CVSS: 7.5EPSS: 1%CPEs: 20EXPL: 1CVE-2013-0269 – rubygem-json: Denial of Service and SQL Injection
https://notcve.org/view.php?id=CVE-2013-0269
The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability." El JSON gem v1.7.x anteriores a 1.7.7, v1.6.x anteriores a v1.6.8, y v1.5.x anteriores a v1.5.5 permite a atacantes remotos provocar una denegación de servicio (consumo de recursos) o evitar el mecanismo de protección de asignación masiva a través de un documento JSON manipulado que lanza la creación de símbolos arbitrarios en Ruby o ciertos objetos internos, como se demostró como se ha demostrado mediante la realización de un ataque de inyección SQL en Ruby on Rails, también conocido como "Vulnerabilidad de creación de objetos no seguro". • https://github.com/heroku/heroku-CVE-2013-0269 http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00015.html http://lists.opensuse.org/opensuse-updates/2013-04/msg00034.html http://rhn.redhat.com/errata/RHSA-2013-0686.html http://rhn.redhat.com/errata/RHSA-2013-0701.html http://rhn.redhat.com/errata/RHSA-2013-1028.html http • CWE-20: Improper Input Validation CWE-502: Deserialization of Untrusted Data •
CVSS: 4.3EPSS: 0%CPEs: 25EXPL: 0CVE-2012-2126 – rubygems: Two security fixes in v1.8.23
https://notcve.org/view.php?id=CVE-2012-2126
RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers to modify a gem during installation via a man-in-the-middle attack. RubyGems anteriores a 1.8.23 no verifican un certificado SSL, lo cual permite a atacantes remotos modificar una gema durante la instalación a través de un ataque man-in-the-middle. • http://rhn.redhat.com/errata/RHSA-2013-1203.html http://rhn.redhat.com/errata/RHSA-2013-1441.html http://rhn.redhat.com/errata/RHSA-2013-1852.html http://secunia.com/advisories/55381 http://www.openwall.com/lists/oss-security/2012/04/20/24 http://www.ubuntu.com/usn/USN-1582-1 https://bugzilla.redhat.com/show_bug.cgi?id=814718 https://github.com/rubygems/rubygems/blob/1.8/History.txt https://access.redhat.com/security/cve/CVE-2012-2126 • CWE-310: Cryptographic Issues •
CVSS: 5.8EPSS: 0%CPEs: 25EXPL: 0CVE-2012-2125 – rubygems: Two security fixes in v1.8.23
https://notcve.org/view.php?id=CVE-2012-2125
RubyGems before 1.8.23 can redirect HTTPS connections to HTTP, which makes it easier for remote attackers to observe or modify a gem during installation via a man-in-the-middle attack. RubyGems anteriores a 1.8.23 pueden redirigir conexiones HTTPS a HTTP, lo cual facilita a atacantes remotos observar o modificar una gema durante la instalación a través de un ataque man-in-the-middle. • http://rhn.redhat.com/errata/RHSA-2013-1203.html http://rhn.redhat.com/errata/RHSA-2013-1441.html http://rhn.redhat.com/errata/RHSA-2013-1852.html http://secunia.com/advisories/55381 http://www.openwall.com/lists/oss-security/2012/04/20/24 http://www.ubuntu.com/usn/USN-1582-1 https://bugzilla.redhat.com/show_bug.cgi?id=814718 https://github.com/rubygems/rubygems/blob/1.8/History.txt https://access.redhat.com/security/cve/CVE-2012-2125 •
CVSS: 5.0EPSS: 1%CPEs: 4EXPL: 1CVE-2012-2139 – rubygem-mail: directory traversal
https://notcve.org/view.php?id=CVE-2012-2139
Directory traversal vulnerability in lib/mail/network/delivery_methods/file_delivery.rb in the Mail gem before 2.4.4 for Ruby allows remote attackers to read arbitrary files via a .. (dot dot) in the to parameter. Vulnerabilidad de salto de directorio en lib/mail/network/delivery_methods/file_delivery.rb en la gema Mail antes de v2.4.3 para Ruby, permite a atacantes remotos para leer archivos de su elección a través de .. (punto punto) en el parámetro to. • http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080645.html http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080648.html http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080747.html http://secunia.com/advisories/48970 http://www.openwall.com/lists/oss-security/2012/04/25/8 http://www.openwall.com/lists/oss-security/2012/04/26/1 https://bugzilla.novell.com/show_bug.cgi?id=759092 https://bugzilla.redhat.com/show_bug.cgi?id=8163 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 1%CPEs: 3EXPL: 2CVE-2012-2140 – rubygem-mail: arbitrary command execution when using exim or sendmail from commandline
https://notcve.org/view.php?id=CVE-2012-2140
The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery. La gema Mail antes de v2.4.3 para Ruby permite a atacantes remotos ejecutar comandos arbitrarios a través de metacaracteres en (1) sendmail o (2) una entrega exim. • http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080645.html http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080648.html http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080747.html http://secunia.com/advisories/48970 http://www.openwall.com/lists/oss-security/2012/04/25/8 http://www.openwall.com/lists/oss-security/2012/04/26/1 https://bugzilla.novell.com/show_bug.cgi?id=759092 https://bugzilla.redhat.com/show_bug.cgi?id=8163 • CWE-20: Improper Input Validation CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •