Skip to contentRuby-lang vulnerabilities
Newest
- ruby-lang webrick** DISPUTED ** The WEBrick gem 1.4.2 for Ruby allows directory traversal if the attacker once had...CVE-2019-11879Disputed5.5 Medium
- ruby-lang ruby, canonical ubuntu linux, debian linux +1 more +3 moreAn issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x...CVE-2018-16396Fix available8.1 High
- ruby-lang openssl, ruby, canonical ubuntu linux +2 more +4 moreRuby Openssl Allows Incorrect Value ComparisonCVE-2018-16395Fix availableEPSS 10.7%9.8 Critical
- ruby-lang ruby, canonical ubuntu linux, debian linux +2 moreIn Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0...CVE-2018-8780Fix available9.1 Critical
- ruby-lang ruby, canonical ubuntu linux, debian linux +2 moreIn Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0...CVE-2018-8779Fix available7.5 High
- ruby-lang ruby, canonical ubuntu linux, debian linux +1 more +3 moreIn Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0...CVE-2018-8778Fix available7.5 High
- ruby-lang ruby, canonical ubuntu linux, debian linux +1 more +3 moreIn Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0...CVE-2018-8777Fix available7.5 High
- ruby-lang ruby, canonical ubuntu linux, debian linux +1 more +3 moreDirectory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library in Ruby before...CVE-2018-6914Fix availableEPSS 10.2%7.5 High
- ruby-lang ruby, debian linux +1 moreRuby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0...CVE-2017-17742Fix available5.3 Medium
- ruby-lang rubyThe lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might...CVE-2017-17790Fix available9.8 Critical
- ruby-lang ruby, debian linux, redhat enterprise linux desktop +5 more +7 moreRuby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile,...CVE-2017-17405Public exploitFix availableEPSS 73.8%8.8 High
- ruby-lang rubyRuby OpenSSL DoS VulnerabilityCVE-2017-14033Fix available7.5 High
- ruby-lang rubyWEBrick RCE VulnerabilityCVE-2017-10784Fix availableEPSS 16.4%8.8 High
- hackerone rubyRuby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a...CVE-2017-0898Fix available9.1 Critical
- ruby-lang ruby, canonical ubuntu linux, debian linux +6 more +8 moreRuby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory...CVE-2017-14064Fix available9.8 Critical
- ruby-lang rubyThe parser_yyerror function in the UTF-8 parser in Ruby 2.4.1 allows attackers to cause a denial...CVE-2017-114659.8 Critical
- ruby-lang rubyNet::SMTP in Ruby before 2.4.0 is vulnerable to SMTP command injection via CRLF sequences in a...CVE-2015-9096Fix available6.1 Medium
- oniguruma project oniguruma, php, ruby-lang ruby +2 moreAn issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and...CVE-2017-9225Fix available9.8 Critical
- oniguruma project oniguruma, php, ruby-lang ruby +2 moreAn issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and...CVE-2017-9229Fix available7.5 High
- ruby-lang rubyThe parse_char_class function in regparse.c in the Onigmo (aka Oniguruma-mod) regular expression...CVE-2017-61817.5 High
- hackerone rubyType confusion exists in two methods of Ruby's WIN32OLE class, ole_invoke and ole_query_interface...CVE-2016-23369.8 Critical
- hackerone rubyAn exploitable heap overflow vulnerability exists in the Fiddle::Function.new "initialize"...CVE-2016-2339Fix available9.8 Critical
- hackerone ruby, tcl tcl/tk +1 moreType confusion exists in _cancel_eval Ruby's TclTkIp class method. Attacker passing different...CVE-2016-2337Fix available9.8 Critical
- ruby-lang openssl, debian linux +1 moreOpenSSL gem for Ruby using inadequate encryption strengthCVE-2016-7798Fix available7.5 High
- ruby-lang ruby, apple mac os x +1 moreThe Fiddle::Handle implementation in ext/fiddle/handle.c in Ruby before 2.0.0-p648, 2.1 before 2...CVE-2015-7551Fix available8.4 High
- ruby-lang rubyDL::dlopen in Ruby 1.8, 1.9.0, 1.9.2, 1.9.3, 2.0.0 before patchlevel 648, and 2.1 before 2.1.8...CVE-2009-5147Public exploitFix available7.3 High
- ruby-lang rubyThe URI.decode_www_form_component method in Ruby before 1.9.2-p330 allows remote attackers to...CVE-2014-6438Fix available7.5 High
- ruby-lang ruby, rubygems, oracle solaris +1 more +3 moreRubyGems vulnerable to DNS hijack attackCVE-2015-3900Fix available5.0 Medium
- hackerone ruby, debian linux, puppet agent +2 more +4 moreverify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x...CVE-2015-1855Public exploitFix available5.9 Medium
- ruby-lang rubyThe REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel 598,...CVE-2014-8090Fix available5.0 Medium
- ruby-lang ruby, canonical ubuntu linux, opensuse +1 more +3 moreThe REXML parser in Ruby 1.9.x before 1.9.3-p550, 2.0.x before 2.0.0-p594, and 2.1.x before 2.1.4...CVE-2014-8080Fix available5.0 Medium
- ruby-lang ruby, canonical ubuntu linux, debian linux +4 more +6 moreOff-by-one error in the encodes function in pack.c in Ruby 1.9.3 and earlier, and 2.x through 2.1...CVE-2014-4975Fix available5.0 Medium
- ruby-lang ruby** DISPUTED ** The openssl extension in Ruby 2.x does not properly maintain the state of process...CVE-2014-2734Public exploitDisputed5.8 Medium
- ruby-lang rubyHeap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before...CVE-2013-4164Fix availableEPSS 35.0%6.8 Medium
- ruby-lang ruby, opensuse +1 more(1) DL and (2) Fiddle in Ruby 1.9 before 1.9.3 patchlevel 426, and 2.0 before 2.0.0 patchlevel...CVE-2013-20656.4 Medium
- ruby-lang ruby, rubygems +1 moreRubyGems Regular Expression Denial of ServiceCVE-2013-4363Fix available4.3 Medium
- ruby-lang ruby, rubygems, redhat enterprise linux +2 moreRubyGems Regular Expression Denial of Service vulnerabilityCVE-2013-4287Fix available4.3 Medium
- ruby-lang rubyThe OpenSSL::SSL.verify_certificate_identity function in lib/openssl/ssl.rb in Ruby 1.8 before 1...CVE-2013-4073Fix available6.8 Medium
- ruby-lang rubyThe safe-level feature in Ruby 1.8.7 allows context-dependent attackers to modify strings via the...CVE-2012-44814.3 Medium
- ruby-lang rubyRuby 1.8.7 before patchlevel 371, 1.9.3 before patchlevel 286, and 2.0 before revision r37068...CVE-2012-44665.0 Medium
- ruby-lang rubyRuby 1.9.3 before patchlevel 286 and 2.0 before revision r37068 allows context-dependent...CVE-2012-44645.0 Medium
- ruby-lang rubyRuby vulnerable to denial of serviceCVE-2013-1821Fix available5.0 Medium
- ruby-lang rdoc, ruby, canonical ubuntu linux +2 moreRDoc contains XSS vulnerabilityCVE-2013-0256Fix available4.3 Medium
- ruby-lang rubyRuby (aka CRuby) 1.9 before 1.9.3-p327 and 2.0 before r37575 computes hash values without...CVE-2012-53715.0 Medium
- ruby-lang rubyThe rb_get_path_check function in file.c in Ruby 1.9.3 before patchlevel 286 and Ruby 2.0.0...CVE-2012-45225.0 Medium
- ruby-lang ruby** DISPUTED ** Untrusted search path vulnerability in the installation functionality in Ruby 1.9...CVE-2012-5380Public exploitDisputed6.0 Medium
- ruby-lang rubyRuby (aka CRuby) before 1.8.7-p357 computes hash values without restricting the ability to...CVE-2011-4815Fix available7.8 High
- ruby-lang rubyRuby before 1.8.6-p114 does not reset the random seed upon forking, which makes it easier for...CVE-2011-30095.0 Medium
- ruby-lang rubyThe SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x...CVE-2011-27055.0 Medium
- ruby-lang rubyRuby before 1.8.7-p352 does not reset the random seed upon forking, which makes it easier for...CVE-2011-26865.0 Medium
- Show moreLoading…