RubyGems vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2014-10075Criticalkaro: karo Metacharacter Handling Remote Command Execution CVE-2014-10077Highi18n: i18n Vulnerable to Denial of Service Attack CVE-2013-2516Highfileutils: Fileutils Command Injection vulnerability CVE-2018-12029Highpassenger: Phusion Passenger Race Condition Allows Privilege Escalation CVE-2018-12026Criticalpassenger: Phusion Passenger SpawningKit Contains Arbitrary Read/Write Vulnerability CVE-2011-4969Mediumjquery: jQuery vulnerable to Cross-Site Scripting (XSS)CVE-2016-3072Highkatello: Katello SQL Injection vulnerabilities CVE-2015-3900Highrubygems-update: RubyGems vulnerable to DNS hijack attack CVE-2013-4287Mediumrubygems-update: RubyGems Regular Expression Denial of Service vulnerability CVE-2017-0900Highrubygems-update: RubyGems Improper Input Validation vulnerability CVE-2018-16887Mediumkatello: katello Cross-site Scripting vulnerability CVE-2018-1000074Highrubygems-update: RubyGems Deserialization of Untrusted Data vulnerability CVE-2018-1000076Criticalrubygems-update: RubyGems Improper Verification of Cryptographic Signature vulnerability CVE-2018-1000078Mediumrubygems-update: RubyGems Cross-site Scripting vulnerability CVE-2018-1000077Mediumrubygems-update: RubyGems Improper Input Validation vulnerability CVE-2014-4326Highlogstash: Elasticsearch Logstash allows remote attackers to execute arbitrary commands CVE-2016-1000221Highlogstash-core: Logstash Logs Sensitive Information CVE-2016-7954Criticalbundler: Bundler allows attacker to inject arbitrary code via secondary Gem source CVE-2011-3871Mediumpuppet: Puppet uses predictable filenames, allowing arbitrary file overwrite CVE-2011-0528Mediumpuppet: Puppet does not properly restrict access to node resources CVE-2011-3870Mediumpuppet: Puppet allows local users to modify the permissions of arbitrary files CVE-2011-3869Mediumpuppet: Puppet arbitrary file overwrite CVE-2015-1426Lowfacter: Puppet Labs Facter allows local users to obtain sensitive Amazon EC2 IAM instance metadata CVE-2012-1987Lowpuppet: Puppet Denial of Service and Arbitrary File Write CVE-2012-1906Mediumpuppet: Puppet uses predictable filenames, allowing arbitrary file overwrite

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo