Search Vulnerabilities

rubyipmi is vulnerable to OS Command Injection through malicious usernames

Malicious code in newrubylogger (RubyGems)

Malicious code in rubocop-vintedmetrics (RubyGems)

Nokogiri does not check the return value from xmlC14NExecute

Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href

Rack has a Directory Traversal via Rack:Directory

Malicious code in cucumber_json_schema (RubyGems)

Bitcoinrb Vulnerable to Command injection via RPC

Faraday affected by SSRF via protocol-relative URL host override in build_exclusive_url

Phlex XSS protection bypass via attribute splatting, dynamic tags, and href values

Unauthenticated Spree Commerce users can access all guest addresses

Unauthenticated Spree Commerce users can view completed guest orders by Order ID

Decidim's private data exports can lead to data leaks

foreman_kubevirt disables SSL verification if a Certificate Authority (CA) certificate is not explicitly set

fog-kubevirt allows remote attacker to perform MITM attack due to disabled certificate validation

AlchemyCMS: Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelper

Active Job - Object injection security vulnerability

ActiveRecord-JDBC-Adapter (AR-JDBC) lib/arjdbc/jdbc/adapter.rb sql.gsub() Function SQL Injection

openc3-api Vulnerable to Unauthenticated Remote Code Execution

Spree API has Unauthenticated IDOR - Guest Address