RubyGems vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2015-7565Mediumember-source: ember-source Cross-site Scripting vulnerabilityCVE-2016-4658Criticalnokogiri: Nokogiri does not forbid namespace nodes in XPointer rangesCVE-2015-5312Highnokogiri: Nokogiri subject to DoS via libxml2 vulnerabilityCVE-2016-5697Highruby-saml: Ruby-saml allows attackers to perform XML signature wrapping attacks CVE-2016-10345Highpassenger: Phusion Passenger uses a known /tmp filenameCVE-2015-8969Criticalgit-fastclone: Git-fastclone passes user modifiable strings directly to a shell commandCVE-2015-5147Highredcarpet: redcarpet Buffer Overflow vulnerabilityCVE-2015-8968Highgit-fastclone: git-fastclone permits arbitrary shell command execution from .gitmodulesCVE-2015-1820Criticalrest-client: rest-client Gem Vulnerable to Session FixationCVE-2018-1000211Highdoorkeeper: Doorkeeper subject to Incorrect Permission AssignmentCVE-2018-3769Mediumgrape: grape subject to Cross-site ScriptingCVE-2018-3779Criticalactive-support: active-support impersonates 'activesupport' gemCVE-2015-1819Mediumnokogiri: Nokogiri vulnerable to libxml XML Entity ExpansionCVE-2016-10522Highrails_admin: Cross-site request forgery in rails_adminCVE-2018-3777Criticalrestforce: restforce vulnerable to Improper Input ValidationCVE-2017-5029Highnokogiri: Nokogiri implementation of libxslt lacks integer overflow checksCVE-2017-11173Highrack-cors: Missing Regex anchor in Rack-Cors allows malicious third party site to perform CORS requestCVE-2018-1000539Mediumjson-jwt: Json-jwt did not verify the cryptographic signature for dataCVE-2018-3759Highprivate_address_check: private_address_check contains race conditionCVE-2018-7261Mediumradiant: radiant vulnerable to Cross-site ScriptingCVE-2018-3721Mediumlodash: Prototype Pollution in lodashCVE-2014-5003Mediumciborg: Ciborg gem for Ruby allows local users to write files and gain privileges via SymlinkCVE-2014-5001Highkcapifony: Kcapifony gem for Ruby places database user passwords on the command lineCVE-2018-3760Highsprockets: Sprockets path traversal leads to information leakCVE-2018-11627Mediumsinatra: Sinatra Cross-site Scripting vulnerability

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo