Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

ruby-lang ruby 1.9.2 vulnerabilities and exploits

(subscribe to this query)
NA
CVE-2011-2705
The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby prior to 1.8.7-p352 and 1.9.x prior to 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent malicious users to predict the result string by leveraging knowledge of ran...
Ruby-lang Ruby 1.8.7Ruby-lang RubyRuby-lang Ruby 1.8.7-p21Ruby-lang Ruby 1.8.7-173Ruby-lang Ruby 1.8.7-160Ruby-lang Ruby 1.8.7-330Ruby-lang Ruby 1.8.7-249Ruby-lang Ruby 1.8.7-248Ruby-lang Ruby 1.8.7-302Ruby-lang Ruby 1.8.7-299Ruby-lang Ruby 1.9.1Ruby-lang Ruby 1.9.0Ruby-lang Ruby 1.9.0-2Ruby-lang Ruby 1.9.0-20070709Ruby-lang Ruby 1.9.0-1Ruby-lang Ruby 1.9.2Ruby-lang Ruby 1.9.2-p180Ruby-lang Ruby 1.9Ruby-lang Ruby 1.9.0-0Ruby-lang Ruby 1.9.2-p136Ruby-lang Ruby 1.9.0-20060415
NA
CVE-2012-5371
Ruby (aka CRuby) 1.9 prior to 1.9.3-p327 and 2.0 before r37575 computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent malicious users to cause a denial of service (CPU consumption) via crafted input to ...
Ruby-lang Ruby 1.9.3Ruby-lang Ruby 2.0Ruby-lang RubyRuby-lang Ruby 1.9.2Ruby-lang Ruby 1.9Ruby-lang Ruby 1.9.1
NA
CVE-2013-1821
lib/rexml/text.rb in the REXML parser in Ruby prior to 1.9.3-p392 allows remote malicious users to cause a denial of service (memory consumption and crash) via crafted text nodes in an XML document, aka an XML Entity Expansion (XEE) attack.
Ruby-lang Ruby 1.9.3Ruby-lang Ruby 1.9.2Ruby-lang RubyRuby-lang Ruby 1.9.1Ruby-lang Ruby 1.9Ruby-lang Ruby 2.0.0Ruby-lang Ruby 2.0
NA
CVE-2011-1004
The FileUtils.remove_entry_secure method in Ruby 1.8.6 up to and including 1.8.6-420, 1.8.7 up to and including 1.8.7-330, 1.8.8dev, 1.9.1 up to and including 1.9.1-430, 1.9.2 up to and including 1.9.2-136, and 1.9.3dev allows local users to delete arbitrary files via a symlink a...
Ruby-lang Ruby 1.9.2Ruby-lang Ruby 1.9.3Ruby-lang Ruby 1.8.6Ruby-lang Ruby 1.8.7Ruby-lang Ruby 1.8.8Ruby-lang Ruby 1.9.1
NA
CVE-2013-4164
Heap-based buffer overflow in Ruby 1.8, 1.9 prior to 1.9.3-p484, 2.0 prior to 2.0.0-p353, 2.1 prior to 2.1.0 preview2, and trunk before revision 43780 allows context-dependent malicious users to cause a denial of service (segmentation fault) and possibly execute arbitrary code vi...
Ruby-lang Ruby 2.1Ruby-lang Ruby 2.0.0Ruby-lang Ruby 1.9Ruby-lang Ruby 1.9.3Ruby-lang Ruby 1.9.1Ruby-lang Ruby 1.9.2Ruby-lang Ruby 1.8
5.3
CVSSv3
CVE-2011-3624
Various methods in WEBrick::HTTPRequest in Ruby 1.9.2 and 1.8.7 and previous versions do not validate the X-Forwarded-For, X-Forwarded-Host and X-Forwarded-Server headers in requests, which might allow remote malicious users to inject arbitrary text into log files or bypass inten...
Ruby-lang Ruby 1.8.7Ruby-lang Ruby 1.9.2
7.3
CVSSv3
CVE-2009-5147
DL::dlopen in Ruby 1.8, 1.9.0, 1.9.2, 1.9.3, 2.0.0 before patchlevel 648, and 2.1 prior to 2.1.8 opens libraries with tainted names.
Ruby-lang Ruby 2.0.0Ruby-lang Ruby 1.8.0Ruby-lang Ruby 2.1.6Ruby-lang Ruby 2.1.7Ruby-lang Ruby 1.9.2Ruby-lang Ruby 1.9.0Ruby-lang Ruby 2.1.3Ruby-lang Ruby 2.1.4Ruby-lang Ruby 2.1.0Ruby-lang Ruby 1.9.3Ruby-lang Ruby 2.1.2Ruby-lang Ruby 2.1.5Ruby-lang Ruby 2.1.1
NA
CVE-2011-0188
The VpMemAlloc function in bigdecimal.c in the BigDecimal class in Ruby 1.9.2-p136 and previous versions, as used on Apple Mac OS X prior to 10.6.7 and other platforms, does not properly allocate memory, which allows context-dependent malicious users to execute arbitrary code or ...
Ruby-lang Ruby 1.9.1Ruby-lang Ruby 1.9.2Ruby-lang Ruby 1.9.0-20060415Ruby-lang RubyRuby-lang Ruby 1.9.0-0Ruby-lang Ruby 1.9Ruby-lang Ruby 1.9.0-20070709Ruby-lang Ruby 1.9.0-1Ruby-lang Ruby 1.9.0Ruby-lang Ruby 1.9.0-2
NA
CVE-2013-2065
(1) DL and (2) Fiddle in Ruby 1.9 prior to 1.9.3 patchlevel 426, and 2.0 prior to 2.0.0 patchlevel 195, do not perform taint checking for native functions, which allows context-dependent malicious users to bypass intended $SAFE level restrictions.
Opensuse Opensuse 12.2Opensuse Opensuse 12.3Ruby-lang Ruby 2.0.0Ruby-lang Ruby 1.9.3Ruby-lang Ruby 1.9.1Ruby-lang Ruby 1.9.2Ruby-lang Ruby 1.9Ruby-lang Ruby 2.0
NA
CVE-2013-0256
darkfish.js in RDoc 2.3.0 up to and including 3.12 and 4.x prior to 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote malicious users to conduct cross-site scripting (XSS) attacks via a crafted URL.
Ruby-lang RdocRuby-lang Rdoc 4.0.0Ruby-lang Ruby 1.9Ruby-lang Ruby 1.9.1Ruby-lang Ruby 1.9.2Ruby-lang Ruby 1.9.3Ruby-lang Ruby 2.0Ruby-lang Ruby 2.0.0Canonical Ubuntu Linux 12.04Canonical Ubuntu Linux 12.10
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
blind SQL injectionfirmwareCVE-2006-4304CVE-2024-32878CVE-2024-31502XSSCVE-2024-3059CVE-2024-33692CVE-2024-3400
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook