Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

ruby-lang ruby 2.1 vulnerabilities and exploits

(subscribe to this query)
NA
CVE-2014-2734
The openssl extension in Ruby 2.x does not properly maintain the state of process memory after a file is reopened, which allows remote malicious users to spoof signatures within the context of a Ruby script that attempts signature verification after performing a certain sequence ...
Ruby-lang Ruby 2.0.0Ruby-lang Ruby 2.1.1Ruby-lang Ruby 2.0Ruby-lang Ruby 2.1
NA
CVE-2013-4164
Heap-based buffer overflow in Ruby 1.8, 1.9 prior to 1.9.3-p484, 2.0 prior to 2.0.0-p353, 2.1 prior to 2.1.0 preview2, and trunk before revision 43780 allows context-dependent malicious users to cause a denial of service (segmentation fault) and possibly execute arbitrary code vi...
Ruby-lang Ruby 2.1Ruby-lang Ruby 2.0.0Ruby-lang Ruby 1.9Ruby-lang Ruby 1.9.3Ruby-lang Ruby 1.9.1Ruby-lang Ruby 1.9.2Ruby-lang Ruby 1.8
7.3
CVSSv3
CVE-2009-5147
DL::dlopen in Ruby 1.8, 1.9.0, 1.9.2, 1.9.3, 2.0.0 before patchlevel 648, and 2.1 prior to 2.1.8 opens libraries with tainted names.
Ruby-lang Ruby 2.0.0Ruby-lang Ruby 1.8.0Ruby-lang Ruby 2.1.6Ruby-lang Ruby 2.1.7Ruby-lang Ruby 1.9.2Ruby-lang Ruby 1.9.0Ruby-lang Ruby 2.1.3Ruby-lang Ruby 2.1.4Ruby-lang Ruby 2.1.0Ruby-lang Ruby 1.9.3Ruby-lang Ruby 2.1.2Ruby-lang Ruby 2.1.5Ruby-lang Ruby 2.1.1
8.4
CVSSv3
CVE-2015-7551
The Fiddle::Handle implementation in ext/fiddle/handle.c in Ruby prior to 2.0.0-p648, 2.1 prior to 2.1.8, and 2.2 prior to 2.2.4, as distributed in Apple OS X prior to 10.11.4 and other products, mishandles tainting, which allows context-dependent malicious users to execute arbit...
Apple Mac Os XRuby-lang Ruby 2.1.6Ruby-lang Ruby 2.1.5Ruby-lang Ruby 2.2.0Ruby-lang Ruby 2.1.7Ruby-lang RubyRuby-lang Ruby 2.2.2Ruby-lang Ruby 2.2.1Ruby-lang Ruby 2.1.2Ruby-lang Ruby 2.1.1Ruby-lang Ruby 2.1.0Ruby-lang Ruby 2.2.3Ruby-lang Ruby 2.1.4Ruby-lang Ruby 2.1.3
NA
CVE-2015-3900
RubyGems 2.0.x prior to 2.0.16, 2.2.x prior to 2.2.4, and 2.4.x prior to 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote malicious users to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hij...
Ruby-lang Ruby 2.1.1Ruby-lang Ruby 2.1.2Ruby-lang Ruby 1.9.3Ruby-lang Ruby 2.0.0Ruby-lang Ruby 2.1Ruby-lang Ruby 1.9.1Ruby-lang Ruby 1.9.2Ruby-lang Ruby 2.1.5Ruby-lang Ruby 2.2.0Ruby-lang Ruby 1.9Ruby-lang Ruby 2.1.3Ruby-lang Ruby 2.1.4Rubygems Rubygems 2.0.1Rubygems Rubygems 2.0.2Rubygems Rubygems 2.0.3Rubygems Rubygems 2.0.10Rubygems Rubygems 2.0.11Rubygems Rubygems 2.2.2Rubygems Rubygems 2.2.3Rubygems Rubygems 2.0.4Rubygems Rubygems 2.0.5Rubygems Rubygems 2.0.12
5.9
CVSSv3
CVE-2015-1855
verify_certificate_identity in the OpenSSL extension in Ruby prior to 2.0.0 patchlevel 645, 2.1.x prior to 2.1.6, and 2.2.x prior to 2.2.2 does not properly validate hostnames, which allows remote malicious users to spoof servers via vectors related to (1) multiple wildcards, (1)...
Ruby-lang Ruby 2.0.0Ruby-lang RubyRuby-lang TrunkDebian Debian Linux 7.0Debian Debian Linux 8.0Debian Debian Linux 9.0Puppet Puppet Agent 1.0.0Puppet Puppet Enterprise
NA
CVE-2013-4363
Algorithmic complexity vulnerability in Gem::Version::ANCHORED_VERSION_PATTERN in lib/rubygems/version.rb in RubyGems prior to 1.8.23.2, 1.8.24 up to and including 1.8.26, 2.0.x prior to 2.0.10, and 2.1.x prior to 2.1.5, as used in Ruby 1.9.0 up to and including 2.0.0p247, allows...
Rubygems Rubygems 2.1.4Rubygems RubygemsRubygems Rubygems 2.0.2Rubygems Rubygems 2.0.3Rubygems Rubygems 1.8.24Rubygems Rubygems 1.8.25Rubygems Rubygems 1.8.13Rubygems Rubygems 1.8.14Rubygems Rubygems 1.8.21Rubygems Rubygems 1.8.22Rubygems Rubygems 1.8.9Rubygems Rubygems 2.1.0Rubygems Rubygems 2.0.0Rubygems Rubygems 2.0.4Rubygems Rubygems 2.0.5Rubygems Rubygems 1.8.26Rubygems Rubygems 1.8.0Rubygems Rubygems 1.8.15Rubygems Rubygems 1.8.16Rubygems Rubygems 1.8.17Rubygems Rubygems 1.8.3Rubygems Rubygems 1.8.4
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
blind SQL injectionCVE-2006-4304CVE-2023-26603CVE-2024-28327CVE-2023-50363CVE-2024-21905template injectionCVE-2024-3400cross-site request forgery
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook