RU
Product
Rubygems
25
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 13Medium 3Low 0
Watch
Add Rubygems to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-1000076 | 9.8 | Mar 13 | RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk… Affected: through 2.2.9; through 2.3.6; through 2.4.3; through 2.5.0 |
| CVE-2017-0903 | 9.8 | Oct 11 | RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability Affected: 2.0.0; 2.0.0; 2.0.0; 2.0.0; 2.0.0; 2.0.0; +34 more |
| CVE-2017-0899 | 9.8 | Aug 31 | RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters Affected: through 2.6.12 |
| CVE-2022-36073 | 8.8 | Sep 7 | RubyGems.org is the Ruby community gem host Affected: before 2022-08-31 |
| CVE-2019-8324 | 8.8 | Jun 17 | An issue was discovered in RubyGems 2.6 and later through 3.0.2 Affected: 2.6.0 through 3.0.2 |
| CVE-2017-0902 | 8.1 | Aug 31 | RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a… Affected: through 2.6.12 |
| CVE-2018-1000074 | 7.8 | Mar 13 | RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk… Affected: through 2.2.9; through 2.3.6; through 2.4.3; through 2.5.0 |
| CVE-2019-8323 | 7.5 | Jun 17 | An issue was discovered in RubyGems 2.6 and later through 3.0.2 Affected: 2.6.0 through 3.0.2 |
| CVE-2019-8322 | 7.5 | Jun 17 | An issue was discovered in RubyGems 2.6 and later through 3.0.2 Affected: 2.6.0 through 3.0.2 |
| CVE-2019-8321 | 7.5 | Jun 17 | An issue was discovered in RubyGems 2.6 and later through 3.0.2 Affected: 2.6.0 through 3.0.2 |
| CVE-2019-8325 | 7.5 | Jun 17 | An issue was discovered in RubyGems 2.6 and later through 3.0.2 Affected: 2.6.0 through 3.0.2 |
| CVE-2018-1000075 | 7.5 | Mar 13 | RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk… Affected: through 2.2.9; through 2.3.6; through 2.4.3; through 2.5.0 |
| CVE-2018-1000073 | 7.5 | Mar 13 | RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk… Affected: through 2.2.9; through 2.3.6; through 2.4.3; through 2.5.0 |
| CVE-2017-0901 | 7.5 | Aug 31 | RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem Affected: through 2.6.12 |
| CVE-2017-0900 | 7.5 | Aug 31 | RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications to cause a denial of service attack against RubyGems clients who have issued a `query`… Affected: through 2.6.12 |
| CVE-2019-8320 | 7.4 | Jun 6 | A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2 Affected: 2.7.6 through 3.0.2 |
| CVE-2018-1000078 | 6.1 | Mar 13 | RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk… Affected: through 2.2.9; through 2.3.6; through 2.4.3; through 2.5.0 |
| CVE-2018-1000079 | 5.5 | Mar 13 | RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk… Affected: through 2.2.9; through 2.3.6; through 2.4.3; through 2.5.0 |
| CVE-2018-1000077 | 5.3 | Mar 13 | RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk… Affected: through 2.2.9; through 2.3.6; through 2.4.3; through 2.5.0 |
| CVE-2015-4020 | – | Aug 25 | RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.4.x before 2.4.8 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to… Affected: 2.0.0; 2.0.0; 2.0.0; 2.0.0; 2.0.0; 2.0.0; +29 more |
| CVE-2015-3900 | – | Jun 24 | RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to… Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +21 more |
| CVE-2013-4363 | – | Oct 17 | Algorithmic complexity vulnerability in Gem::Version::ANCHORED_VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.2, 1.8.24 through 1.8.26, 2.0.x before 2.0.10,… Affected: through 1.8.23; 1.8.0; 1.8.1; 1.8.2; 1.8.3; 1.8.4; +34 more |
| CVE-2013-4287 | – | Oct 17 | Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x… Affected: through 1.8.23; 1.8.0; 1.8.1; 1.8.2; 1.8.3; 1.8.4; +30 more |
| CVE-2012-2126 | – | Oct 1 | RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers to modify a gem during installation via a man-in-the-middle attack Affected: through 1.8.22; 1.8.0; 1.8.1; 1.8.2; 1.8.3; 1.8.4; +17 more |
| CVE-2012-2125 | – | Oct 1 | RubyGems before 1.8.23 can redirect HTTPS connections to HTTP, which makes it easier for remote attackers to observe or modify a gem during installation via a man-in-the-middle… Affected: through 1.8.22; 1.8.0; 1.8.1; 1.8.2; 1.8.3; 1.8.4; +17 more |
Showing 25