Vulnerabilities

Filters

1 selected

37 records

Sort

Vendor: rubygems Clear all filters

TI-2024-23291 CVE-2024-35221

Denial of service when publishing a package on rubygems.org

LOW 21

Rubygems.org is the Ruby community's gem hosting service.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00494 Published 2024-05-29 Fixed in 2024-04-12 CWE-400

TI-2024-14379 CVE-2024-21654

rubygems.org MFA Bypass through password reset function could allow account takeover

MEDIUM 49

Rubygems.org is the Ruby community's gem hosting service.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0048 Published 2024-01-12 No fix listed CWE-287

TI-2023-21039 CVE-2023-40165

Unauthorized gem replacement for full names ending in numbers on rubygems.org

LOW 33

rubygems.org is the Ruby community's primary gem (library) hosting service.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00459 Published 2023-08-17 Fixed in 2023-08-14 CWE-20

TI-2022-16496 CVE-2022-36073

RubyGems allows creation of users with arbitrary unverified emails

MEDIUM 42

RubyGems.org is the Ruby community gem host.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01039 Published 2022-09-07 Fixed in 90c9e6a CWE-287

TI-2022-11761 CVE-2022-29218

Unauthorized takeover for new versions of some platform-specific gems

HIGH 67

RubyGems is a package registry used to supply software for the Ruby language ecosystem.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.01309 Published 2022-05-12 No fix listed CWE-269

TI-2022-11719 CVE-2022-29176

Unauthorized gem takeover for some gems on rubygems.org

MEDIUM 47

Rubygems is a package registry used to supply software for the Ruby language ecosystem.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.01938 Published 2022-05-05 No fix listed CWE-862

TI-2021-19615 CVE-2021-43809 · GHSA-fj7f-vq84-fh43

Local Code Execution through Argument Injection via dash leading git url parameter in Gemfile

LOW 37

`Bundler` is a package for managing application dependencies in Ruby.

CVSS 3.1HIGH 7.3 Local Low privileges User interaction EPSS 0.02909 Published 2021-12-08 Partial fix · 2.2.33 CWE-88

TI-2019-05974 CVE-2019-8321 · GHSA-fr32-gr5c-xq5c

An issue was discovered in RubyGems 2.6 and later through 3.0.2.

LOW 39

An issue was discovered in RubyGems 2.6 and later through 3.0.2.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03281 Published 2019-06-17 Partial fix · 2.7.9, 3.0.2 CWE-88

TI-2019-05975 CVE-2019-8322 · GHSA-mh37-8c3g-3fgc

An issue was discovered in RubyGems 2.6 and later through 3.0.2.

LOW 39

An issue was discovered in RubyGems 2.6 and later through 3.0.2.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03281 Published 2019-06-17 Partial fix · 2.7.9, 3.0.2 CWE-74

TI-2019-05976 CVE-2019-8323 · GHSA-3h4r-pjv6-cph9

An issue was discovered in RubyGems 2.6 and later through 3.0.2.

LOW 39

An issue was discovered in RubyGems 2.6 and later through 3.0.2.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03281 Published 2019-06-17 Partial fix · 2.7.9, 3.0.2 CWE-74

TI-2019-05978 CVE-2019-8325 · GHSA-4wm8-fjv7-j774

An issue was discovered in RubyGems 2.6 and later through 3.0.2.

LOW 39

An issue was discovered in RubyGems 2.6 and later through 3.0.2.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03281 Published 2019-06-17 Partial fix · 2.7.9, 3.0.2 CWE-74

TI-2019-05977 CVE-2019-8324 · GHSA-76wm-422q-92mq

An issue was discovered in RubyGems 2.6 and later through 3.0.2.

MEDIUM 44

An issue was discovered in RubyGems 2.6 and later through 3.0.2.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.03219 Published 2019-06-17 Fixed in 2.7.9, 3.0.2 CWE-94

TI-2019-05973 CVE-2019-8320 · GHSA-5x32-c9mf-49cc

A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2.

LOW 39

A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2.

CVSS 3.0HIGH 7.4 Network No auth No interaction EPSS 0.04193 Published 2019-06-06 Partial fix · 2.7.9, 3.0.3 CWE-22

TI-2018-15734 CVE-2018-1000079 · GHSA-8qxg-mff5-j3wc

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier…

LOW 30

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversa…

CVSS 3.0MEDIUM 5.5 Local No auth User interaction EPSS 0.02779 Published 2018-03-13 Partial fix · 2.7.6, 9.1.16.0 CWE-22

TI-2018-15733 CVE-2018-1000078 · GHSA-87qx-g5wg-mwmj

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier…

LOW 32

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripti…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.02749 Published 2018-03-13 Partial fix · 2.7.6, 9.1.16.0 CWE-79

TI-2018-15732 CVE-2018-1000077 · GHSA-gv86-43rv-79m2

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier…

LOW 30

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Val…

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.03595 Published 2018-03-13 Partial fix · 2.7.6, 9.1.16.0 CWE-20

TI-2018-15731 CVE-2018-1000076 · GHSA-mc6j-h948-v2p6

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier…

MEDIUM 47

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verificat…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02934 Published 2018-03-13 Partial fix · 2.7.6, 9.1.16.0 CWE-347

TI-2018-15730 CVE-2018-1000075 · GHSA-74pv-v9gh-h25p

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier…

MEDIUM 40

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caus…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.04736 Published 2018-03-13 Partial fix · 2.7.6, 9.1.16.0 CWE-835

TI-2018-15729 CVE-2018-1000074 · GHSA-qj2w-mw2r-pv39

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier…

LOW 39

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of…

CVSS 3.0HIGH 7.8 Local No auth User interaction EPSS 0.02881 Published 2018-03-13 Partial fix · 2.7.6, 9.1.16.0 CWE-502

TI-2018-15728 CVE-2018-1000073 · GHSA-gx69-6cp4-hxrj

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier…

MEDIUM 41

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversa…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.04905 Published 2018-03-13 Partial fix · 2.7.6, 9.1.16.0 CWE-59

TI-2017-00851 CVE-2017-0903 · GHSA-mqwr-4qf2-2hcv

Deserialization of untrusted data in HackerOne RubyGems

MEDIUM 58

RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.15853 Published 2017-10-11 Fixed in 2.6.14 CWE-502

TI-2017-00850 CVE-2017-0902 · GHSA-73w7-6w9g-gc8w

Origin validation error in HackerOne RubyGems

MEDIUM 43

RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls.

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.0475 Published 2017-08-31 Partial fix · 2.6.13 CWE-350

TI-2017-00849 CVE-2017-0901 · GHSA-pm9x-4392-2c2p

Path traversal in HackerOne RubyGems

MEDIUM 56

RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.29442 Published 2017-08-31 Partial fix · 2.6.13 CWE-22

TI-2017-00848 CVE-2017-0900 · GHSA-p7f2-rr42-m9xm

RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem…

MEDIUM 44

RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications to cause a denial of service attack against RubyGems clients who have issued a `query` command.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.08491 Published 2017-08-31 Partial fix · 2.6.13 CWE-20

TI-2017-00847 CVE-2017-0899 · GHSA-7gcp-2gmq-w3xh

Code injection in HackerOne RubyGems

MEDIUM 55

RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.11102 Published 2017-08-31 Partial fix · 2.6.13 CWE-150