markevans/dragonfly
GitHub
Releases87
Frequency2 months 3 days
Last Release
Stars2.11K
A Ruby gem for on-the-fly processing - suitable for image uploading in Rails, Sinatra and much more!
CVE History
| CVE | Published | CVSS v3 | CVSS v2 |
|---|---|---|---|
| 9.1 CRITICAL | 4.9 MEDIUM | ||
An argument injection vulnerability in Dragonfly Ruby Gem v1.3.0 allows attackers to read and write arbitrary files when the verify_url option is disabled. This vulnerability is exploited via a crafted URL. | |||
| 9.8 CRITICAL | 6.8 MEDIUM | ||
An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL when the verify_url option is disabled. This may lead to code execution. The problem occurs because the generate and process features mishandle use of the ImageMagick convert utility. | |||
| — | 7.5 HIGH | ||
The Dragonfly gem 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby, when used with Ruby on Rails, allows remote attackers to execute arbitrary code via a crafted request. | |||