Description

An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats.

Remediation

References

CVE-2018-16396

Related Vulnerabilities

WordPress Plugin Templatic Tevolution Arbitrary File Upload (2.3.6)

WordPress Plugin Visual Form Builder Unspecified Vulnerability (3.0.5)

WordPress Plugin Comment Rating 'id' Parameter SQL Injection (2.9.23)

Ruby on Rails Improper Input Validation Vulnerability (CVE-2019-5420)

WordPress Plugin Mobiloud-Native Mobile Apps for your WordPress site (iPhone, iPad, Android) Multiple Cross-Site Scripting Vulnerabilities (2.3.7)

Severity

High

Classification

CVE-2018-16396 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities