Rubygems vulnerabilities

Products

• Rubygems 26
• Rubygems.org 6
• Mail Gem 2

Newest

• rubygems rubygems.org Denial of service when publishing a package on rubygems.org CVE-2024-35221 Fix available 4.3 MediumMay 29, 2024
• rubygems rubygems.org rubygems.org MFA Bypass through password reset function could allow account takeover CVE-2024-21654 4.8 MediumJanuary 12, 2024
• rubygems rubygems.org Unauthorized gem replacement for full names ending in numbers on rubygems.org CVE-2023-40165 7.4 HighAugust 17, 2023
• rubygems, rubygems rubygems.org +1 more RubyGems allows creation of users with arbitrary unverified emails CVE-2022-36073 8.3 HighSeptember 7, 2022
• rubygems rubygems.org Unauthorized takeover for new versions of some platform-specific gems CVE-2022-29218 7.7 HighMay 12, 2022
• rubygems rubygems.org Unauthorized gem takeover for some gems on rubygems.org CVE-2022-29176 9.9 CriticalMay 5, 2022
• bundler, rubygems +1 more Local Code Execution through Argument Injection via dash leading git url parameter in Gemfile CVE-2021-43809 Fix available 6.7 MediumDecember 8, 2021
• rubygems, debian linux, opensuse leap +2 more RubyGems Escape sequence injection in errors CVE-2019-8325 Fix available 7.5 HighMarch 27, 2019
• rubygems, debian linux, opensuse leap +1 more +3 more Code injection in RubyGems CVE-2019-8324 Fix available 8.8 HighMarch 27, 2019
• rubygems, debian linux, opensuse leap +2 more RubyGems Escape sequence injection vulnerability in api response handling CVE-2019-8323 Fix available 7.5 HighMarch 27, 2019
• rubygems, debian linux, opensuse leap +2 more RubyGems Escape sequence injection vulnerability in gem owner CVE-2019-8322 Fix available 7.5 HighMarch 27, 2019
• rubygems, debian linux, opensuse leap +2 more RubyGems Escape sequence injection vulnerability in verbose CVE-2019-8321 Fix available 7.5 HighMarch 27, 2019
• rubygems RubyGems Delete directory using symlink when decompressing tar CVE-2019-8320 Fix available 7.4 HighMarch 27, 2019
• rubygems RubyGems Path Traversal vulnerability CVE-2018-1000079 Fix available 5.5 MediumMarch 13, 2018
• rubygems, debian linux +1 more RubyGems Cross-site Scripting vulnerability CVE-2018-1000078 Fix available 6.1 MediumMarch 13, 2018
• rubygems, debian linux +1 more RubyGems Improper Input Validation vulnerability CVE-2018-1000077 Fix available 5.3 MediumMarch 13, 2018
• rubygems, debian linux +1 more RubyGems Improper Verification of Cryptographic Signature vulnerability CVE-2018-1000076 Fix available 9.8 CriticalMarch 13, 2018
• rubygems, debian linux +1 more RubyGems Infinite Loop vulnerability CVE-2018-1000075 Fix available 7.5 HighMarch 13, 2018
• rubygems RubyGems Deserialization of Untrusted Data vulnerability CVE-2018-1000074 Fix available 7.8 HighMarch 13, 2018
• rubygems RubyGems Link Following vulnerability CVE-2018-1000073 Fix available 7.5 HighMarch 13, 2018
• hackerone rubygems, canonical ubuntu linux, debian linux +6 more +8 more RubyGems vulnerable to Deserialization of Untrusted Data CVE-2017-0903 Fix available EPSS 15.9% 9.8 CriticalOctober 11, 2017
• hackerone rubygems, canonical ubuntu linux, debian linux +6 more +8 more RubyGems has Origin Validation Error vulnerability CVE-2017-0902 Fix available 8.1 HighAugust 31, 2017
• hackerone rubygems, canonical ubuntu linux, debian linux +6 more +8 more RubyGems may allow a maliciously crafted gem to overwrite files CVE-2017-0901 Public exploitFix available EPSS 29.4% 7.5 HighAugust 31, 2017
• rubygems, debian linux, redhat enterprise linux desktop +5 more +7 more RubyGems Improper Input Validation vulnerability CVE-2017-0900 Fix available 7.5 HighAugust 31, 2017
• hackerone rubygems, debian linux, redhat enterprise linux desktop +5 more +7 more RubyGems Code Injection vulnerability CVE-2017-0899 Fix available EPSS 11.1% 9.8 CriticalAugust 31, 2017
• rubygems, oracle solaris +1 more RubyGems Improper Input Validation vulnerability CVE-2015-4020 Fix available 4.3 MediumAugust 25, 2015
• ruby-lang ruby, rubygems, oracle solaris +1 more +3 more RubyGems vulnerable to DNS hijack attack CVE-2015-3900 Fix available 5.0 MediumJune 24, 2015
• ruby-lang ruby, rubygems +1 more RubyGems Regular Expression Denial of Service CVE-2013-4363 Fix available 4.3 MediumOctober 9, 2013
• ruby-lang ruby, rubygems, redhat enterprise linux +2 more RubyGems Regular Expression Denial of Service vulnerability CVE-2013-4287 Fix available 4.3 MediumOctober 9, 2013
• rubygems mini magick MiniMagick Gem for Ruby URI Handling Arbitrary Command Injection CVE-2013-2616 Fix available 7.5 HighMarch 20, 2013
• rubygems fastreader fastreader Gem for Ruby URI Handling Arbitrary Command Injection CVE-2013-2615 7.5 HighMarch 20, 2013
• rubygems command wrap Shell command injection in command_wrap CVE-2013-1875 7.5 HighMarch 20, 2013
• rubygems json gem JSON gem has Improper Input Validation vulnerability CVE-2013-0269 Public exploitFix available EPSS 13.9% 7.5 HighFebruary 12, 2013
• rubygems mail gem Mail Gem Improper Input Validation vulnerability CVE-2012-2140 Fix available 7.5 HighJuly 18, 2012
• rubygems mail gem Mail Gem Path Traversal vulnerability CVE-2012-2139 Fix available 5.0 MediumJuly 18, 2012
• rubygems RubyGems does not verify SSL certificate CVE-2012-2126 Fix available 4.3 MediumApril 20, 2012
• rubygems RubyGems HTTPS to HTTP redirect CVE-2012-2125 Fix available 5.8 MediumApril 20, 2012