permite a atacantes remotos... • http://blog.rubygems.org/2015/05/14/CVE-2015-3900.html • CWE-254: 7PK - Security Features CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 6.8EPSS: 68%CPEs: 17EXPL: 3CVE-2013-0233 – Ruby on Rails Devise Authentication Password Reset
https://notcve.org/view.php?id=CVE-2013-0233
25 Apr 2013 — Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass security checks via unknown vectors, as demonstrated by resetting passwords of arbitrary accounts. Devise v2.2.x antes de v2.2.3, v2.1.x antes de v2.1.3, v2.0.x antes de v2.0.5, v1.5.x antes de v1.5.4 de Ruby, al u... • https://packetstorm.news/files/id/180861 • CWE-399: Resource Management Errors •