Vulnerabilities

TI-2017-12350 CVE-2017-16792 · GHSA-653m-r33x-39ff

Stored cross-site scripting (XSS) vulnerability in "geminabox" (Gem in a Box) before…

LOW 29

Stored cross-site scripting (XSS) vulnerability in "geminabox" (Gem in a Box) before 0.13.10 allows attackers to inject arbitrary web script via the "homepage" value of a ".gemspec" file, related to views/gem.erb and vie…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01084 Published 2017-11-13 Fixed in 0.13.10 CWE-79

TI-2017-10753 CVE-2017-14683 · GHSA-qwv2-2x8g-g43g

geminabox (aka Gem in a Box) before 0.13.7 has CSRF, as demonstrated by an unintended gem upload.

LOW 39

geminabox (aka Gem in a Box) before 0.13.7 has CSRF, as demonstrated by an unintended gem upload.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00496 Published 2017-09-25 Fixed in 0.13.7 CWE-352

TI-2017-10608 CVE-2017-14506 · GHSA-98hq-3qvg-pg78

geminabox (aka Gem in a Box) before 0.13.6 has XSS, as demonstrated by uploading a gem…

LOW 26

geminabox (aka Gem in a Box) before 0.13.6 has XSS, as demonstrated by uploading a gem file that has a crafted gem.homepage value in its .gemspec file.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0068 Published 2017-09-25 Fixed in 0.13.6 CWE-79

Vulnerabilities

Filters

Stored cross-site scripting (XSS) vulnerability in "geminabox" (Gem in a Box) before…

geminabox (aka Gem in a Box) before 0.13.7 has CSRF, as demonstrated by an unintended gem upload.

geminabox (aka Gem in a Box) before 0.13.6 has XSS, as demonstrated by uploading a gem…