ruby-lang webrick vulnerabilities and exploits

(subscribe to this query)

2.1

CVSSv2

The WEBrick gem 1.4.2 for Ruby allows directory traversal if the attacker once had local access to create a symlink to a location outside of the web root directory. NOTE: The vendor states that this is analogous to Options FollowSymlinks in the Apache HTTP Server, and therefore i...

Ruby-lang Webrick 1.4.2

7.5

CVSSv2

WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel 248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev writes data to a log file without sanitizing non-printable characters, which might allow remote malicious users to modify a window's title, ...

Ruby-lang Webrick 1.3.1

1 EDB exploit

5

CVSSv2

An issue exists in Ruby up to and including 2.5.8, 2.6.x up to and including 2.6.6, and 2.7.x up to and including 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue ...

Ruby-lang Ruby Ruby-lang Webrick Fedoraproject Fedora 32 Fedoraproject Fedora 33

5

CVSSv2

Directory traversal vulnerability in WEBrick in Ruby 1.8 prior to 1.8.5-p115 and 1.8.6-p114, and 1.9 up to and including 1.9.0-1, when running on systems that support backslash (\) path separators or case-insensitive file names, allows remote malicious users to access arbitrary f...

Ruby-lang Webrick -Fedoraproject Fedora 8 Fedoraproject Fedora 7

1 EDB exploit

7.8

CVSSv2

Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.split_header_value function in WEBrick::HTTP::DefaultFileHandler in WEBrick in Ruby 1.8.5 and previous versions, 1.8.6 up to and including 1.8.6-p286, 1.8.7 up to and including 1.8.7-p71, and 1.9 through r18423 allows...

Ruby-lang Ruby 1.8.1 Ruby-lang Ruby 1.8.2 Ruby-lang Ruby 1.8.3 Ruby-lang Ruby 1.8.4 Ruby-lang Ruby 1.8.5 Ruby-lang Ruby 1.8.6 Ruby-lang Ruby 1.8.7 Ruby-lang Ruby 1.9.0 Ruby-lang Ruby 1.6.8 Ruby-lang Ruby 1.8.0 Ruby-lang Ruby

1 EDB exploit

7.8

CVSSv2

httputils.rb in WEBrick in Ruby 1.8.1 and 1.8.5, as used in Red Hat Enterprise Linux 4 and 5, allows remote malicious users to cause a denial of service (CPU consumption) via a crafted HTTP request. NOTE: this issue exists because of an incomplete fix for CVE-2008-3656.

Ruby-lang Ruby 1.8.5 Ruby-lang Ruby 1.8.1

1 EDB exploit

5

CVSSv2

Directory traversal vulnerability in WEBrick in Ruby 1.8.4 and previous versions, 1.8.5 prior to 1.8.5-p231, 1.8.6 prior to 1.8.6-p230, 1.8.7 prior to 1.8.7-p22, and 1.9.0 prior to 1.9.0-2, when using NTFS or FAT filesystems, allows remote malicious users to read arbitrary CGI fi...

Ruby-lang Ruby 1.8.5 Ruby-lang Ruby 1.8.6 Ruby-lang Ruby

6.3

CVSSv2

The FileUtils.remove_entry_secure method in Ruby 1.8.6 up to and including 1.8.6-420, 1.8.7 up to and including 1.8.7-330, 1.8.8dev, 1.9.1 up to and including 1.9.1-430, 1.9.2 up to and including 1.9.2-136, and 1.9.3dev allows local users to delete arbitrary files via a symlink a...

Ruby-lang Ruby 1.9.2 Ruby-lang Ruby 1.9.3 Ruby-lang Ruby 1.8.6 Ruby-lang Ruby 1.8.7 Ruby-lang Ruby 1.8.8 Ruby-lang Ruby 1.9.1

6.8

CVSSv2

The VpMemAlloc function in bigdecimal.c in the BigDecimal class in Ruby 1.9.2-p136 and previous versions, as used on Apple Mac OS X prior to 10.6.7 and other platforms, does not properly allocate memory, which allows context-dependent malicious users to execute arbitrary code or ...

Ruby-lang Ruby 1.9.1 Ruby-lang Ruby 1.9.2 Ruby-lang Ruby 1.9.0-20060415 Ruby-lang Ruby Ruby-lang Ruby 1.9.0-0 Ruby-lang Ruby 1.9 Ruby-lang Ruby 1.9.0-20070709 Ruby-lang Ruby 1.9.0-1 Ruby-lang Ruby 1.9.0 Ruby-lang Ruby 1.9.0-2

Get Started

1 2 3 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook