Search Results (Refine Search)
- Results Type: Overview
- Keyword (text search): cpe:2.3:a:rubyzip_project:rubyzip:0.9.7:*:*:*:*:*:*:*
- CPE Name Search: true
Vuln ID | Summary | CVSS Severity |
---|---|---|
CVE-2019-16892 |
In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption). Published: September 25, 2019; 6:15:10 PM -0400 |
V3.1: 5.5 MEDIUM V2.0: 7.1 HIGH |
CVE-2018-1000544 |
rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , an attacker can upload a malicious file that contains symlinks or files with absolute pathnames "../" to write arbitrary files to the filesystem.. Published: June 26, 2018; 12:29:02 PM -0400 |
V3.1: 9.8 CRITICAL V2.0: 7.5 HIGH |