Description
In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the Dir.open, Dir.new, Dir.entries and Dir.empty? methods do not check NULL characters. When using the corresponding method, unintentional directory traversal may be performed.
Remediation
References
Related Vulnerabilities
Joomla! Core Multiple Vulnerabilities (1.7.3 - 3.7.2)
WordPress Plugin MailPoet Newsletters (Previous) SQL Injection (2.2)
AngularJS Inefficient Regular Expression Complexity Vulnerability (CVE-2024-21490)
WordPress Plugin Social Sharing-Sassy Social Share Cross-Site Scripting (3.3.39)
XWiki Improper Encoding or Escaping of Output Vulnerability (CVE-2022-36099)