Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Advisory: HackerOne RubyGems — GLSA-201710-01 Clear all filters
TI-2017-00850 CVE-2017-0902 · GHSA-73w7-6w9g-gc8w

Origin validation error in HackerOne RubyGems

Priority MEDIUM 43

RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls.

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.0475 Published 2017-08-31 Partial fix · 2.6.13 CWE-350
TI-2017-00849 CVE-2017-0901 · GHSA-pm9x-4392-2c2p

Path traversal in HackerOne RubyGems

Priority MEDIUM 56

RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.29442 Published 2017-08-31 Partial fix · 2.6.13 CWE-22
TI-2017-00847 CVE-2017-0899 · GHSA-7gcp-2gmq-w3xh

Code injection in HackerOne RubyGems

Priority MEDIUM 55

RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.11102 Published 2017-08-31 Partial fix · 2.6.13 CWE-150