Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
rubygems rubygems vulnerabilities and exploits
(subscribe to this query)
828
VMScore
CVE-2007-0469
The extract_files function in installer.rb in RubyGems prior to 0.9.1 does not check whether files exist before overwriting them, which allows user-assisted remote malicious users to overwrite arbitrary files, cause a denial of service, or execute arbitrary code via crafted GEM p...
Rubyforge Rubygems 0.8.11
Rubyforge Rubygems
783
VMScore
CVE-2019-8320
A Directory Traversal issue exists in RubyGems 2.7.6 and later up to and including 3.0.2. Before making new directories or touching files (which now include path-checking code for symlinks), it would delete the target destination. If that destination was hidden behind a symlink, ...
Rubygems Rubygems
668
VMScore
CVE-2021-41816
CGI.escape_html in Ruby prior to 2.7.5 and 3.x prior to 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of bytes. This also affects the CGI gem prior to 0.3.1 for Ruby.
Ruby-lang Cgi
Fedoraproject Fedora 34
Fedoraproject Fedora 35
668
VMScore
CVE-2013-1875
command_wrap.rb in the command_wrap Gem for Ruby allows remote malicious users to execute arbitrary commands via shell metacharacters in a URL or filename.
Rubygems Command Wrap -
668
VMScore
CVE-2013-2616
lib/mini_magick.rb in the MiniMagick Gem 1.3.1 for Ruby allows remote malicious users to execute arbitrary commands via shell metacharacters in a URL.
Rubygems Mini Magick 1.3.1
668
VMScore
CVE-2013-2615
lib/entry_controller.rb in the fastreader Gem 1.0.8 for Ruby allows remote malicious users to execute arbitrary commands via shell metacharacters in a URL.
Rubygems Fastreader 1.0.8
668
VMScore
CVE-2013-0269
The JSON gem prior to 1.5.5, 1.6.x prior to 1.6.8, and 1.7.x prior to 1.7.7 for Ruby allows remote malicious users to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbi...
Rubygems Json Gem 1.7.1
Rubygems Json Gem 1.7.0
Rubygems Json Gem 1.6.1
Rubygems Json Gem 1.6.0
Rubygems Json Gem 1.7.6
Rubygems Json Gem 1.7.5
Rubygems Json Gem 1.6.5
Rubygems Json Gem 1.6.4
Rubygems Json Gem 1.5.2
Rubygems Json Gem 1.5.1
Rubygems Json Gem 1.7.4
Rubygems Json Gem 1.7.3
Rubygems Json Gem 1.7.2
Rubygems Json Gem 1.6.3
Rubygems Json Gem 1.6.2
Rubygems Json Gem 1.5.0
Rubygems Json Gem 1.6.7
Rubygems Json Gem 1.6.6
Rubygems Json Gem 1.5.4
Rubygems Json Gem 1.5.3
1 Github repository
668
VMScore
CVE-2012-2140
The Mail gem prior to 2.4.3 for Ruby allows remote malicious users to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery.
Rubygems Mail Gem
Rubygems Mail Gem 2.3.3
Rubygems Mail Gem 2.3.2
605
VMScore
CVE-2019-8324
An issue exists in RubyGems 2.6 and later up to and including 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could inject arbitrary code to the stub line of gemspec, which is eval-ed by code in ensure_loadable_spec during the preinsta...
Rubygems Rubygems
Debian Debian Linux 9.0
Opensuse Leap 15.0
Opensuse Leap 15.1
Redhat Enterprise Linux 8.0
578
VMScore
CVE-2020-15244
In Magento (rubygems openmage/magento-lts package) prior to 19.4.8 and 20.0.4, an admin user can generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product. The issue is patched in versions 19.4.8 and 20.0.4.
Openmage Magento
VMScore
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-32976
CVE-2024-33557
CVE-2024-36801
CVE-2024-35654
authentication bypass
CVE-2024-24919
CSRF
code execution
CVE-2024-27348
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
3
4
NEXT »