Vendors / ruby Records 136 All Threatist records
Exploited (KEV) 1
CVSS critical 18
CVSS high 49
Exploited now ruby records in CISA KEV
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 50
CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of bytes.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04898 · Published 2022-02-06 · Fixed in 0.3.1, 0.2.1 +1 CWE-190
Priority MEDIUM 43
The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting.
CVSS 3.1 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.02452 · Published 2022-11-18 · Partial fix · 0.3.5, 0.2.2 +1 CWE-74
Priority LOW 39
CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.03151 · Published 2022-01-01 · Partial fix · 0.3.1, 0.2.1 +1 CWE-565
Priority LOW 34
In the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the Util#escapeElement method.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.0076 · Published 2025-03-03 · Partial fix · 0.3.5.1, 0.3.7 +1 CWE-1333
Priority LOW 34
In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service (DoS) vulnerability.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.00849 · Published 2025-03-03 · Partial fix · 0.3.5.1, 0.3.7 +1 CWE-770
Open these records in search → All records by CVSS severity
18 49 62 7 0
THREATIST.IORead the docs