Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

ruby-lang rexml vulnerabilities and exploits

(subscribe to this query)
5
CVSSv2
CVE-2021-28965
The REXML gem prior to 3.2.5 in Ruby prior to 2.6.7, 2.7.x prior to 2.7.3, and 3.x prior to 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.
Ruby-lang RubyRuby-lang RexmlFedoraproject Fedora 34
5
CVSSv2
CVE-2008-3790
The REXML module in Ruby 1.8.6 up to and including 1.8.6-p287, 1.8.7 up to and including 1.8.7-p72, and 1.9 allows context-dependent malicious users to cause a denial of service (CPU consumption) via an XML document with recursively nested entities, aka an "XML entity explos...
Ruby-lang Ruby 1.8.6Ruby-lang Ruby 1.8.7Ruby-lang Ruby 1.9
5
CVSSv2
CVE-2013-1821
lib/rexml/text.rb in the REXML parser in Ruby prior to 1.9.3-p392 allows remote malicious users to cause a denial of service (memory consumption and crash) via crafted text nodes in an XML document, aka an XML Entity Expansion (XEE) attack.
Ruby-lang Ruby 1.9.3Ruby-lang Ruby 1.9.2Ruby-lang RubyRuby-lang Ruby 1.9.1Ruby-lang Ruby 1.9Ruby-lang Ruby 2.0.0Ruby-lang Ruby 2.0
7.5
CVSSv2
CVE-2008-3655
Ruby 1.8.5 and previous versions, 1.8.6 up to and including 1.8.6-p286, 1.8.7 up to and including 1.8.7-p71, and 1.9 through r18423 does not properly restrict access to critical variables and methods at various safe levels, which allows context-dependent malicious users to bypass...
Ruby-lang Ruby 1.8.1Ruby-lang Ruby 1.8.2Ruby-lang Ruby 1.8.3Ruby-lang Ruby 1.8.4Ruby-lang Ruby 1.8.5Ruby-lang Ruby 1.8.6Ruby-lang Ruby 1.8.7Ruby-lang Ruby 1.6.8Ruby-lang Ruby 1.9.0Ruby-lang RubyRuby-lang Ruby 1.8.0
7.8
CVSSv2
CVE-2008-3656
Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.split_header_value function in WEBrick::HTTP::DefaultFileHandler in WEBrick in Ruby 1.8.5 and previous versions, 1.8.6 up to and including 1.8.6-p286, 1.8.7 up to and including 1.8.7-p71, and 1.9 through r18423 allows...
Ruby-lang Ruby 1.8.1Ruby-lang Ruby 1.8.2Ruby-lang Ruby 1.8.3Ruby-lang Ruby 1.8.4Ruby-lang Ruby 1.8.5Ruby-lang Ruby 1.8.6Ruby-lang Ruby 1.8.7Ruby-lang Ruby 1.9.0Ruby-lang Ruby 1.6.8Ruby-lang Ruby 1.8.0Ruby-lang Ruby
7.5
CVSSv2
CVE-2008-3657
The dl module in Ruby 1.8.5 and previous versions, 1.8.6 up to and including 1.8.6-p286, 1.8.7 up to and including 1.8.7-p71, and 1.9 through r18423 does not check "taintness" of inputs, which allows context-dependent malicious users to bypass safe levels and execute da...
Ruby-lang Ruby 1.8.2Ruby-lang Ruby 1.8.4Ruby-lang Ruby 1.8.6Ruby-lang Ruby 1.8.7Ruby-lang Ruby 1.8.5Ruby-lang Ruby 1.8.1Ruby-lang Ruby 1.8.3Ruby-lang Ruby 1.9.0Ruby-lang RubyRuby-lang Ruby 1.6.8Ruby-lang Ruby 1.8.0
5
CVSSv2
CVE-2011-1005
The safe-level feature in Ruby 1.8.6 up to and including 1.8.6-420, 1.8.7 up to and including 1.8.7-330, and 1.8.8dev allows context-dependent malicious users to modify strings via the Exception#to_s method, as demonstrated by changing an intended pathname.
Ruby-lang Ruby 1.8.7-330Ruby-lang Ruby 1.8.8Ruby-lang Ruby 1.8.6-420Ruby-lang Ruby 1.8.7Ruby-lang Ruby 1.8.6
5.8
CVSSv2
CVE-2008-3905
resolv.rb in Ruby 1.8.5 and previous versions, 1.8.6 prior to 1.8.6-p287, 1.8.7 prior to 1.8.7-p72, and 1.9 r18423 and previous versions uses sequential transaction IDs and constant source ports for DNS requests, which makes it easier for remote malicious users to spoof DNS respo...
Ruby-lang Ruby 1.8.3Ruby-lang Ruby 1.8.4Ruby-lang Ruby 1.8.6Ruby-lang Ruby 1.8.7Ruby-lang RubyRuby-lang Ruby 1.8.1Ruby-lang Ruby 1.8.2Ruby-lang Ruby 1.6.8Ruby-lang Ruby 1.8.0Ruby-lang Ruby 1.6
5
CVSSv2
CVE-2008-3443
The regular expression engine (regex.c) in Ruby 1.8.5 and previous versions, 1.8.6 up to and including 1.8.6-p286, 1.8.7 up to and including 1.8.7-p71, and 1.9 through r18423 allows remote malicious users to cause a denial of service (infinite loop and crash) via multiple long re...
Ruby-lang Ruby 1.8.1Ruby-lang Ruby 1.8.2Ruby-lang Ruby 1.8.4Ruby-lang Ruby 1.8.5Ruby-lang Ruby 1.8.6Ruby-lang Ruby 1.8.7Ruby-lang Ruby 1.8.0Ruby-lang Ruby 1.8.3Ruby-lang Ruby 1.6.8Ruby-lang Ruby 1.9.0
6.8
CVSSv2
CVE-2013-4164
Heap-based buffer overflow in Ruby 1.8, 1.9 prior to 1.9.3-p484, 2.0 prior to 2.0.0-p353, 2.1 prior to 2.1.0 preview2, and trunk before revision 43780 allows context-dependent malicious users to cause a denial of service (segmentation fault) and possibly execute arbitrary code vi...
Ruby-lang Ruby 2.1Ruby-lang Ruby 2.0.0Ruby-lang Ruby 1.9Ruby-lang Ruby 1.9.3Ruby-lang Ruby 1.9.1Ruby-lang Ruby 1.9.2Ruby-lang Ruby 1.8
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-27322administrator privilegesCVE-2024-1579hardcodedCVE-2023-20198CVE-2024-33587CVE-2024-33449CVE-2024-4308HTML injection
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook