RubyGems vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2017-0899Criticalrubygems-update: RubyGems Code Injection vulnerability CVE-2017-2667Highhammer_cli_foreman: hammer_cli_foreman Improper Certificate Validation vulnerability CVE-2017-2662Mediumkatello: katello Improper Privilege Management vulnerability CVE-2018-14623Mediumkatello: katello SQL Injection vulnerability CVE-2017-14683Highgeminabox: Gem in a Box vulnerable to Cross-site Request Forgery CVE-2017-14506Mediumgeminabox: Gem in a Box vulnerable to Cross-site Scripting CVE-2017-16355Mediumpassenger: Phusion Passenger information disclosure CVE-2019-11068Criticalnokogiri: Nokogiri vulnerable to libxslt protection mechanism bypass CVE-2018-1000073Highrubygems-update: RubyGems Link Following vulnerability CVE-2017-2096Criticalsmalruby-editor: smalruby and smalruby-editor vulnerable to OS Command Injection CVE-2015-3649Highopen-uri-cached: open-uri-cached Gem for Ruby Unsafe Temporary File Creation Enables Code Execution CVE-2017-1000026Highmixlib-archive: mixlib-archive Path Traversal vulnerability CVE-2018-14040Mediumbootstrap: Bootstrap vulnerable to Cross-Site Scripting (XSS)CVE-2017-10906Criticalfluentd: Fluentd Escape Sequence Injection Vulnerability CVE-2016-2785Criticalpuppet: Puppet Improper Access Control CVE-2018-18260Mediumcamaleon_cms: Camaleon CMS vulnerable to Stored Cross-site Scripting CVE-2017-16932Highnokogiri: Nokogiri gem, via libxml, is affected by DoS vulnerabilities CVE-2013-0334Mediumbundler: Bundler may install gems from a different source than expected CVE-2013-0263Mediumrack: Rack arbitrary code execution via timing attack CVE-2013-0184Mediumrack: Rack vulnerable to Denial of Service CVE-2013-0162Lowruby_parser: ruby_parser allows local users to overwrite arbitrary files via symlink attack on temporary file with predictable name CVE-2013-1607Criticalpdfkit: PDFKit Improper Input Validation vulnerability CVE-2013-4318Mediumfeatures: Features file injection vulnerability CVE-2013-4593Highomniauth-facebook: omniauth-facebook Improper Authentication vulnerability CVE-2013-2095Criticalopenshift-origin-controller: RubyGem openshift-origin-controller is vulnerable to command injection

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo