Most recent entries from all

certa-2013-avi-024 — Deux vulnérabilités ont été corrigées dans Ruby on Rails Elles concernent des exécutions de…

certa-2013-avi-024

EUVD-2026-104524

fkie_cve-2013-0156

active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.

GHSA-jmgw-6vjg-jjwg — actionpack Improper Input Validation vulnerability

Affected: RubyGems: actionpack

`active_support/core_ext/hash/conversions.rb` in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.

gsd-2013-0156

openSUSE-SU-2024:10188-1 — ruby2.2-rubygem-extlib-0.9.16-7.4 on GA media

ruby2.2-rubygem-extlib-0.9.16-7.4 on GA media

RHSA-2013:0153 — Red Hat Security Advisory: Ruby on Rails security update

rubygem-activesupport: Multiple vulnerabilities in parameter parsing in ActionPack

Withdrawn: UBUNTU-CVE-2013-0156

Withdrawn by the publisher.

Affected: Ubuntu:14.04:LTS: ruby-extlib