{"resultsPerPage":12,"startIndex":0,"totalResults":12,"format":"NVD_CVE","version":"2.0","timestamp":"2026-11-11T13:29:26.573","vulnerabilities":[{"cve":{"id":"CVE-2013-1911","sourceIdentifier":"secalert@redhat.com","published":"2013-04-03T00:55:02.267","lastModified":"2026-06-16T23:52:23.030","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"lib/ldoce/word.rb in the ldoce 0.0.2 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in (1) an mp3 URL or (2) file name."},{"lang":"es","value":"lib/ldoce/word.rb en el gem ldoce 0.0.2 para Ruby, permite a atacantes remotos ejecutar comandos arbitrarios a través de meta caracteres de consola en (1) un mp3 o URL, o (2) en un nombre de archivo."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:mark_burns:ldoce:0.0.2:*:*:*:*:*:*:*","matchCriteriaId":"D811774C-2E7B-4C18-9913-BA5D1616BD00"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*","matchCriteriaId":"264DD094-A8CD-465D-B279-C834DDA5F79C"}]}]}],"references":[{"url":"http://archives.neohapsis.com/archives/bugtraq/2013-04/0010.html","source":"secalert@redhat.com","tags":["Exploit"]},{"url":"http://osvdb.org/91870","source":"secalert@redhat.com"},{"url":"http://otiose.dhs.org/advisories/ldoce-0.0.2-cmd-exec.html","source":"secalert@redhat.com","tags":["Exploit"]},{"url":"http://www.openwall.com/lists/oss-security/2013/03/31/3","source":"secalert@redhat.com","tags":["Exploit"]},{"url":"http://www.securityfocus.com/bid/58783","source":"secalert@redhat.com","tags":["Exploit"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/83163","source":"secalert@redhat.com"},{"url":"http://archives.neohapsis.com/archives/bugtraq/2013-04/0010.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"]},{"url":"http://osvdb.org/91870","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://otiose.dhs.org/advisories/ldoce-0.0.2-cmd-exec.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"]},{"url":"http://www.openwall.com/lists/oss-security/2013/03/31/3","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"]},{"url":"http://www.securityfocus.com/bid/58783","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/83163","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2013-0175","sourceIdentifier":"secalert@redhat.com","published":"2013-04-25T23:55:01.410","lastModified":"2026-06-16T23:48:54.593","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156."},{"lang":"es","value":"multi_xml v0.5.2 de Ruby, tal como se utiliza en Grape antes de v0.2.6 y posiblemente otros productos, no restringe debidamente vaciados de valores de cadena, lo que permite a atacantes remotos realizar ataques de inyección a objetos y ejecutar código arbitrario o causar una denegación de servicio (consumo de memoria y CPU) que implica anidadas referencias de entidad XML, mediante el aprovechamiento de apoyo (1) YAML conversión de tipo o (2) la conversión de tipos Symbol, una vulnerabilidad similar a CVE-2013-0156."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:erik_michaels-ober:multi_xml:0.5.2:*:*:*:*:*:*:*","matchCriteriaId":"28BB74BA-387E-4EDC-89BD-C83A5F7E8757"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*","matchCriteriaId":"264DD094-A8CD-465D-B279-C834DDA5F79C"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:erik_michaels-ober:multi_xml:0.5.2:*:*:*:*:*:*:*","matchCriteriaId":"28BB74BA-387E-4EDC-89BD-C83A5F7E8757"},{"vulnerable":true,"criteria":"cpe:2.3:a:grape_project:grape:0.1.0:*:*:*:*:*:*:*","matchCriteriaId":"1E127DAB-366C-4EF8-BA31-75710F6C3EB8"},{"vulnerable":true,"criteria":"cpe:2.3:a:grape_project:grape:0.1.1:*:*:*:*:*:*:*","matchCriteriaId":"A2232040-600B-4700-A003-4938A69472AF"},{"vulnerable":true,"criteria":"cpe:2.3:a:grape_project:grape:0.1.2:*:*:*:*:*:*:*","matchCriteriaId":"0D32EC21-9ED8-4AB9-A863-377B3FC65524"},{"vulnerable":true,"criteria":"cpe:2.3:a:grape_project:grape:0.1.3:*:*:*:*:*:*:*","matchCriteriaId":"911EEC0A-A036-4612-ADA0-F37A60391731"},{"vulnerable":true,"criteria":"cpe:2.3:a:grape_project:grape:0.1.4:*:*:*:*:*:*:*","matchCriteriaId":"AE5ED3F1-5108-41CE-9136-76C637D1515E"},{"vulnerable":true,"criteria":"cpe:2.3:a:grape_project:grape:0.1.5:*:*:*:*:*:*:*","matchCriteriaId":"A782D309-3921-41A9-B651-7140DAA3B8F8"},{"vulnerable":true,"criteria":"cpe:2.3:a:grape_project:grape:0.2.0:*:*:*:*:*:*:*","matchCriteriaId":"B936CD4A-AC45-44B0-A583-7F2EC00AEC0A"},{"vulnerable":true,"criteria":"cpe:2.3:a:grape_project:grape:0.2.1:*:*:*:*:*:*:*","matchCriteriaId":"A3F9EBC0-F68A-403D-9EE8-E3B028B6AD08"},{"vulnerable":true,"criteria":"cpe:2.3:a:grape_project:grape:0.2.2:*:*:*:*:*:*:*","matchCriteriaId":"FB8D75D8-3E36-4416-B340-BF106E851AA9"},{"vulnerable":true,"criteria":"cpe:2.3:a:grape_project:grape:0.2.3:*:*:*:*:*:*:*","matchCriteriaId":"13955945-3FBD-4A5E-8412-B0FAE846ABAC"},{"vulnerable":true,"criteria":"cpe:2.3:a:grape_project:grape:0.2.4:*:*:*:*:*:*:*","matchCriteriaId":"332884DB-6D64-42F2-B377-1AEB7FF62DF2"},{"vulnerable":true,"criteria":"cpe:2.3:a:grape_project:grape:0.2.5:*:*:*:*:*:*:*","matchCriteriaId":"D8BE3F96-6394-45ED-A606-516A76A213F6"}]}]}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2013/01/11/9","source":"secalert@redhat.com"},{"url":"https://gist.github.com/nate/d7f6d9f4925f413621aa","source":"secalert@redhat.com"},{"url":"https://github.com/sferik/multi_xml/pull/34","source":"secalert@redhat.com"},{"url":"https://groups.google.com/forum/?fromgroups=#%21topic/ruby-grape/fthDkMgIOa0","source":"secalert@redhat.com"},{"url":"https://news.ycombinator.com/item?id=5040457","source":"secalert@redhat.com"},{"url":"http://www.openwall.com/lists/oss-security/2013/01/11/9","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://gist.github.com/nate/d7f6d9f4925f413621aa","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/sferik/multi_xml/pull/34","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://groups.google.com/forum/?fromgroups=#%21topic/ruby-grape/fthDkMgIOa0","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://news.ycombinator.com/item?id=5040457","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2013-0233","sourceIdentifier":"secalert@redhat.com","published":"2013-04-25T23:55:01.460","lastModified":"2026-06-16T23:49:01.230","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass security checks via unknown vectors, as demonstrated by resetting passwords of arbitrary accounts."},{"lang":"es","value":"Devise v2.2.x antes de v2.2.3, v2.1.x antes de v2.1.3, v2.0.x antes de v2.0.5, v1.5.x antes de v1.5.4 de Ruby, al utilizar ciertas bases de datos, no funciona correctamente cuando se realiza la conversión de tipos consultas de base de datos, lo que podría permitir a atacantes remotos provocar resultados incorrectos para ser devueltos y eludir los controles de seguridad a través de vectores desconocidos, como lo demuestra restablecer las contraseñas de las cuentas arbitrarias."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-399"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:plataformatec:devise:1.5.0:*:*:*:*:*:*:*","matchCriteriaId":"A4F9C7C7-7723-43D4-91F6-6186D9C9BB10"},{"vulnerable":true,"criteria":"cpe:2.3:a:plataformatec:devise:1.5.1:*:*:*:*:*:*:*","matchCriteriaId":"70B06452-931F-4975-84A3-36C1364C9C11"},{"vulnerable":true,"criteria":"cpe:2.3:a:plataformatec:devise:1.5.2:*:*:*:*:*:*:*","matchCriteriaId":"C259DDDF-BC40-46F5-BFFA-0FF2C93E62B0"},{"vulnerable":true,"criteria":"cpe:2.3:a:plataformatec:devise:1.5.3:*:*:*:*:*:*:*","matchCriteriaId":"6B7320C8-E9CB-4954-AE38-2EB81C1BE4E4"},{"vulnerable":true,"criteria":"cpe:2.3:a:plataformatec:devise:2.0.0:*:*:*:*:*:*:*","matchCriteriaId":"5682C78A-1FC7-41F8-873E-C61EC8CEA475"},{"vulnerable":true,"criteria":"cpe:2.3:a:plataformatec:devise:2.0.1:*:*:*:*:*:*:*","matchCriteriaId":"5B10284E-9813-4941-9D46-A2E6A7E4B3D0"},{"vulnerable":true,"criteria":"cpe:2.3:a:plataformatec:devise:2.0.2:*:*:*:*:*:*:*","matchCriteriaId":"43680C09-6447-4567-9693-09EABE846CDF"},{"vulnerable":true,"criteria":"cpe:2.3:a:plataformatec:devise:2.0.3:*:*:*:*:*:*:*","matchCriteriaId":"C3096DCF-E91B-4D83-BD15-28D42C12F3B9"},{"vulnerable":true,"criteria":"cpe:2.3:a:plataformatec:devise:2.0.4:*:*:*:*:*:*:*","matchCriteriaId":"E5C542B5-B5DE-462F-82F8-854837DA1B1D"},{"vulnerable":true,"criteria":"cpe:2.3:a:plataformatec:devise:2.1.0:*:*:*:*:*:*:*","matchCriteriaId":"3CD02E50-A2C8-43CC-A839-E5CA4A208EC2"},{"vulnerable":true,"criteria":"cpe:2.3:a:plataformatec:devise:2.1.1:*:*:*:*:*:*:*","matchCriteriaId":"49F151AD-49A1-4B6C-BD13-EAC3C9329D56"},{"vulnerable":true,"criteria":"cpe:2.3:a:plataformatec:devise:2.1.2:*:*:*:*:*:*:*","matchCriteriaId":"9785762C-15CA-4511-AE99-63063E1C4D91"},{"vulnerable":true,"criteria":"cpe:2.3:a:plataformatec:devise:2.2.0:*:*:*:*:*:*:*","matchCriteriaId":"A3646CD4-0C1D-43F7-9259-A6F6D6F8FE4C"},{"vulnerable":true,"criteria":"cpe:2.3:a:plataformatec:devise:2.2.1:*:*:*:*:*:*:*","matchCriteriaId":"DB24CBA3-26EA-4B6C-9EBF-018A8004BFE5"},{"vulnerable":true,"criteria":"cpe:2.3:a:plataformatec:devise:2.2.2:*:*:*:*:*:*:*","matchCriteriaId":"5FB39D4E-850B-4D13-9B2B-F8DBE707F5E7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*","matchCriteriaId":"264DD094-A8CD-465D-B279-C834DDA5F79C"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:*","matchCriteriaId":"D806A17E-B8F9-466D-807D-3F1E77603DC8"}]}]}],"references":[{"url":"http://blog.plataformatec.com.br/2013/01/security-announcement-devise-v2-2-3-v2-1-3-v2-0-5-and-v1-5-3-released/","source":"secalert@redhat.com","tags":["Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-03/msg00000.html","source":"secalert@redhat.com"},{"url":"http://www.metasploit.com/modules/auxiliary/admin/http/rails_devise_pass_reset","source":"secalert@redhat.com","tags":["Exploit"]},{"url":"http://www.openwall.com/lists/oss-security/2013/01/29/3","source":"secalert@redhat.com"},{"url":"http://www.phenoelit.org/blog/archives/2013/02/05/mysql_madness_and_rails/index.html","source":"secalert@redhat.com","tags":["Exploit"]},{"url":"http://www.securityfocus.com/bid/57577","source":"secalert@redhat.com"},{"url":"https://github.com/Snorby/snorby/issues/261","source":"secalert@redhat.com"},{"url":"http://blog.plataformatec.com.br/2013/01/security-announcement-devise-v2-2-3-v2-1-3-v2-0-5-and-v1-5-3-released/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-03/msg00000.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.metasploit.com/modules/auxiliary/admin/http/rails_devise_pass_reset","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"]},{"url":"http://www.openwall.com/lists/oss-security/2013/01/29/3","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.phenoelit.org/blog/archives/2013/02/05/mysql_madness_and_rails/index.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"]},{"url":"http://www.securityfocus.com/bid/57577","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/Snorby/snorby/issues/261","source":"af854a3a-2127-422b-91ae-364da2661108"}],"evaluatorImpact":"Per http://lists.opensuse.org/opensuse-updates/2013-03/msg00000.html\r\n\"Affected Products:\r\nopenSUSE 12.2\""}},{"cve":{"id":"CVE-2013-1933","sourceIdentifier":"secalert@redhat.com","published":"2013-04-25T23:55:01.570","lastModified":"2026-06-16T23:52:25.783","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"The extract_from_ocr function in lib/docsplit/text_extractor.rb in the Karteek Docsplit (karteek-docsplit) gem 0.5.4 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a PDF filename."},{"lang":"es","value":"La función extract_from_ocr en lib/docsplit/text_extractor.rb en el Karteek Docsplit (karteek-docsplit) v0.5.4 para Ruby permite a atacantes dependientes de contexto para ejecutar comandos arbitrarios vía metacaracteres de shell en un nombre de archivo PDF."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:C/I:C/A:C","baseScore":9.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.6,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:documentcloud:karteek-docsplit:0.5.4:*:*:*:*:*:*:*","matchCriteriaId":"95C48293-8D52-46CE-AB0C-00295AECE368"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*","matchCriteriaId":"264DD094-A8CD-465D-B279-C834DDA5F79C"}]}]}],"references":[{"url":"http://osvdb.org/92117","source":"secalert@redhat.com"},{"url":"http://vapid.dhs.org/advisories/karteek-docsplit-cmd-inject.html","source":"secalert@redhat.com"},{"url":"http://www.openwall.com/lists/oss-security/2013/04/08/15","source":"secalert@redhat.com"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/83277","source":"secalert@redhat.com"},{"url":"http://osvdb.org/92117","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://vapid.dhs.org/advisories/karteek-docsplit-cmd-inject.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2013/04/08/15","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/83277","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2013-1947","sourceIdentifier":"secalert@redhat.com","published":"2013-04-25T23:55:01.597","lastModified":"2026-06-16T23:52:27.340","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"kelredd-pruview gem 0.3.8 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument to (1) document.rb, (2) video.rb, or (3) video_image.rb."},{"lang":"es","value":"kelredd-pruview v0.3.8 para Ruby permite a atacantes dependientes de contexto ejecutar comandos arbitrarios vía metacaracteres de shell en un argumento de nombre de archivo a (1) document.rb, (2) video.rb, o (3) video_image.rb."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:C/I:C/A:C","baseScore":9.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.6,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:kelly_d._redding:kelredd-pruview:0.3.8:*:*:*:*:*:*:*","matchCriteriaId":"AB24E6E5-E18F-4990-92C4-48E3B24E38A3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*","matchCriteriaId":"264DD094-A8CD-465D-B279-C834DDA5F79C"}]}]}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2013/04/10/3","source":"secalert@redhat.com"},{"url":"http://www.openwall.com/lists/oss-security/2013/04/12/2","source":"secalert@redhat.com"},{"url":"http://www.openwall.com/lists/oss-security/2013/04/10/3","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2013/04/12/2","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2013-1948","sourceIdentifier":"secalert@redhat.com","published":"2013-04-25T23:55:01.617","lastModified":"2026-06-16T23:52:27.440","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"converter.rb in the md2pdf gem 0.0.1 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename."},{"lang":"es","value":"converter.rb del md2pdf para Ruby v0.0.1 permite a atacantes dependientes de contexto para ejecutar comandos arbitrarios vía metacaracteres de shell en un nombre de archivo."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rob_westgeest:md2pdf:0.0.1:*:*:*:*:*:*:*","matchCriteriaId":"70D6EB3C-A8C6-4F21-BF5A-FFCF85B3395A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*","matchCriteriaId":"264DD094-A8CD-465D-B279-C834DDA5F79C"}]}]}],"references":[{"url":"http://osvdb.org/92290","source":"secalert@redhat.com"},{"url":"http://vapid.dhs.org/advisories/md2pdf-remote-exec.html","source":"secalert@redhat.com"},{"url":"http://www.securityfocus.com/bid/59061","source":"secalert@redhat.com"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/83416","source":"secalert@redhat.com"},{"url":"http://osvdb.org/92290","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://vapid.dhs.org/advisories/md2pdf-remote-exec.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/59061","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/83416","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2013-5647","sourceIdentifier":"cve@mitre.org","published":"2013-08-29T12:07:56.583","lastModified":"2026-06-16T23:59:11.137","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"lib/sounder/sound.rb in the sounder gem 1.0.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a filename."},{"lang":"es","value":"lib/sounder/sound.rb en Sounder Gem v1.0.1 para Ruby permite a atacantes remotos ejecutar código arbitrario a través de metacaracteres de shell en un nombre de archivo."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-94"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:adam_zaninovich:sounder:1.0.1:*:*:*:*:*:*:*","matchCriteriaId":"8B8C90DB-54D0-49F3-93D6-7B2A8E089672"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*","matchCriteriaId":"264DD094-A8CD-465D-B279-C834DDA5F79C"}]}]}],"references":[{"url":"http://vapid.dhs.org/advisories/sounder-ruby-gem-cmd-inj.html","source":"cve@mitre.org","tags":["Exploit"]},{"url":"http://vapid.dhs.org/advisories/sounder-ruby-gem-cmd-inj.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"]}]}},{"cve":{"id":"CVE-2013-4136","sourceIdentifier":"secalert@redhat.com","published":"2013-09-30T21:55:07.223","lastModified":"2026-06-16T23:56:41.543","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/."},{"lang":"es","value":"ext/common/ServerInstanceDir.h en Phusion Passenger gem anteriores a 4.0.6 para Ruby permite a usuarios locales obtener privilegios o posiblemente cambiar el propietario de directorios arbitrarios a través de un ataque de enlaces simbólicos sobre un directorio con nombre predecible en /tmp/."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:M/Au:N/C:P/I:P/A:P","baseScore":4.4,"accessVector":"LOCAL","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":3.4,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-59"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:phusion:passenger:*:*:*:*:*:*:*:*","versionEndIncluding":"4.0.5","matchCriteriaId":"E22179A8-F51E-4F78-8A42-E579F43729F4"},{"vulnerable":true,"criteria":"cpe:2.3:a:phusion:passenger:4.0.1:*:*:*:*:*:*:*","matchCriteriaId":"E3C18671-5FB1-4C97-9FDD-6D495A748DF9"},{"vulnerable":true,"criteria":"cpe:2.3:a:phusion:passenger:4.0.2:*:*:*:*:*:*:*","matchCriteriaId":"ECFAD875-6DB0-4D40-9A11-E02DA954B197"},{"vulnerable":true,"criteria":"cpe:2.3:a:phusion:passenger:4.0.3:*:*:*:*:*:*:*","matchCriteriaId":"A1CC46D4-E33E-467C-B5C7-8F371D906A46"},{"vulnerable":true,"criteria":"cpe:2.3:a:phusion:passenger:4.0.4:*:*:*:*:*:*:*","matchCriteriaId":"2595C046-B304-42F3-8194-C259EFDBCA76"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*","matchCriteriaId":"264DD094-A8CD-465D-B279-C834DDA5F79C"}]}]}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2013-1136.html","source":"secalert@redhat.com","tags":["Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2013/07/16/6","source":"secalert@redhat.com"},{"url":"https://code.google.com/p/phusion-passenger/issues/detail?id=910","source":"secalert@redhat.com"},{"url":"https://github.com/phusion/passenger/blob/release-4.0.6/NEWS","source":"secalert@redhat.com"},{"url":"https://github.com/phusion/passenger/commit/5483b3292cc2af1c83033eaaadec20dba4dcfd9b","source":"secalert@redhat.com"},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1136.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2013/07/16/6","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://code.google.com/p/phusion-passenger/issues/detail?id=910","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/phusion/passenger/blob/release-4.0.6/NEWS","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/phusion/passenger/commit/5483b3292cc2af1c83033eaaadec20dba4dcfd9b","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2013-2119","sourceIdentifier":"secalert@redhat.com","published":"2014-01-03T18:54:11.350","lastModified":"2026-06-16T23:52:46.913","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary \"config\" file in a directory with a predictable name in /tmp/ before it is used by the gem."},{"lang":"es","value":"Las versiones 3.0.21 y 4.0.x anteriores a 4.0.5 de la gema Phusion Passenger para Ruby permite a usuarios locales causar denegación de servicio (prevención de inicio de la aplicación) u obtener privilegios creando un fichero \"config\" temporal en un directorio con un nombre predecible en /tmp/ antes de que sea utilizado por la gema."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:P/I:P/A:P","baseScore":4.6,"accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":3.9,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-264"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:phusion:passenger:*:*:*:*:*:*:*:*","versionEndIncluding":"3.0.20","matchCriteriaId":"EAC9E6F6-1C3C-4270-8360-97C0D1907D0C"},{"vulnerable":true,"criteria":"cpe:2.3:a:phusion:passenger:3.0.0:*:*:*:*:*:*:*","matchCriteriaId":"079D1872-7E1B-4A66-9B3C-7FFC842A7BE6"},{"vulnerable":true,"criteria":"cpe:2.3:a:phusion:passenger:3.0.1:*:*:*:*:*:*:*","matchCriteriaId":"BD8C8495-4011-4B96-BB78-430B1F508548"},{"vulnerable":true,"criteria":"cpe:2.3:a:phusion:passenger:3.0.2:*:*:*:*:*:*:*","matchCriteriaId":"0D3426ED-FAD6-47C5-94D3-A8BACFBEF270"},{"vulnerable":true,"criteria":"cpe:2.3:a:phusion:passenger:3.0.3:*:*:*:*:*:*:*","matchCriteriaId":"6CD685C8-82D3-497A-84E9-238D19F15FE7"},{"vulnerable":true,"criteria":"cpe:2.3:a:phusion:passenger:3.0.4:*:*:*:*:*:*:*","matchCriteriaId":"40AD3808-45E1-4889-98AF-4267B9DB17A6"},{"vulnerable":true,"criteria":"cpe:2.3:a:phusion:passenger:3.0.5:*:*:*:*:*:*:*","matchCriteriaId":"36FCE653-AFE2-4291-872E-9CA8772F0CAD"},{"vulnerable":true,"criteria":"cpe:2.3:a:phusion:passenger:3.0.6:*:*:*:*:*:*:*","matchCriteriaId":"5EF4B9EF-23CC-46E3-8700-36633924B9CF"},{"vulnerable":true,"criteria":"cpe:2.3:a:phusion:passenger:3.0.7:*:*:*:*:*:*:*","matchCriteriaId":"4BAC8504-4F89-49AD-A06F-6A5A5B1DA34E"},{"vulnerable":true,"criteria":"cpe:2.3:a:phusion:passenger:3.0.8:*:*:*:*:*:*:*","matchCriteriaId":"522C4CC8-9B97-4E1D-B82B-073D14444909"},{"vulnerable":true,"criteria":"cpe:2.3:a:phusion:passenger:3.0.9:*:*:*:*:*:*:*","matchCriteriaId":"E9FEA652-5FFF-443F-983B-4FC5A4478F9E"},{"vulnerable":true,"criteria":"cpe:2.3:a:phusion:passenger:3.0.10:*:*:*:*:*:*:*","matchCriteriaId":"3907694B-8E1A-4C5B-ABF0-90F023845557"},{"vulnerable":true,"criteria":"cpe:2.3:a:phusion:passenger:3.0.11:*:*:*:*:*:*:*","matchCriteriaId":"D2AA53B5-4F58-4D38-80D7-42771F2C295C"},{"vulnerable":true,"criteria":"cpe:2.3:a:phusion:passenger:3.0.12:*:*:*:*:*:*:*","matchCriteriaId":"4472ABCB-B464-4640-A892-73B4C8CB609F"},{"vulnerable":true,"criteria":"cpe:2.3:a:phusion:passenger:3.0.13:*:*:*:*:*:*:*","matchCriteriaId":"0A2AA0F1-AB6F-4583-9AB1-38B7F69CE96D"},{"vulnerable":true,"criteria":"cpe:2.3:a:phusion:passenger:3.0.14:*:*:*:*:*:*:*","matchCriteriaId":"8EDAC43A-BC17-4F1E-BFF6-4C9180817E5A"},{"vulnerable":true,"criteria":"cpe:2.3:a:phusion:passenger:3.0.15:*:*:*:*:*:*:*","matchCriteriaId":"49FEE58A-FFDD-4E00-94F7-947D32CC1350"},{"vulnerable":true,"criteria":"cpe:2.3:a:phusion:passenger:3.0.17:*:*:*:*:*:*:*","matchCriteriaId":"09AFC97E-37EF-4D68-B947-C8FB43A11245"},{"vulnerable":true,"criteria":"cpe:2.3:a:phusion:passenger:3.0.18:*:*:*:*:*:*:*","matchCriteriaId":"E2267254-554B-4AF2-A72B-0E346E4657C3"},{"vulnerable":true,"criteria":"cpe:2.3:a:phusion:passenger:3.0.19:*:*:*:*:*:*:*","matchCriteriaId":"5C406BAD-DCF8-4C46-9731-A81EBF387F68"},{"vulnerable":true,"criteria":"cpe:2.3:a:phusion:passenger:4.0.1:*:*:*:*:*:*:*","matchCriteriaId":"E3C18671-5FB1-4C97-9FDD-6D495A748DF9"},{"vulnerable":true,"criteria":"cpe:2.3:a:phusion:passenger:4.0.2:*:*:*:*:*:*:*","matchCriteriaId":"ECFAD875-6DB0-4D40-9A11-E02DA954B197"},{"vulnerable":true,"criteria":"cpe:2.3:a:phusion:passenger:4.0.3:*:*:*:*:*:*:*","matchCriteriaId":"A1CC46D4-E33E-467C-B5C7-8F371D906A46"},{"vulnerable":true,"criteria":"cpe:2.3:a:phusion:passenger:4.0.4:*:*:*:*:*:*:*","matchCriteriaId":"2595C046-B304-42F3-8194-C259EFDBCA76"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*","matchCriteriaId":"264DD094-A8CD-465D-B279-C834DDA5F79C"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:redhat:openshift:1.0:*:enterprise:*:*:*:*:*","matchCriteriaId":"E038BCDC-E14F-4D37-981C-BB80853C148C"}]}]}],"references":[{"url":"http://blog.phusion.nl/2013/05/29/phusion-passenger-3-0-21-released/","source":"secalert@redhat.com","tags":["Patch","Vendor Advisory"]},{"url":"http://blog.phusion.nl/2013/05/29/phusion-passenger-4-0-5-released/","source":"secalert@redhat.com","tags":["Patch","Vendor Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1136.html","source":"secalert@redhat.com","tags":["Third Party Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=892813","source":"secalert@redhat.com","tags":["Issue Tracking","Third Party Advisory"]},{"url":"http://blog.phusion.nl/2013/05/29/phusion-passenger-3-0-21-released/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"]},{"url":"http://blog.phusion.nl/2013/05/29/phusion-passenger-4-0-5-released/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1136.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=892813","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2013-4413","sourceIdentifier":"secalert@redhat.com","published":"2014-03-11T19:37:02.880","lastModified":"2026-06-16T23:57:11.260","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Directory traversal vulnerability in controller/concerns/render_redirect.rb in the Wicked gem before 1.0.1 for Ruby allows remote attackers to read arbitrary files via a %2E%2E%2F (encoded dot dot slash) in the step."},{"lang":"es","value":"Vulnerabilidad de salto de directorio en controller/concerns/render_redirect.rb en la gema Wicked anterior a 1.0.1 para Ruby permite a atacantes remotos leer archivos arbitrarios a través de un %2E%2E%2F (punto punto barra codificado) en el paso."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:schneems:wicked:*:*:*:*:*:ruby:*:*","versionEndIncluding":"1.0.0","matchCriteriaId":"7BB24A72-A86D-4C16-BAC7-CE3F433A8C0C"},{"vulnerable":true,"criteria":"cpe:2.3:a:schneems:wicked:0.0.1:*:*:*:*:ruby:*:*","matchCriteriaId":"11C26B86-CDFA-45F3-BD36-E37C3446F9DD"},{"vulnerable":true,"criteria":"cpe:2.3:a:schneems:wicked:0.0.2:*:*:*:*:ruby:*:*","matchCriteriaId":"45008888-E02B-4832-B268-733849D30412"},{"vulnerable":true,"criteria":"cpe:2.3:a:schneems:wicked:0.1.0:*:*:*:*:ruby:*:*","matchCriteriaId":"24678459-FB79-4DE2-9B93-6678C0E59E91"},{"vulnerable":true,"criteria":"cpe:2.3:a:schneems:wicked:0.1.1:*:*:*:*:ruby:*:*","matchCriteriaId":"9575E1DD-F8FD-4D30-94FC-0903A5C880C1"},{"vulnerable":true,"criteria":"cpe:2.3:a:schneems:wicked:0.1.2:*:*:*:*:ruby:*:*","matchCriteriaId":"1D406277-1F89-4B5B-B2DE-FF875F16045E"},{"vulnerable":true,"criteria":"cpe:2.3:a:schneems:wicked:0.1.3:*:*:*:*:ruby:*:*","matchCriteriaId":"06B2A5FC-F95C-4645-9944-1556441EFCE3"},{"vulnerable":true,"criteria":"cpe:2.3:a:schneems:wicked:0.1.4:*:*:*:*:ruby:*:*","matchCriteriaId":"EAEC4F02-2F65-4102-9C20-FD09439340FB"},{"vulnerable":true,"criteria":"cpe:2.3:a:schneems:wicked:0.1.5:*:*:*:*:ruby:*:*","matchCriteriaId":"8012CC6B-147B-4098-AEF5-273662549248"},{"vulnerable":true,"criteria":"cpe:2.3:a:schneems:wicked:0.1.6:*:*:*:*:ruby:*:*","matchCriteriaId":"02949A0C-52BA-4519-9236-116062644E13"},{"vulnerable":true,"criteria":"cpe:2.3:a:schneems:wicked:0.2.0:*:*:*:*:ruby:*:*","matchCriteriaId":"1076DC7A-C9FE-4D59-9E83-F018FDAC67F4"},{"vulnerable":true,"criteria":"cpe:2.3:a:schneems:wicked:0.3.0:*:*:*:*:ruby:*:*","matchCriteriaId":"A97B76A9-B09F-4014-9C70-49642C04A375"},{"vulnerable":true,"criteria":"cpe:2.3:a:schneems:wicked:0.3.1:*:*:*:*:ruby:*:*","matchCriteriaId":"B9680911-AD8E-4B3E-A766-3EC01C8ED64E"},{"vulnerable":true,"criteria":"cpe:2.3:a:schneems:wicked:0.3.2:*:*:*:*:ruby:*:*","matchCriteriaId":"B040BF93-15A9-4500-86A3-573D2FEA1BE0"},{"vulnerable":true,"criteria":"cpe:2.3:a:schneems:wicked:0.3.3:*:*:*:*:ruby:*:*","matchCriteriaId":"09E23352-72CD-4B0A-89A4-DE01A0F82E57"},{"vulnerable":true,"criteria":"cpe:2.3:a:schneems:wicked:0.3.4:*:*:*:*:ruby:*:*","matchCriteriaId":"8B3F55EB-B6CC-4AE7-8935-CE0F2BFB10A3"},{"vulnerable":true,"criteria":"cpe:2.3:a:schneems:wicked:0.4.0:*:*:*:*:ruby:*:*","matchCriteriaId":"EF94B020-F2D9-4F78-A924-28EFFEA7D1D9"},{"vulnerable":true,"criteria":"cpe:2.3:a:schneems:wicked:0.5.0:*:*:*:*:ruby:*:*","matchCriteriaId":"C9288672-11DB-4F74-A6A1-61C2BE06C685"},{"vulnerable":true,"criteria":"cpe:2.3:a:schneems:wicked:0.6.0:*:*:*:*:ruby:*:*","matchCriteriaId":"82C3CCAE-F8EB-4AFD-8392-22685DB19428"},{"vulnerable":true,"criteria":"cpe:2.3:a:schneems:wicked:0.6.1:*:*:*:*:ruby:*:*","matchCriteriaId":"7956F067-453E-438E-A330-B0B4CB03265E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*","matchCriteriaId":"264DD094-A8CD-465D-B279-C834DDA5F79C"}]}]}],"references":[{"url":"http://seclists.org/oss-sec/2013/q4/43","source":"secalert@redhat.com","tags":["Patch"]},{"url":"http://secunia.com/advisories/55151","source":"secalert@redhat.com","tags":["Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/62891","source":"secalert@redhat.com"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/87783","source":"secalert@redhat.com"},{"url":"https://github.com/schneems/wicked/commit/fe31bb2533fffc9d098c69ebeb7afc3b80509f53","source":"secalert@redhat.com","tags":["Exploit","Patch"]},{"url":"http://seclists.org/oss-sec/2013/q4/43","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"http://secunia.com/advisories/55151","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/62891","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/87783","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/schneems/wicked/commit/fe31bb2533fffc9d098c69ebeb7afc3b80509f53","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Patch"]}]}},{"cve":{"id":"CVE-2026-46727","sourceIdentifier":"cve@mitre.org","published":"2026-05-22T18:16:22.927","lastModified":"2026-07-23T16:10:00.137","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"An issue was discovered in Ruby 4 before 4.0.5. A race condition leading to a use-after-free in the pthread-based getaddrinfo timeout handler (rb_getaddrinfo in ext/socket/raddrinfo.c) allows a remote attacker who can delay DNS responses near the user-specified timeout to crash a Ruby process that calls Addrinfo.getaddrinfo(..., timeout:) or Socket.tcp(..., resolv_timeout:). Memory-corruption-based exploitation is theoretically possible. The attack could, for example, be carried out through a crafted authoritative DNS server or recursive resolver."},{"lang":"es","value":"Se descubrió un problema en Ruby 4 antes de 4.0.5. Una condición de carrera que conduce a un uso después de liberación en el gestor de tiempo de espera de getaddrinfo basado en pthread (rb_getaddrinfo en ext/socket/raddrinfo.c) permite a un atacante remoto que puede retrasar las respuestas DNS cerca del tiempo de espera especificado por el usuario bloquear un proceso de Ruby que llama a Addrinfo.getaddrinfo(..., timeout:) o Socket.tcp(..., resolv_timeout:). La explotación basada en corrupción de memoria es teóricamente posible. El ataque podría, por ejemplo, llevarse a cabo a través de un servidor DNS autoritativo manipulado o un resolvedor recursivo."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"ruby-lang","product":"Ruby","defaultStatus":"unaffected","versions":[{"version":"4.0.0","lessThan":"4.0.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-05-22T18:41:24.966247Z","id":"CVE-2026-46727","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-362"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.5","matchCriteriaId":"BA79BA10-3D56-4399-A909-60048906946A"}]}]}],"references":[{"url":"https://hackerone.com/reports/3607434","source":"cve@mitre.org","tags":["Permissions Required"]},{"url":"https://www.ruby-lang.org/en/news/2026/05/20/getaddrinfo-cve-2026-46727/","source":"cve@mitre.org","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-97229","sourceIdentifier":"cve@gitlab.com","published":"2026-10-13T02:17:00.840","lastModified":"2026-11-02T13:30:16.800","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation."}],"affected":[{"source":"cve@gitlab.com","affectedData":[{"vendor":"GitLab","product":"GitLab","defaultStatus":"unaffected","cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"],"repo":"https://gitlab.com/gitlab-org/gitlab","versions":[{"version":"19.2","lessThan":"19.2.8","versionType":"semver","status":"affected"},{"version":"19.3","lessThan":"19.3.5","versionType":"semver","status":"affected"},{"version":"19.4","lessThan":"19.4.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@gitlab.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-13T00:00:00+00:00","id":"CVE-2026-97229","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"cisaExploitAdd":"2026-10-29","cisaActionDue":"2026-11-01","cisaRequiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cisaVulnerabilityName":"GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability","weaknesses":[{"source":"cve@gitlab.com","type":"Secondary","description":[{"lang":"en","value":"CWE-190"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"19.2.0","versionEndExcluding":"19.2.8","matchCriteriaId":"A938C22D-FD14-48A6-B46F-CCA9AC8EBC9F"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"19.2.0","versionEndExcluding":"19.2.8","matchCriteriaId":"EC585668-21D1-41DF-A4FB-17DD48AB9F12"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"19.3.0","versionEndExcluding":"19.3.5","matchCriteriaId":"1304F38C-8780-4412-AE0B-D0B65319E8E6"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"19.3.0","versionEndExcluding":"19.3.5","matchCriteriaId":"75C2C2EE-4DF9-4AB5-9E15-2EC799667C6C"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"19.4.0","versionEndExcluding":"19.4.2","matchCriteriaId":"5FD2476C-E11F-4215-A329-C3B189B6611F"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"19.4.0","versionEndExcluding":"19.4.2","matchCriteriaId":"FAAF2A38-5C01-490C-A191-8532B58C246B"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*","versionStartIncluding":"3.3.0","versionEndExcluding":"3.3.13","matchCriteriaId":"822BFBA1-8011-481F-AB12-A4659A198702"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*","versionStartIncluding":"3.4.0","versionEndExcluding":"3.4.12","matchCriteriaId":"74D2C27C-A166-48E7-ACCB-546BE5A232EC"},{"vulnerable":true,"criteria":"cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.8","matchCriteriaId":"76DE6415-3A05-4233-805C-1F48CC6CA1D8"}]}]}],"references":[{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/","source":"cve@gitlab.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/630686","source":"cve@gitlab.com","tags":["Broken Link"]},{"url":"https://hackerone.com/reports/4055749","source":"cve@gitlab.com","tags":["Permissions Required"]},{"url":"https://hackerone.com/reports/4058589","source":"cve@gitlab.com","tags":["Permissions Required"]},{"url":"https://github.com/rapid7/metasploit-framework/pull/22017","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-97229","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["US Government Resource"]}]}}]}