TI-2021-19615 CVE-2021-43809 · GHSA-fj7f-vq84-fh43
Local Code Execution through Argument Injection via dash leading git url parameter in Gemfile
Priority LOW 37
`Bundler` is a package for managing application dependencies in Ruby.
Vulnerabilities
5 records
TI-2020-18610 CVE-2020-36327 · GHSA-fp4w-jxhp-m23p
Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency…
Priority MEDIUM 49
Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the inten…
TI-2019-02891 CVE-2019-3881 · GHSA-g98m-96g9-wfjq
Uncontrolled search path in rubygem-bundler
Priority LOW 35
Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available.
TI-2016-06685 CVE-2016-7954 · GHSA-jvgm-pfqv-887x
Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an…
Priority MEDIUM 53
Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source.
TI-2013-00264 CVE-2013-0334 · GHSA-49jx-9cmc-xjxm
Bundler before 1.7, when multiple top-level source lines are used, allows remote…
Priority LOW 30
Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source.