Skip to content
OpenAdvisories

Package · RubyGems

geminabox

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Medium 6.1
    CVE-2017-16792

    Geminabox contains Cross-site Scripting

    Stored cross-site scripting (XSS) vulnerability in "geminabox" (Gem in a Box) before 0.13.10 allows attackers to inject arbitrary web script via the "homepage" value of a ".gemspec" file, related to views/gem.erb and views/index.erb.

    geminabox RubyGems
  • High 8.8
    CVE-2017-14683

    Gem in a Box vulnerable to Cross-site Request Forgery

    geminabox (aka Gem in a Box) before 0.13.7 has CSRF, as demonstrated by an unintended gem upload.

    geminabox RubyGems
  • Medium 5.4
    CVE-2017-14506

    Gem in a Box vulnerable to Cross-site Scripting

    geminabox (aka Gem in a Box) before 0.13.6 has XSS, as demonstrated by uploading a gem file that has a crafted gem.homepage value in its .gemspec file.

    geminabox RubyGems