rubygems

Records37All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical5CVSS 9.0–10.0

CVSS high21CVSS 7.0–8.9

Exploited now

rubygems records in CISA KEV

No rubygems vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Rubygems 25 records MEDIUM Rubygems.org 4 records HIGH Mail Gem 2 records MEDIUM Command Wrap 1 record LOW Fastreader 1 record LOW Json Gem 1 record MEDIUM Mini Magick 1 record LOW

Records

37 records

TI-2022-11761 CVE-2022-29218

Unauthorized takeover for new versions of some platform-specific gems

HIGH 67

RubyGems is a package registry used to supply software for the Ruby language ecosystem.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.01309 Published 2022-05-12 No fix listed CWE-269

TI-2017-00851 CVE-2017-0903 · GHSA-mqwr-4qf2-2hcv

Deserialization of untrusted data in HackerOne RubyGems

MEDIUM 58

RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.15853 Published 2017-10-11 Fixed in 2.6.14 CWE-502

TI-2017-00849 CVE-2017-0901 · GHSA-pm9x-4392-2c2p

Path traversal in HackerOne RubyGems

MEDIUM 56

RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.29442 Published 2017-08-31 Partial fix · 2.6.13 CWE-22

TI-2017-00847 CVE-2017-0899 · GHSA-7gcp-2gmq-w3xh

Code injection in HackerOne RubyGems

MEDIUM 55

RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.11102 Published 2017-08-31 Partial fix · 2.6.13 CWE-150

TI-2024-14379 CVE-2024-21654

rubygems.org MFA Bypass through password reset function could allow account takeover

MEDIUM 49

Rubygems.org is the Ruby community's gem hosting service.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0048 Published 2024-01-12 No fix listed CWE-287

TI-2013-00203 CVE-2013-0269 · GHSA-x457-cw4h-hq5f

The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows…

MEDIUM 48

The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.13911 Published 2013-02-13 Partial fix · 1.5.5, 1.6.8 +1 CWE-20

TI-2022-11719 CVE-2022-29176

Unauthorized gem takeover for some gems on rubygems.org

MEDIUM 47

Rubygems is a package registry used to supply software for the Ruby language ecosystem.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.01938 Published 2022-05-05 No fix listed CWE-862

TI-2018-15731 CVE-2018-1000076 · GHSA-mc6j-h948-v2p6

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier…

MEDIUM 47

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verificat…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02934 Published 2018-03-13 Partial fix · 2.7.6, 9.1.16.0 CWE-347

TI-2019-05977 CVE-2019-8324 · GHSA-76wm-422q-92mq

An issue was discovered in RubyGems 2.6 and later through 3.0.2.

MEDIUM 44

An issue was discovered in RubyGems 2.6 and later through 3.0.2.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.03219 Published 2019-06-17 Fixed in 2.7.9, 3.0.2 CWE-94

TI-2017-00848 CVE-2017-0900 · GHSA-p7f2-rr42-m9xm

RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem…

MEDIUM 44

RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications to cause a denial of service attack against RubyGems clients who have issued a `query` command.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.08491 Published 2017-08-31 Partial fix · 2.6.13 CWE-20

TI-2017-00850 CVE-2017-0902 · GHSA-73w7-6w9g-gc8w

Origin validation error in HackerOne RubyGems

MEDIUM 43

RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls.

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.0475 Published 2017-08-31 Partial fix · 2.6.13 CWE-350

TI-2022-16496 CVE-2022-36073

RubyGems allows creation of users with arbitrary unverified emails

MEDIUM 42

RubyGems.org is the Ruby community gem host.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01039 Published 2022-09-07 Fixed in 90c9e6aac2d91518b479c51d48275c57de492d4d CWE-287

TI-2018-15728 CVE-2018-1000073 · GHSA-gx69-6cp4-hxrj

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier…

MEDIUM 41

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.04905 Published 2018-03-13 Partial fix · 2.7.6, 9.1.16.0 CWE-59

TI-2018-15730 CVE-2018-1000075 · GHSA-74pv-v9gh-h25p

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier…

MEDIUM 40

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.04736 Published 2018-03-13 Partial fix · 2.7.6, 9.1.16.0 CWE-835

TI-2012-01913 CVE-2012-2140 · GHSA-rp63-jfmw-532w

The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands…

MEDIUM 40

The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.04466 Published 2012-07-18 Partial fix · 2.4.3 CWE-20

TI-2019-05978 CVE-2019-8325 · GHSA-4wm8-fjv7-j774

An issue was discovered in RubyGems 2.6 and later through 3.0.2.

LOW 39

An issue was discovered in RubyGems 2.6 and later through 3.0.2.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03281 Published 2019-06-17 Partial fix · 2.7.9, 3.0.2 CWE-74

TI-2019-05976 CVE-2019-8323 · GHSA-3h4r-pjv6-cph9

An issue was discovered in RubyGems 2.6 and later through 3.0.2.

LOW 39

An issue was discovered in RubyGems 2.6 and later through 3.0.2.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03281 Published 2019-06-17 Partial fix · 2.7.9, 3.0.2 CWE-74

TI-2019-05975 CVE-2019-8322 · GHSA-mh37-8c3g-3fgc

An issue was discovered in RubyGems 2.6 and later through 3.0.2.

LOW 39

An issue was discovered in RubyGems 2.6 and later through 3.0.2.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03281 Published 2019-06-17 Partial fix · 2.7.9, 3.0.2 CWE-74

TI-2019-05974 CVE-2019-8321 · GHSA-fr32-gr5c-xq5c

An issue was discovered in RubyGems 2.6 and later through 3.0.2.

LOW 39

An issue was discovered in RubyGems 2.6 and later through 3.0.2.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03281 Published 2019-06-17 Partial fix · 2.7.9, 3.0.2 CWE-88

TI-2019-05973 CVE-2019-8320 · GHSA-5x32-c9mf-49cc

A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2.

LOW 39

A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2.

CVSS 3.0HIGH 7.4 Network No auth No interaction EPSS 0.04193 Published 2019-06-06 Partial fix · 2.7.9, 3.0.3 CWE-22

TI-2018-15729 CVE-2018-1000074 · GHSA-qj2w-mw2r-pv39

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier…

LOW 39

CVSS 3.0HIGH 7.8 Local No auth User interaction EPSS 0.02881 Published 2018-03-13 Partial fix · 2.7.6, 9.1.16.0 CWE-502

TI-2013-02303 CVE-2013-2616 · GHSA-w754-gq8r-pf5f

lib/mini_magick.rb in the MiniMagick Gem 1.3.1 for Ruby allows remote attackers to…

LOW 39

lib/mini_magick.rb in the MiniMagick Gem 1.3.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.03633 Published 2013-03-20 Fixed in 3.6.0 CWE-94

TI-2013-01656 CVE-2013-1875 · GHSA-p673-hjf2-pwfr

command_wrap.rb in the command_wrap Gem for Ruby allows remote attackers to execute…

LOW 39

command_wrap.rb in the command_wrap Gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL or filename.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.03633 Published 2013-03-20 No fix listed CWE-94

TI-2021-19615 CVE-2021-43809 · GHSA-fj7f-vq84-fh43

Local Code Execution through Argument Injection via dash leading git url parameter in Gemfile

LOW 37

`Bundler` is a package for managing application dependencies in Ruby.

CVSS 3.1HIGH 7.3 Local Low privileges User interaction EPSS 0.02909 Published 2021-12-08 Partial fix · 2.2.33 CWE-88

TI-2013-02302 CVE-2013-2615 · GHSA-w248-xr37-jx8m

lib/entry_controller.rb in the fastreader Gem 1.0.8 for Ruby allows remote attackers to…

LOW 37

lib/entry_controller.rb in the fastreader Gem 1.0.8 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02268 Published 2013-03-20 No fix listed CWE-94

Open these records in search →

Critical	5
High	21
Medium	11
Low	0
No CVSS	0