...dfsg-1.3build2.1) UNRELEASED; urgency=medium * SECURITY UPDATE: possible arbitrary file leak (CVE-2022-44268) * Backport upstream https://github.com/ImageMagick/ImageMagick6/commit/3c5188b41902a909e163492fb0c19e49efefcefe -- YOUR NAME <YOUR@EMAIL-ADDRESS> Sun, 05 Feb...
...dfsg-2.1ubuntu11.4.1) UNRELEASED; urgency=medium * SECURITY UPDATE: possible arbitrary file leak (CVE-2022-44268) * Backport upstream https://github.com/ImageMagick/ImageMagick6/commit/3c5188b41902a909e163492fb0c19e49efefcefe -- YOUR NAME <YOUR@EMAIL-ADDRESS> Sun, 05 Feb...
Usage The CLI will show you for each gem, whether a CVE exists for your current version and whether major/minor/patch updates are available. You can navigate the...
...we no longer recommend blindly installing patch updates. Prefer using this tool for patching CVEs and for catching up on major versions. The tool respects your Bundler settings, such as...
...a few selective npm libraries in a project that uses pnpm to apply a CVE mitigation. My first instinct was to modify the package.json file and hope that pnpm install...
...changes (both to the package.json and pnpm lockfile) will be minimal. Example for my CVE-2025-66478 fix: pnpm up next@15.4.8 react@19.1.2 There is also pnpm audit --fix...
...fails like this: Invalid query parameters: invalid %-encoding (../../../../../../../../../etc/passwd%%0000.html) Someone tries to exploit CVE-2019-5418. If you use the latest Rails (or latest Rails LTS) you're safe...
Enter the hostname of a server to test it for CVE...
...endanger an app and how we find and fix them, e.g. with bundler-audit, CVE advisories and Rails LTS. You can explain what HTTPS guarantees against an attacker on the...
...for Rails projects — our card Vulnerable dependencies 📄 bundler-audit — checks your Gemfile.lock against known CVEs 📄 Brakeman — static analysis of a Rails app for security warnings 📄 How to apply security updates...
...so slow that it can DoS your application (Examples are the ActiveRecord's PostgreSQL CVE-2021-22880 or the Cloudflare outage 2019). Greedy quantifiers (default) A plain * or + is greedy...
...source(:github) { |repo| "https://github.com/#{repo}.git" } ruby "2.7.6" gem "rails" gem "sqlite3", ">1.4.0" # CVE-XYZ gem "puma" Downgrades with bundler happens only in rare cases and will emit...
...consequently enforce this, your rails line would have a long line of comments with CVEs Good source "https://rubygems.org" git_source(:github) { |repo| "https://github.com/#{repo}.git" }
...unpoly": "2.x" and "unpoly": "^2.7.2" expresses the same version constraint Bad Commit message: Fixes CVE-XYZ { "dependencies": { "autosize": ">6.0.0", "unpoly": "x" } } There is no reason we have to protect...
...match rows without knowing a secret token: Potential Query Manipulation with Common Rails Practises CVE-2013-3211 MySQL madness and Rails
Yesterday, Rails fixed a security issue (CVE-2014-3514) in Rails 4+. It was possible to use .where or .create_with to bypass Rails' Strong Parameters: user.blog_posts.create_with...
...large attack surface that has repeatedly caused security incidents in the past (compare ImageMagick CVEs with libvips CVEs). Ubuntu is sometimes slow to fix the numerous ImageMagick vulnerabilities. E.g. this...
...Ubuntu update from June 2021 is fixing ImageMagick CVEs from November 2020. We repeatedly had major pains upgrading ImageMagick across major releases of Ubuntu. I also found a few downsides...