Read the docs

rubygems

Records37All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical5CVSS 9.0–10.0
CVSS high21CVSS 7.0–8.9

Exploited now

rubygems records in CISA KEV

No rubygems vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Rubygems 25 records MEDIUM Rubygems.org 4 records HIGH Mail Gem 2 records MEDIUM Command Wrap 1 record LOW Fastreader 1 record LOW Json Gem 1 record MEDIUM Mini Magick 1 record LOW

Records

25 records in Rubygems · all components

TI-2017-00851 CVE-2017-0903 · GHSA-mqwr-4qf2-2hcv

Deserialization of untrusted data in HackerOne RubyGems

Priority MEDIUM 58

RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.15853 Published 2017-10-11 Fixed in 2.6.14 CWE-502
TI-2017-00849 CVE-2017-0901 · GHSA-pm9x-4392-2c2p

Path traversal in HackerOne RubyGems

Priority MEDIUM 56

RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.29442 Published 2017-08-31 Partial fix · 2.6.13 CWE-22
TI-2017-00847 CVE-2017-0899 · GHSA-7gcp-2gmq-w3xh

Code injection in HackerOne RubyGems

Priority MEDIUM 55

RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.11102 Published 2017-08-31 Partial fix · 2.6.13 CWE-150
TI-2018-15731 CVE-2018-1000076 · GHSA-mc6j-h948-v2p6

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier…

Priority MEDIUM 47

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verificat…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02934 Published 2018-03-13 Partial fix · 2.7.6, 9.1.16.0 CWE-347
TI-2017-00848 CVE-2017-0900 · GHSA-p7f2-rr42-m9xm

RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem…

Priority MEDIUM 44

RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications to cause a denial of service attack against RubyGems clients who have issued a `query` command.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.08491 Published 2017-08-31 Partial fix · 2.6.13 CWE-20
TI-2017-00850 CVE-2017-0902 · GHSA-73w7-6w9g-gc8w

Origin validation error in HackerOne RubyGems

Priority MEDIUM 43

RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls.

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.0475 Published 2017-08-31 Partial fix · 2.6.13 CWE-350
TI-2018-15728 CVE-2018-1000073 · GHSA-gx69-6cp4-hxrj

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier…

Priority MEDIUM 41

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversa…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.04905 Published 2018-03-13 Partial fix · 2.7.6, 9.1.16.0 CWE-59
TI-2018-15730 CVE-2018-1000075 · GHSA-74pv-v9gh-h25p

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier…

Priority MEDIUM 40

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caus…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.04736 Published 2018-03-13 Partial fix · 2.7.6, 9.1.16.0 CWE-835
TI-2018-15729 CVE-2018-1000074 · GHSA-qj2w-mw2r-pv39

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier…

Priority LOW 39

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of…

CVSS 3.0HIGH 7.8 Local No auth User interaction EPSS 0.02881 Published 2018-03-13 Partial fix · 2.7.6, 9.1.16.0 CWE-502
TI-2015-03307 CVE-2015-3900 · GHSA-wp3j-rvfp-624h

RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not…

Priority LOW 34

RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains v…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.08871 Published 2015-06-24 Partial fix · 2.0.16, 2.2.4 +1 CWE-254
TI-2018-15733 CVE-2018-1000078 · GHSA-87qx-g5wg-mwmj

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier…

Priority LOW 32

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripti…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.02749 Published 2018-03-13 Partial fix · 2.7.6, 9.1.16.0 CWE-79
TI-2018-15734 CVE-2018-1000079 · GHSA-8qxg-mff5-j3wc

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier…

Priority LOW 30

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversa…

CVSS 3.0MEDIUM 5.5 Local No auth User interaction EPSS 0.02779 Published 2018-03-13 Partial fix · 2.7.6, 9.1.16.0 CWE-22
TI-2018-15732 CVE-2018-1000077 · GHSA-gv86-43rv-79m2

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier…

Priority LOW 30

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Val…

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.03595 Published 2018-03-13 Partial fix · 2.7.6, 9.1.16.0 CWE-20
TI-2015-03390 CVE-2015-4020 · GHSA-qv62-xfj6-32xm

RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.4.x before 2.4.8 does not…

Priority LOW 26

RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.4.x before 2.4.8 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains v…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.03461 Published 2015-08-25 Fixed in 2.0.17, 2.2.5 +1 CWE-20
TI-2013-03753 CVE-2013-4287 · GHSA-9j7m-rjqx-48vh

Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in…

Priority LOW 26

Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 throu…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.03331 Published 2013-10-17 Partial fix · 1.8.23.1, 1.8.26 +2 CWE-310
TI-2013-03822 CVE-2013-4363 · GHSA-9qvm-2vhf-q649

Algorithmic complexity vulnerability in Gem::Version::ANCHORED_VERSION_PATTERN in…

Priority LOW 23

Algorithmic complexity vulnerability in Gem::Version::ANCHORED_VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.2, 1.8.24 through 1.8.26, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, as used in Ruby 1…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.0169 Published 2013-10-17 Fixed in 1.8.23.2, 1.8.27 +2 CWE-310
Open these records in search →