Ooooooo_Q

There is a deserialization of untrusted data vulnerability in the Kredis JSON deserialization code. This issue may result in the deserialization of unexpected objects in the system when carefully crafted JSON data is processed by Kredis. Any applications using Kredis with JSON are affected.

There is a denial of service vulnerability in the Content-Disposition parsing component of Rack. This could allow an attacker to craft an input that can cause Content-Disposition header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is used typically in multipart parsing. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.

A denial of service vulnerability in the Range header parsing component of Rack can cause the component to take an unexpected amount of time when processing carefully crafted input, possibly resulting in a denial of service attack vector. Any applications that deal with Range requests, such as streaming applications or applications that serve files, may be impacted.

A regular expression based DoS issue in Action Dispatch is related to insufficient input validation. Exploitation of this issue can allow a remote attacker to cause a denial of service. Specially crafted cookies, in combination with a specially crafted `X FORWARDED HOST` header, can cause the regular expression engine to enter a state of catastrophic backtracking, leading to high CPU and memory usage.

A ReDoS based DoS vulnerability in GlobalID could allow an attacker to cause the regular expression engine to take an unexpected amount of time with a carefully crafted input. In Rails, there is a possible open redirect when using the `redirect to` helper with untrusted user input, which could be bypassed by a carefully crafted URL.

The issue is related to insufficient input validation in the Inflector.underscore method, which can lead to a regular expression based DoS vulnerability. A specially crafted string passed to the underscore method can cause the regular expression engine to enter a state of catastrophic backtracking, resulting in high CPU and memory usage, and potentially leading to a denial of service. This affects methods such as String#underscore, ActiveSupport::Inflector.underscore, and String#titleize.

The issue is related to an open redirect vulnerability in Rails, where an attacker could bypass the protection against open redirects by using a carefully crafted URL, resulting in an open redirect vulnerability. This occurs when the `redirect to` helper is used with untrusted user input. The vulnerability can be exploited by a remote attacker to redirect users to an arbitrary URL.

The issue is related to certain configurations of rails-html-sanitizer that use an inefficient regular expression. This inefficiency can lead to excessive backtracking when attempting to sanitize certain SVG attributes, resulting in a denial of service through CPU resource consumption. The vulnerability can be exploited by a remote attacker to cause a denial of service.

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. It contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a denial of service through CPU resource consumption.

The issue affects the generation of the table of contents (toc) in markdown-it-toc, where the title of the generated toc and the contents of the header are not properly escaped.

The issue affects the markdown-it-decorate package, allowing an attacker to add an event handler or use javascript:xxx for the link, potentially leading to cross-site scripting (XSS). This is a type of attack where an attacker can inject malicious scripts into a website, potentially stealing user data or taking control of the user's session.

A possible denial of service vulnerability exists in the multipart parsing component of Rack. This issue is related to insufficient checking of user-input data when parsing composite POST requests. Exploitation of this vulnerability may allow a remote attacker to perform a denial of service (DoS) attack using a specially crafted POST request. The vulnerability can be triggered by carefully crafted multipart POST requests, causing Rack's multipart parser to take longer than expected.

Name of the Vulnerable Software and Affected Versions: GitLab versions 13.0 through 14.3.1 Description: A stored Reflected Cross-Site Scripting issue in the Jira integration allows an attacker to execute arbitrary javascript code. Recommendations: For GitLab versions 13.0 through 14.3.1, update to a version later than 14.3.1 to resolve the issue.

This issue allows malicious JavaScript to be inserted as a value of `lang` in the markdown-it-highlightjs Inline code highlighting feature. The vulnerability can be exploited by manipulating the `lang` value, enabling the execution of malicious code.

The issue allows an attacker to write arbitrary files to a web server, potentially resulting in remote code execution if the attacker can write unescaped ERB to a view.

Name of the Vulnerable Software and Affected Versions: RubyGems versions 2.7.6 through 3.0.2 Description: A Directory Traversal issue was discovered in RubyGems. The issue allows a malicious gem to delete arbitrary files on the user's machine if the attacker can guess the paths, potentially leading to data loss or an unusable system. This is particularly concerning given how frequently the gem is run as sudo and the predictability of paths on modern systems. Recommendations: For versions 2.7.6 through 3.0.2, update to a version later than 3.0.2 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A remote code execution issue exists in development mode Rails, allowing an attacker to guess the automatically generated development mode secret token. This token can be used in combination with other Rails internals to escalate to a remote code execution exploit. The vulnerability is related to errors in the pseudorandom number generator code.

The issue arises from the Dir.open, Dir.new, Dir.entries, and Dir.empty? methods not checking for NULL characters, potentially leading to unintentional directory traversal. This could allow a remote attacker to gain unauthorized access to protected data or impact the integrity of protected information.

The issue arises from insufficient input validation in the UNIXServer.open and UNIXSocket.open methods. This may allow an attacker to connect to an unintended socket, potentially bypassing security restrictions.

The issue exists due to incorrect restriction of the directory path name with limited access in the Dir.mktmpdir method of the tmpdir library in Ruby. This could allow a remote attacker to write arbitrary files to the file system. The vulnerability might be exploited by using a .. (dot dot) in the prefix argument to create arbitrary directories or files.