Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

rubygems Security Advisories

Loading...
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLW1oMzctOGMzZy0zZmdj
RubyGems Escape sequence injection vulnerability in gem owner
Ecosystems: rubygems
Packages: rubygems-update
Source: GitHub Advisory Database
Blast Radius: 15.4
Published: almost 5 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXd3bWYtNnA1OC02dmoy
Remote code execution in rwiki
Ecosystems: rubygems
Packages: rwiki
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLW1ocHAtODc1dy05Y3B2
Denial of Service in jquery
Ecosystems: rubygems, maven, nuget, npm
Packages: jquery-rails, org.webjars.npm:jquery, jQuery, jquery
Source: GitHub Advisory Database
Blast Radius: 129.0
Published: over 6 years ago
High
GSA_kwCzR0hTQS03bTJ3LTlndzctYzN4cM31tA
open-uri-cached Gem for Ruby Unsafe Temporary File Creation Enables Code Execution
Ecosystems: rubygems
Packages: open-uri-cached
Source: GitHub Advisory Database
Blast Radius: 22.0
Published: about 2 years ago
High
GSA_kwCzR0hTQS1qbTc5LTlwbTQtdnJ3Oc4AA0m2
Decidim vulnerable to sensitive data disclosure
Ecosystems: rubygems
Packages: decidim-meetings, decidim
Source: GitHub Advisory Database
Blast Radius: 18.7
Published: 10 months ago
High
GSA_kwCzR0hTQS13cnJ3LWNycDgtOTc5cc4AAuzs
Pageflow vulnerable to sensitive user data extraction via Ransack query injection
Ecosystems: rubygems
Packages: pageflow
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 1 year ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXhmOTYtMzJxMi05cncy
Rails ActiveRecord gem vulnerable to SQL injection
Ecosystems: rubygems
Packages: activerecord
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWg1ZzItMzh4OS00Z3Yz
archive-tar-minitar and minitar vulnerable to Path Traversal
Ecosystems: rubygems
Packages: minitar, archive-tar-minitar
Source: GitHub Advisory Database
Blast Radius: 30.3
Published: over 6 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXJwNjMtamZtdy01MzJ3
Mail Gem Improper Input Validation vulnerability
Ecosystems: rubygems
Packages: mail
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXE5N3YtNzY0Zy1yMnJw
gollum and gollum-lib allow remote authenticated users to execute arbitrary code
Ecosystems: rubygems
Packages: gollum-lib, gollum
Source: GitHub Advisory Database
Blast Radius: 26.3
Published: over 6 years ago
High
GSA_kwCzR0hTQS1jZmdwLTI5NzctMmZtbc4AA0N9
Connection confusion in gRPC
Ecosystems: rubygems, pypi, maven
Packages: grpc, grpcio, io.grpc:grpc-protobuf
Source: GitHub Advisory Database
Blast Radius: 88.5
Published: 11 months ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXZxY20tN2Y3Zi1yNTM5
brbackup exposes database password to unauthorized users
Ecosystems: rubygems
Packages: brbackup
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: about 6 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTZmY3EtM2NtMi1qM2o1
Kcapifony gem for Ruby places database user passwords on the command line
Ecosystems: rubygems
Packages: kcapifony
Source: GitHub Advisory Database
Blast Radius: 1.0
Published: almost 6 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXEycXctcm1yaC12djQy
Improper Access Control in activejob
Ecosystems: rubygems
Packages: activejob
Source: GitHub Advisory Database
Blast Radius: 42.8
Published: over 5 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWhqZzQtOHE1Zi14NmZt
Action Pack contains Information Disclosure / Unintended Method Execution vulnerability
Ecosystems: rubygems
Packages: actionpack
Source: GitHub Advisory Database
Blast Radius: 44.6
Published: about 3 years ago
High
GSA_kwCzR0hTQS01eDc5LXc4MmYtZ3c4d84AAwSf
Inefficient Regular Expression Complexity in rails-html-sanitizer
Ecosystems: rubygems
Packages: rails-html-sanitizer
Source: GitHub Advisory Database
Blast Radius: 42.9
Published: over 1 year ago
High
GSA_kwCzR0hTQS00ODZmLWhqajktOXZoaM4AAwSc
Inefficient Regular Expression Complexity in Loofah
Ecosystems: rubygems
Packages: loofah
Source: GitHub Advisory Database
Blast Radius: 42.9
Published: over 1 year ago
High
GSA_kwCzR0hTQS05cDU3LWg5ODctNHZneM4AA7eG
Phlex vulnerable to Cross-site Scripting (XSS) via maliciously formed HTML attribute names and values
Ecosystems: rubygems
Packages: phlex
Source: GitHub Advisory Database
Blast Radius: 8.7
Published: 14 days ago
High
GSA_kwCzR0hTQS12NmdwLTltbW0tYzZwNc054w
Out-of-bounds Write in zlib affects Nokogiri
Ecosystems: rubygems
Packages: nokogiri
Source: GitHub Advisory Database
Blast Radius: 45.3
Published: about 2 years ago
High
GSA_kwCzR0hTQS01NjUyLTkycjktM2Z4Oc4AA0m4
Decidim Cross-site Scripting vulnerability in the processes filter
Ecosystems: rubygems
Packages: decidim-core, decidim
Source: GitHub Advisory Database
Blast Radius: 20.2
Published: 10 months ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWNyM3gtN20zOS1jNmpx
Remote code execution via user-provided local names in ActionView
Ecosystems: rubygems
Packages: actionview
Source: GitHub Advisory Database
Blast Radius: 50.9
Published: almost 4 years ago
High
GSA_kwCzR0hTQS1odjVqLTNoOWYtOTljMs4AAyes
Ruby URI component ReDoS issue
Ecosystems: rubygems
Packages: uri
Source: GitHub Advisory Database
Blast Radius: 23.0
Published: about 1 year ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXA2NzMtaGpmMi1wd2Zy
Shell command injection in command_wrap
Ecosystems: rubygems
Packages: command_wrap
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXEyN2YtdjNyNi05djc3
Improper Certificate Validation in EM-HTTP-Request
Ecosystems: rubygems
Packages: em-http-request
Source: GitHub Advisory Database
Blast Radius: 29.2
Published: almost 3 years ago
High
GSA_kwCzR0hTQS00aG05LTg0NGotam14cM4AAhJW
Uninitialized read in Nokogiri gem
Ecosystems: rubygems
Packages: nokogiri
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: almost 2 years ago
High
GSA_kwCzR0hTQS01MjdyLW1mbWotcHJxZs4AATl1
Katello SQL Injection vulnerabilities
Ecosystems: rubygems
Packages: katello
Source: GitHub Advisory Database
Blast Radius: 8.8
Published: about 2 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTU3NHEtZnhmai13djZo
Puppet Improper Input Validation vulnerability
Ecosystems: rubygems
Packages: puppet
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
High
GSA_kwCzR0hTQS14Z3Y3LXBxcWgtaDJ3Oc4AAxEu
jruby-openssl gem for JRuby fails to do proper certificate validation
Ecosystems: rubygems
Packages: jruby-openssl
Source: GitHub Advisory Database
Blast Radius: 30.3
Published: over 1 year ago
High
GSA_kwCzR0hTQS03N2g4LXhyODUtM3g1cc4AARcM
hammer_cli_foreman Improper Certificate Validation vulnerability
Ecosystems: rubygems
Packages: hammer_cli_foreman
Source: GitHub Advisory Database
Blast Radius: 11.7
Published: about 2 years ago
High
GSA_kwCzR0hTQS1ocTdwLWozNzctNnY2M84AAxDu
SQL Injection Vulnerability via ActiveRecord comments
Ecosystems: rubygems
Packages: activerecord
Source: GitHub Advisory Database
Blast Radius: 52.4
Published: over 1 year ago
High
GSA_kwCzR0hTQS04OTM2LWNnajQtcGhyMs4AAXa1
Echor contains Command Injection
Ecosystems: rubygems
Packages: echor
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: about 2 years ago
High
GSA_kwCzR0hTQS02OXAzLXhwMzctZjY5Ms015g
Improper Certificate Validation in kubeclient
Ecosystems: rubygems
Packages: kubeclient
Source: GitHub Advisory Database
Blast Radius: 25.2
Published: about 2 years ago
High
GSA_kwCzR0hTQS03NDZnLTNnZnAtaGZod84AAxNH
Devise Gem for Ruby Unauthorized Access Using "Remember Me" Cookie
Ecosystems: rubygems
Packages: devise
Source: GitHub Advisory Database
Blast Radius: 40.2
Published: over 1 year ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTJqOWMtOXZtdi03bTM5
Missing Regex anchor in Rack-Cors allows malicious third party site to perform CORS request
Ecosystems: rubygems
Packages: rack-cors
Source: GitHub Advisory Database
Blast Radius: 40.9
Published: almost 6 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTk0Y3EtN2NjcS1jbWNt
lynx doesn't properly sanitize user input and exposes database password to unauthorized users
Ecosystems: rubygems
Packages: lynx
Source: GitHub Advisory Database
Blast Radius: 13.3
Published: over 6 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXFoNHctN3B3My1wNHJw
BSON rubygem contains potential denial of service
Ecosystems: rubygems
Packages: bson
Source: GitHub Advisory Database
Blast Radius: 32.2
Published: about 4 years ago
High
GSA_kwCzR0hTQS01ZzY2LTYyOGYtN2N2as4AA4Lx
Omniauth::MicrosoftGraph Account takeover (nOAuth)
Ecosystems: rubygems
Packages: omniauth-microsoft_graph
Source: GitHub Advisory Database
Blast Radius: 9.0
Published: 4 months ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTJ4dmotajNxaC14OGMz
private_address_check contains race condition
Ecosystems: rubygems
Packages: private_address_check
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: almost 6 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTVwbTgtNDkyYy05MnA1
Prototype Pollution in chartkick
Ecosystems: npm, rubygems
Packages: chartkick
Source: GitHub Advisory Database
Blast Radius: 52.1
Published: over 4 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLThjcjgtNHZmdy1tcjdo
REXML round-trip instability
Ecosystems: rubygems
Packages: rexml
Source: GitHub Advisory Database
Blast Radius: 40.7
Published: about 3 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXJoZ3EtdnY5eC1qNHA1
lawn-login exposes database password to unauthorized users
Ecosystems: rubygems
Packages: lawn-login
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
High
GSA_kwCzR0hTQS01Nzl3LTIyajQtNDc0Oc4AAxDw
Denial of Service Vulnerability in ActiveRecord's PostgreSQL adapter
Ecosystems: rubygems
Packages: activerecord
Source: GitHub Advisory Database
Blast Radius: 44.7
Published: over 1 year ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWdneG0tcGdjOS1nN2Zw
Arbitrary Code Execution in Rdoc
Ecosystems: rubygems
Packages: rdoc
Source: GitHub Advisory Database
Blast Radius: 39.7
Published: over 2 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWd3cmotODhmcC01bTM2
Code injection in Narou
Ecosystems: rubygems
Packages: narou
Source: GitHub Advisory Database
Blast Radius: 2.6
Published: almost 3 years ago
High
GSA_kwCzR0hTQS00dmY0LXFtdmctbWg3aM0gHQ
Cookie Prefix Spoofing in CGI::Cookie.parse
Ecosystems: rubygems
Packages: cgi
Source: GitHub Advisory Database
Blast Radius: 20.2
Published: over 2 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXd3aDctNGp3OS0zM3g2
yajl-ruby gem Denial of Service vulnerability
Ecosystems: rubygems
Packages: yajl-ruby
Source: GitHub Advisory Database
Blast Radius: 34.9
Published: over 6 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTk0aG0tOHE2NS1ybXht
OmniAuth-SAML authentication bypass via incorrect XML canonicalization and DOM traversal
Ecosystems: rubygems
Packages: omniauth-saml
Source: GitHub Advisory Database
Blast Radius: 25.2
Published: almost 5 years ago
High
GSA_kwCzR0hTQS12YzQ3LTZycWctYzdmNc4AAv82
HTTP response splitting in CGI
Ecosystems: rubygems
Packages: cgi
Source: GitHub Advisory Database
Blast Radius: 23.7
Published: over 1 year ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTc1NTMtanI5OC12eDQ3
libxml as used in Nokogiri has an infinite loop in a certain end-of-file situation
Ecosystems: rubygems
Packages: nokogiri
Source: GitHub Advisory Database
Blast Radius: 45.3
Published: about 4 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWh4eDYtcDI0di13Zzhj
Curl Gem insufficient URL escaping command injection
Ecosystems: rubygems
Packages: curl
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXd3NHgtcndxNi1xcGdm
OmniAuth Ruby gem Cross-site Request Forgery in request phase
Ecosystems: rubygems
Packages: omniauth
Source: GitHub Advisory Database
Blast Radius: 41.7
Published: almost 5 years ago
High
GSA_kwCzR0hTQS00d2hmLXJteDUtOGZyds4AAwZi
active_attr Improper Resource Shutdown or Release vulnerability
Ecosystems: rubygems
Packages: active_attr
Source: GitHub Advisory Database
Blast Radius: 23.5
Published: over 1 year ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTRjNHctM3E0NS1ocDlq
Aescrypt does not sufficiently use random values
Ecosystems: rubygems
Packages: aescrypt
Source: GitHub Advisory Database
Blast Radius: 15.0
Published: over 6 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLW03ZnEtY2Y4cS0zNXE3
crack does not properly restrict casts of string values
Ecosystems: rubygems
Packages: crack
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
High
GSA_kwCzR0hTQS12Y21tLXBwcXgtOTVjaM4AATXo
Logstash Logs Sensitive Information
Ecosystems: rubygems
Packages: logstash-core
Source: GitHub Advisory Database
Blast Radius: 22.7
Published: about 2 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTdmcWotY2c3OS1mMnB2
Thumbshooter vulnerable to Code Injection
Ecosystems: rubygems
Packages: thumbshooter
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
High
GSA_kwCzR0hTQS1oeHF4LXh3dmgtNDRtMs4AArQW
Denial of Service Vulnerability in Rack Multipart Parsing
Ecosystems: rubygems
Packages: rack
Source: GitHub Advisory Database
Blast Radius: 45.1
Published: almost 2 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTNoNHItcGp2Ni1jcGg5
RubyGems Escape sequence injection vulnerability in api response handling
Ecosystems: rubygems
Packages: rubygems-update
Source: GitHub Advisory Database
Blast Radius: 15.4
Published: almost 5 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXBmNm0tZnhwcS1mZzh2
Nokogiri implementation of libxslt lacks integer overflow checks
Ecosystems: rubygems
Packages: nokogiri
Source: GitHub Advisory Database
Blast Radius: 53.1
Published: almost 6 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWc4d3ctNDZ4Mi0ycDY1
Denial of Service in Action Dispatch
Ecosystems: rubygems
Packages: actionpack
Source: GitHub Advisory Database
Blast Radius: 44.6
Published: about 3 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTR3bTgtZmp2Ny1qNzc0
RubyGems Escape sequence injection in errors
Ecosystems: rubygems
Packages: rubygems-update
Source: GitHub Advisory Database
Blast Radius: 15.4
Published: almost 5 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWdqNHAtM3doMy0ycm1m
Arbitrary file read vulnerability in yard server
Ecosystems: rubygems
Packages: yard
Source: GitHub Advisory Database
Blast Radius: 35.6
Published: over 6 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXFyZ2YtanFxbS14N3h2
Code injection in dragonfly gem
Ecosystems: rubygems
Packages: fog-dragonfly, dragonfly
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWhnNzgtNGY2eC05OXdx
Rack vulnerable to Denial of Service
Ecosystems: rubygems
Packages: rack
Source: GitHub Advisory Database
Blast Radius: 45.1
Published: over 5 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTJoeHYtbXg4eC1tY2o5
Spina gem vulnerable to Cross-site request forgery (CSRF) vulnerability
Ecosystems: rubygems
Packages: spina
Source: GitHub Advisory Database
Blast Radius: 15.8
Published: over 5 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXhqcWctOWp2Zy1mZ3gy
Nokogiri subject to DoS via libxml2 vulnerability
Ecosystems: rubygems
Packages: nokogiri
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 5 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLW1neDMtMjdoci1tZmdw
HTTParty does not restrict casts of string values
Ecosystems: rubygems
Packages: httparty
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTUycDktdjc0NC1td2pq
Remote code execution in Kramdown
Ecosystems: rubygems
Packages: kramdown
Source: GitHub Advisory Database
Blast Radius: 55.7
Published: about 3 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXI4ZmgtaHEycC03cWhx
Active Record contains SQL Injection via improper range quoting
Ecosystems: rubygems
Packages: activerecord
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
High
GSA_kwCzR0hTQS13cDNqLXJ2ZnAtNjI0aM4AATla
RubyGems vulnerable to DNS hijack attack
Ecosystems: rubygems
Packages: rubygems-update
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: about 2 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTcycmotMzZxYy00N2c3
Pgsync Contains Cleartext Transmission of Sensitive Information
Ecosystems: rubygems
Packages: pgsync
Source: GitHub Advisory Database
Blast Radius: 20.7
Published: about 3 years ago
High
GSA_kwCzR0hTQS14M3JxLXIzY20tNXZjNM0psw
Publify Business Logic Errors
Ecosystems: rubygems
Packages: publify_core
Source: GitHub Advisory Database
Blast Radius: 6.8
Published: over 2 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWZyMzItZ3I1Yy14cTVj
RubyGems Escape sequence injection vulnerability in verbose
Ecosystems: rubygems
Packages: rubygems-update
Source: GitHub Advisory Database
Blast Radius: 15.4
Published: almost 5 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTQ5MzYtcmoyNS02d202
nori contains Improper Input Validation
Ecosystems: rubygems
Packages: nori
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
High
GSA_kwCzR0hTQS1wMjVtLWpwajQtcWNycs4AA127
Denial of Service Vulnerability in gRPC TCP Server (Posix-compatible platforms)
Ecosystems: pypi, rubygems
Packages: grpcio, grpc
Source: GitHub Advisory Database
Blast Radius: 61.2
Published: 8 months ago
High
GSA_kwCzR0hTQS1nd2ZnLWNxbWctY2Y4Zs4AAmJ3
WEBRick vulnerable to HTTP Request/Response Smuggling
Ecosystems: rubygems
Packages: webrick
Source: GitHub Advisory Database
Blast Radius: 35.0
Published: almost 2 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTM4OTItMnI1Mi1wNjVt
HTTP Request Smuggling in goliath
Ecosystems: rubygems
Packages: goliath
Source: GitHub Advisory Database
Blast Radius: 18.7
Published: almost 3 years ago
High
GSA_kwCzR0hTQS13cnhmLXg4cm0tNmdnZ84AAyiM
Fluent Fluentd and Fluent-ui use default password
Ecosystems: rubygems
Packages: fluentd-ui, fluentd
Source: GitHub Advisory Database
Blast Radius: 30.7
Published: about 1 year ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTloNmctZ3A5NS14M3E1
actionpack is vulnerable to denial of service because of a wildcard controller route
Ecosystems: rubygems
Packages: actionpack
Source: GitHub Advisory Database
Blast Radius: 44.6
Published: over 6 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWZmcHYtYzRobS0zeDZ2
actionpack is vulnerable to denial of service via a crafted HTTP Accept header
Ecosystems: rubygems
Packages: actionpack
Source: GitHub Advisory Database
Blast Radius: 44.6
Published: over 6 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLThoYzQteHhtMy01cHBw
Active Record subject to Regular Expression Denial-of-Service (ReDoS)
Ecosystems: rubygems
Packages: activerecord
Source: GitHub Advisory Database
Blast Radius: 44.7
Published: about 3 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXFycW0tZnB2Ni02cjhn
Command Injection Vulnerability in Mechanize
Ecosystems: rubygems
Packages: mechanize
Source: GitHub Advisory Database
Blast Radius: 29.4
Published: over 3 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTlwcjYtZ3JmNC14MmZy
Omniauth allows POST parameters to be stored in session
Ecosystems: rubygems
Packages: omniauth
Source: GitHub Advisory Database
Blast Radius: 35.5
Published: over 6 years ago
High
GSA_kwCzR0hTQS14Z3d3LWg5OGYtMjRxZs4AAoS0
Metasploit Framework user exposes Metasploit to same deserialization issue that is exploited by that module
Ecosystems: rubygems
Packages: metasploit-framework
Source: GitHub Advisory Database
Blast Radius: 23.6
Published: almost 2 years ago
High
GSA_kwCzR0hTQS1jZjQ2LTZ4eGgtcGM3Nc4AAhJV
libxslt Type Confusion vulnerability that affects Nokogiri
Ecosystems: rubygems
Packages: nokogiri
Source: GitHub Advisory Database
Blast Radius: 45.3
Published: almost 2 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTR4amgtbTNxeC00OXdj
Jekyll allows attackers to access arbitrary files by specifying a symlink
Ecosystems: rubygems
Packages: jekyll
Source: GitHub Advisory Database
Blast Radius: 42.7
Published: over 5 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTJndzItOHE5dy1jdzhw
Ruby-ffi has a DLL loading issue
Ecosystems: rubygems
Packages: ffi
Source: GitHub Advisory Database
Blast Radius: 46.7
Published: over 5 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXEyOG0tOHhqdy04dnI1
Puma's Keepalive Connections Causing Denial Of Service
Ecosystems: rubygems
Packages: puma
Source: GitHub Advisory Database
Blast Radius: 42.1
Published: almost 3 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTV4MzItYzltZi00OWNj
RubyGems Delete directory using symlink when decompressing tar
Ecosystems: rubygems
Packages: rubygems-update
Source: GitHub Advisory Database
Blast Radius: 15.2
Published: almost 5 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTM2cDcteGp3OC1oNmYy
Ruby-saml allows attackers to perform XML signature wrapping attacks
Ecosystems: rubygems
Packages: ruby-saml
Source: GitHub Advisory Database
Blast Radius: 25.2
Published: over 5 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTY5NG0tamhyOS1wZjc3
Doorkeeper subject to Incorrect Permission Assignment
Ecosystems: rubygems
Packages: doorkeeper
Source: GitHub Advisory Database
Blast Radius: 28.0
Published: almost 6 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXgzdjQtcHh2bS02M2o4
HTTP Request Smuggling in reel
Ecosystems: rubygems
Packages: reel
Source: GitHub Advisory Database
Blast Radius: 17.7
Published: almost 3 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXB4cXItOHY1NC1tMmhq
Cross-site request forgery in rails_admin
Ecosystems: rubygems
Packages: rails_admin
Source: GitHub Advisory Database
Blast Radius: 34.9
Published: almost 6 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWc5OG0tOTZnOS13Zmpx
Insecure path handling in Bundler
Ecosystems: rubygems
Packages: bundler
Source: GitHub Advisory Database
Blast Radius: 37.5
Published: about 3 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWY5M2otaG1jci1qY3do
Moped Rubygem Data Injection Vulnerability
Ecosystems: rubygems
Packages: moped
Source: GitHub Advisory Database
Blast Radius: 29.4
Published: over 3 years ago
High
GSA_kwCzR0hTQS1yNThyLTc0Z3gtNnd4M84AAVTq
Nokogiri gem, via libxml, is affected by DoS vulnerabilities
Ecosystems: rubygems
Packages: nokogiri
Source: GitHub Advisory Database
Blast Radius: 53.1
Published: about 2 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTczMjItOW14Ni01ajJt
redcarpet Buffer Overflow vulnerability
Ecosystems: rubygems
Packages: redcarpet
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 5 years ago
High
GSA_kwCzR0hTQS05OHd4LWN3ODYtYzk3eM3xGg
mixlib-archive Path Traversal vulnerability
Ecosystems: rubygems
Packages: mixlib-archive
Source: GitHub Advisory Database
Blast Radius: 23.1
Published: about 2 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWYycnAtNHJ2Ny1mYzk1
Exposure of Sensitive Information to an Unauthorized Actor in foreman_fog_proxmox
Ecosystems: rubygems
Packages: foreman_fog_proxmox
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: almost 3 years ago
High
GSA_kwCzR0hTQS1qcmZqLTk4cWctcWpnds0lug
Denial of service in sidekiq
Ecosystems: rubygems
Packages: sidekiq
Source: GitHub Advisory Database
Blast Radius: 33.0
Published: over 2 years ago
Statistics
Advisories: 18,745
Packages: 8,373
Repositories: 285
Ecosystems: 12
Filter by Package
actionpack 57 nokogiri 44 rubygems-update 25 puppet 23 rack 22 activerecord 21 publify_core 14 activesupport 14 passenger 13 actionview 12 rails 11 puma 11 fat_free_crm 10 jquery-rails 9 rails-html-sanitizer 9 jquery 8 org.webjars.npm:jquery 8 decidim 7 jQuery.UI.Combined 7 org.webjars.npm:jquery-ui 7 jQuery 7 org.jruby:jruby-stdlib 7 jquery-ui-rails 7 jquery-ui 7 camaleon_cms 6 loofah 6 katello 6 doorkeeper 6 ember-source 6 bundler 5 spree 5 sidekiq 5 commonmarker 5 spree_auth_devise 5 grpc 4 grpcio 4 sanitize 4 carrierwave 4 webrick 4 sinatra 4 devise 4 fluentd 4 mail 4 avo 4 dragonfly 4 activestorage 4 bootstrap 3 decidim-core 3 chartkick 3 openssl 3 rubyzip 3 geminabox 3 resque 3 ruby-saml 3 rdoc 3 yard 3 cgi 3 omniauth 3 bootstrap 3 rest-client 3 gollum 3 json-jwt 3 rails_admin 3 git 3 rack-cors 3 phlex 3 io.grpc:grpc-protobuf 3 private_address_check 3 bson 2 sprockets 2 json 2 safemode 2 mapbox.js 2 twitter-bootstrap-rails 2 mini_magick 2 ox 2 sup 2 net-ldap 2 echor 2 paperclip 2 omniauth-facebook 2 user_agent_parser 2 field_test 2 solidus_core 2 faye 2 view_component 2 pghero 2 uri 2 cocoapods-downloader 2 solidus_frontend 2 spina 2 devise-two-factor 2 redcarpet 2 kramdown 2 i18n 2 httparty 2 VladTheEnterprising 2 pdfkit 2 red-arrow 2 pyarrow 2 radiant 2 activeadmin 2 mechanize 2 logstash-core 2 google-protobuf 2 git-fastclone 2 administrate 2 pageflow 2 com.google.protobuf:protobuf-kotlin 2 yajl-ruby 2 decidim-templates 2 qiita-markdown 2 mapbox-rails 2 bootstrap-sass 2 ruby-openid 2 facter 2 secure_headers 2 com.google.protobuf:protobuf-java 2 foreman_ansible 1 geokit-rails 1 blazer 1 multi_xml 1 rmagick 1 keynote 1 twitter-stream 1 gitlab-grit 1 solidus_auth_devise 1 pysha3 1 brbackup 1 mcollective-client 1 wicked 1 actionmailer 1 kelredd-pruview 1 hiera 1 hub 1 sqlite3-ruby 1 thin 1 github.com/github/hub 1 websocket-extensions 1 rack-mini-profiler 1 ruby-jss 1 matestack-ui-core 1 cap-strap 1 railties 1 sha3 1 restforce 1 solidus_backend 1 better_errors 1 mongrel 1 unpoly-rails 1 bindata 1 oxidized-web 1 github.com/pubnub/swift 1 pubnub 1 pubnub 1 pubnub/pubnub 1 pubnub 1 pubnub 1 Pubnub 1 github.com/pubnub/go/v5 1 github.com/pubnub/go/v6 1 github.com/pubnub/go 1 github.com/pubnub/go/v7 1 com.pubnub:pubnub 1 com.pubnub:pubnub-kotlin 1 rubocop 1 ruby-mysql 1 gtk2 1 rotp 1 @turbo-boost/commands 1 turbo_boost-commands 1 discordrb 1 diffy 1 recurly 1 md2pdf 1 sounder 1 date 1 octopoller 1 paratrooper-newrelic 1 jmespath 1 trilogy 1 sentry-raven 1 ruby_parser 1 ftpd 1 tweetstream 1 flash_tool 1 lean-ruport 1 openshift-origin-node 1 point-cli 1 govuk_tech_docs 1 audited 1 omniauth-apple 1 spree_api 1 omniauth-auth0 1 shrine 1 message_bus 1 inline_svg 1 pdf_info 1 rswag 1 resque-scheduler 1
Filter by Repository
https://github.com/rails/rails 53 https://github.com/sparklemotion/nokogiri 33 https://github.com/rubygems/rubygems 18 https://github.com/rack/rack 17 https://github.com/puppetlabs/puppet 15 https://github.com/publify/publify 13 https://github.com/puma/puma 11 https://github.com/phusion/passenger 10 https://github.com/jquery/jquery 9 https://github.com/rails/rails-html-sanitizer 9 https://github.com/fatfreecrm/fat_free_crm 9 https://github.com/decidim/decidim 8 https://github.com/doorkeeper-gem/doorkeeper 6 https://github.com/flavorjones/loofah 6 https://github.com/jquery/jquery-ui 6 https://github.com/solidusio/solidus 5 https://github.com/solidusio/solidus_auth_devise 5 https://github.com/owen2345/camaleon-cms 4 https://github.com/mikel/mail 4 https://github.com/markevans/dragonfly 4 https://github.com/Katello/katello 4 https://github.com/ruby/openssl 4 https://github.com/avo-hq/avo 4 https://github.com/grpc/grpc 4 https://github.com/carrierwaveuploader/carrierwave 4 https://github.com/rgrove/sanitize 4 https://github.com/sinatra/sinatra 4 https://github.com/fluent/fluentd 4 https://github.com/sidekiq/sidekiq 3 https://github.com/rubygems/rubygems.org 3 https://github.com/ruby-git/ruby-git 3 https://github.com/rubyzip/rubyzip 3 https://github.com/resque/resque 3 https://github.com/spree/spree 3 https://github.com/phlex-ruby/phlex 3 https://github.com/rest-client/rest-client 3 https://github.com/geminabox/geminabox 3 https://github.com/cyu/rack-cors 3 https://github.com/twbs/bootstrap 3 https://github.com/gjtorikian/commonmarker 3 https://github.com/lsegal/yard 3 https://github.com/gollum/gollum 3 https://github.com/jtdowney/private_address_check 3 https://github.com/emberjs/ember.js 2 https://github.com/codevise/pageflow 2 https://github.com/CocoaPods/cocoapods-downloader 2 https://github.com/brianmario/yajl-ruby 2 https://github.com/ankane/pghero 2 https://github.com/ankane/field_test 2 https://github.com/ruby-ldap/ruby-net-ldap 2 https://github.com/ankane/chartkick 2 https://github.com/ruby/rdoc 2 https://github.com/ruby/uri 2 https://github.com/ruby/webrick 2 https://github.com/activeadmin/activeadmin 2 https://github.com/faye/faye 2 https://github.com/gettalong/kramdown 2 https://github.com/github/cmark-gfm 2 https://github.com/increments/qiita-markdown 2 https://github.com/jnunemaker/httparty 2 https://github.com/protocolbuffers/protobuf 2 https://github.com/plataformatec/devise 2 https://github.com/mongodb/bson-ruby 2 https://github.com/mperham/sidekiq 2 https://github.com/nov/json-jwt 2 https://github.com/openid/ruby-openid 2 https://github.com/omniauth/omniauth 2 https://github.com/ohler55/ox 2 https://github.com/vmg/redcarpet 2 https://github.com/sparklemotion/mechanize 2 https://github.com/twitter/secure_headers 2 https://github.com/square/git-fastclone 2 https://github.com/tinfoil/devise-two-factor 2 https://github.com/sup-heliotrope/sup 2 https://github.com/svenfuchs/i18n 2 https://github.com/svenfuchs/safemode 2 https://github.com/thoughtbot/paperclip 2 https://gitlab.com/gitlab-org/cves 2 https://github.com/github/view_component 1 https://github.com/github/trilogy 1 https://github.com/github/hub 1 https://github.com/twbs/bootstrap-sass 1 https://github.com/kaminari/kaminari 1 https://github.com/theforeman/ldap_fluff 1 https://github.com/getsentry/raven-ruby 1 https://github.com/geokit/geokit-rails 1 https://github.com/tzinfo/tzinfo 1 https://github.com/gazay/gon 1 https://github.com/fnando/svg_optimizer 1 https://github.com/ua-parser/uap-core 1 https://github.com/flori/json 1 https://github.com/ua-parser/uap-ruby 1 https://github.com/ffi/ffi 1 https://github.com/faye/websocket-extensions-ruby 1 https://github.com/faye/faye-websocket-ruby 1 https://github.com/unpoly/unpoly-rails 1 https://github.com/ViewComponent/view_component 1 https://github.com/theforeman/foreman_fog_proxmox 1 https://github.com/exiftool-rb/exiftool_vendored.rb 1 https://github.com/excon/excon 1 https://github.com/evan/ccsv 1 https://github.com/thoughtbot/cocaine 1 https://github.com/jnunemaker/crack 1 https://github.com/jmespath/jmespath.rb 1 https://github.com/jirutka/asciidoctor-include-ext 1 https://github.com/jgarber/redcloth 1 https://github.com/jekyll/jekyll 1 https://github.com/janko/image_processing 1 https://github.com/jamesmartin/inline_svg 1 https://github.com/inukshuk/bibtex-ruby 1 https://github.com/jordansissel/ruby-arr-pm 1 https://github.com/josh/rack-ssl 1 https://github.com/imsebao/404team 1 https://github.com/thoughtbot/clearance 1 https://github.com/igrigorik/em-http-request 1 https://github.com/hopsoft/turbo_boost-commands 1 https://github.com/heartcombo/devise 1 https://github.com/thoughtbot/administrate 1 https://github.com/haml/haml 1 https://github.com/halostatue/minitar 1 https://github.com/Gurpartap/aescrypt 1 https://github.com/tigris/open-uri-cached 1 https://github.com/theforeman/smart_proxy_dynflow 1 https://github.com/GNOME/libxml2 1 https://github.com/TrestleAdmin/trestle-auth 1 https://github.com/binarylogic/authlogic 1 https://github.com/BetterErrors/better_errors 1 https://github.com/beenhero/omniauth-weibo-oauth2 1 https://github.com/bdmac/strong_password 1 https://github.com/bbatsov/rubocop 1 https://github.com/basecamp/marginalia 1 https://github.com/basecamp/easymon 1 https://github.com/aws/aws-sdk-ruby 1 https://github.com/zendesk/samlr 1 https://github.com/auth0/omniauth-auth0 1 https://github.com/asteinhauser/fat_free_crm 1 https://github.com/asciidoctor/asciidoctor 1 https://github.com/ankane/pgsync 1 https://github.com/zenspider/ruby_parser-legacy 1 https://github.com/zvory/csv-safe 1 https://github.com/ankane/clockwork_web 1 https://github.com/ankane/chartkick.js 1 https://gitlab.com/2013/11 1 https://github.com/ankane/blazer 1 https://github.com/amro/gibbon 1 https://github.com/alphagov/tech-docs-gem 1 https://github.com/alexreisner/geocoder 1 https://github.com/AlchemyCMS/alchemy_cms 1 https://github.com/airbrake/airbrake-ruby 1 https://github.com/ahorner/text-helpers 1 https://github.com/affix/CVE-2022-36231 1 https://github.com/adamzaninovich/sounder 1 https://github.com/elastic/logstash 1 https://github.com/elastic/apm-agent-ruby 1 https://github.com/ejschmitt/delayed_job_web 1 https://github.com/dspinhirne/netaddr-rb 1 https://github.com/doorkeeper-gem/doorkeeper-openid_connect 1 https://github.com/voloko/twitter-stream 1 https://github.com/dmendel/bindata 1 https://github.com/discourse/rails_multisite 1 https://github.com/discourse/message_bus 1 https://github.com/denkGroot/Spina 1 https://github.com/dejan/espeak-ruby 1 https://github.com/wconrad/ftpd 1 https://github.com/datamapper/extlib 1 https://github.com/webbynode/webbynode 1 https://github.com/ConradIrwin/em-imap 1 https://github.com/collectiveidea/audited 1 https://github.com/whiteleaf7/narou 1 https://github.com/codders/dataset 1 https://github.com/wycats/handlebars.js 1 https://github.com/chef/mixlib-archive 1 https://github.com/cgriego/active_attr 1 https://github.com/XKCP/XKCP 1 https://github.com/camilova/activerecord-update-by-case 1 https://github.com/bvsatyaram/random_password_generator 1 https://github.com/bundler/bundler 1 https://github.com/ytti/oxidized-web 1 https://github.com/sinatra/rack-protection 1 https://github.com/rf-/keynote 1 https://github.com/restforce/restforce 1 https://github.com/sisimai/rb-sisimai 1 https://github.com/resque/resque-scheduler 1 https://github.com/Smashing/smashing 1 https://github.com/redis-store/redis-store 1 https://github.com/recurly/recurly-client-ruby 1 https://github.com/rdoc/rdoc 1 https://github.com/rcook/rgpg 1 https://github.com/rapid7/metasploit-framework 1 https://github.com/rails/web-console 1 https://github.com/rails/sprockets 1 https://github.com/Snorby/snorby 1 https://github.com/socketry/protocol-http1 1 https://github.com/rails/kredis 1 https://github.com/rails/jquery-rails 1 https://github.com/rails/globalid 1 https://github.com/railsdog/spree 1 https://github.com/railsadminteam/rails_admin 1 https://github.com/rails/activeresource 1