Skip to content
OpenAdvisories

Ecosystem

RubyGems

1,141 known vulnerabilities.

Most affected packages

actionpack 69 nokogiri 60 rack 54 rubygems-update 25 activerecord 23 puppet 23 activesupport 19 activestorage 18 actionview 17 loofah 17 rails-html-sanitizer 17 publify_core 15 camaleon_cms 15 passenger 14 puma 14 decidim 13 openc3 11 fat_free_crm 11 rails 11 oj 11 ruby-saml 10 net-imap 10 jquery-rails 9 decidim-core 9 katello 8 avo 8 spree 8 addressable 8 rexml 8 lodash-rails 7 fluentd 7 bootstrap 7 bootstrap-sass 7 jquery-ui-rails 7 webrick 6 json 6 doorkeeper 6 ember-source 6 mcp 6 devise 6
All Critical High Medium Low Exploited only Public exploit

1,129 results · Feed

  • Medium —
    CVE-2007-6183

    gtk2 vulnerable to Use of Externally-Controlled Format String

    Format string vulnerability in the mdiag_initialize function in gtk/src/rbgtkmessagedialog.c in Ruby-GNOME 2 (aka Ruby/Gnome2) 0.16.0, and SVN versions before 20071127, allows context-dependent attackers to execute arbitrary code via format string specifiers …

    gtk2 RubyGems
  • Medium —
    CVE-2007-6077

    session fixation protection mechanism in cgi_process.rb in Rails

    The session fixation protection mechanism in cgi_process.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookie_only attribute from the DEFAULT_SESSION_OPTIONS constant, which effectively causes cookie_only to be applied only to the first instantiat…

    rails rails Debian RubyGems
  • Medium —
    CVE-2007-5379

    Moderate severity vulnerability that affects rails

    Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.from_xml (Hash#from_xml) method, which uses XmlSimple (XML::Simple) unsaf…

    rails rails Debian RubyGems
  • Medium —
    CVE-2007-5380

    Session fixation vulnerability in Rails

    Session fixation vulnerability in Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers to hijack web sessions via unspecified vectors related to "URL-based sessions."

    rails rails Debian RubyGems
  • Medium —
    CVE-2007-3227 Public exploit

    Moderate severity vulnerability that affects rails

    Cross-site scripting (XSS) vulnerability in the to_json (ActiveRecord::Base#to_json) function in Ruby on Rails before edge 9606 allows remote attackers to inject arbitrary web script via the input values.

    rails rails Debian RubyGems
  • Medium —
    CVE-2007-0469

    RubyGems file overwrite vulnerability

    The extract_files function in installer.rb in RubyGems before 0.9.1 does not check whether files exist before overwriting them, which allows user-assisted remote attackers to overwrite arbitrary files, cause a denial of service, or execute arbitrary code via …

    rubygems-update RubyGems
  • High —
    CVE-2006-4111

    Ruby on Rails vulnerable to code injection

    Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with "severe" or "serious" impact via a File Upload request with an HTTP header that modifies the LOAD_PATH variable, a different vulnerability than CVE-2006-4112.

    rails rails Debian RubyGems
  • High —
    CVE-2006-4112

    Rails Denial of Service vulnerability

    Unspecified vulnerability in the "dependency resolution mechanism" in Ruby on Rails 1.1.0 through 1.1.5 allows remote attackers to execute arbitrary Ruby code via a URL that is not properly handled in the routing code, which leads to a denial of service (appl…

    rails rails Debian RubyGems
  • High —
    CVE-2006-2582

    Remote code execution in rwiki

    The editing form in RWiki 2.1.0pre1 through 2.1.0 allows remote attackers to execute arbitrary Ruby code via unknown attack vectors.

    rwiki RubyGems