https://pwn.watch/t/ruby Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Mon, 07 Jul 2025 00:00:00 GMT https://pwn.watch/i/rails-ruby-on-rails-cve-2019-5418 https://pwn.watch/i/rails-ruby-on-rails-cve-2019-5418 Mon, 07 Jul 2025 00:00:00 GMT high <p>Rails Ruby on Rails contains a path traversal vulnerability in Action View. Specially crafted accept headers in combination with calls to `render file:` can cause arbitrary files on the target server to be rendered, disclosing the file contents. Added to CISA KEV on 2025-07-07.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2025-07-07: CISA added CVE-2019-5418 to the KEV catalog (due 2025-07-28).</li></ul> <p><strong>CVEs:</strong> CVE-2019-5418</p> https://pwn.watch/i/gitlab-ce-ee-cve-2023-7028 https://pwn.watch/i/gitlab-ce-ee-cve-2023-7028 Wed, 01 May 2024 00:00:00 GMT critical <p>GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover. Added to the CISA KEV catalog on 2024-05-01. CVE-2023-7028 was assigned before 2024; the KEV listing came in 2024.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2024-05-01: CISA added CVE-2023-7028 to the KEV catalog (federal deadline 2024-05-22) (<a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">source</a>)</li><li>2024-01-12: CVE-2023-7028 published (<a href="https://nvd.nist.gov/vuln/detail/CVE-2023-7028">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2023-7028</p>