Vulnerabilities > Ruby Lang
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2013-11-02 | CVE-2013-2065 | Permissions, Privileges, and Access Controls vulnerability in multiple products (1) DL and (2) Fiddle in Ruby 1.9 before 1.9.3 patchlevel 426, and 2.0 before 2.0.0 patchlevel 195, do not perform taint checking for native functions, which allows context-dependent attackers to bypass intended $SAFE level restrictions. | 6.4 |
| 2013-10-17 | CVE-2013-4363 | Cryptographic Issues vulnerability in multiple products Algorithmic complexity vulnerability in Gem::Version::ANCHORED_VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.2, 1.8.24 through 1.8.26, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression. | 4.3 |
| 2013-10-17 | CVE-2013-4287 | Cryptographic Issues vulnerability in multiple products Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression. | 4.3 |
| 2013-09-30 | CVE-2013-4136 | Link Following vulnerability in Phusion Passenger ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/. | 4.4 |
| 2013-08-29 | CVE-2013-5647 | Code Injection vulnerability in Adam Zaninovich Sounder 1.0.1 lib/sounder/sound.rb in the sounder gem 1.0.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a filename. | 7.5 |
| 2013-04-25 | CVE-2013-1948 | Remote Command Injection vulnerability in ROB Westgeest Md2Pdf 0.0.1 converter.rb in the md2pdf gem 0.0.1 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename. | 10.0 |
| 2013-04-25 | CVE-2013-1947 | OS Command Injection vulnerability in Kelly D. Redding Kelredd-Pruview 0.3.8 kelredd-pruview gem 0.3.8 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument to (1) document.rb, (2) video.rb, or (3) video_image.rb. | 9.3 |
| 2013-04-25 | CVE-2013-1933 | OS Command Injection vulnerability in Documentcloud Karteek-Docsplit 0.5.4 The extract_from_ocr function in lib/docsplit/text_extractor.rb in the Karteek Docsplit (karteek-docsplit) gem 0.5.4 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a PDF filename. | 9.3 |
| 2013-04-25 | CVE-2013-0233 | Resource Management Errors vulnerability in multiple products Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass security checks via unknown vectors, as demonstrated by resetting passwords of arbitrary accounts. | 6.8 |
| 2013-04-25 | CVE-2012-4466 | Permissions, Privileges, and Access Controls vulnerability in Ruby-Lang Ruby Ruby 1.8.7 before patchlevel 371, 1.9.3 before patchlevel 286, and 2.0 before revision r37068 allows context-dependent attackers to bypass safe-level restrictions and modify untainted strings via the name_err_mesg_to_str API function, which marks the string as tainted, a different vulnerability than CVE-2011-1005. | 5.0 |