Skip to content
OpenAdvisories

Vendor

rubygems

7 known vulnerabilities.

Products

rubygems.org 6 rubygems 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.4
    CVE-2023-40165

    Unauthorized gem replacement for full names ending in numbers on rubygems.org

    rubygems.org is the Ruby community's primary gem (library) hosting service. Insufficient input validation allowed malicious actors to replace any uploaded gem version that had a platform, version number, or gem name matching `/-\d/`, permanently replacing the…

    rubygems rubygems.org
  • High 8.3
    CVE-2022-36073

    RubyGems allows creation of users with arbitrary unverified emails

    RubyGems.org is the Ruby community gem host. A bug in password & email change confirmation code allowed an attacker to change their RubyGems.org account's email to an unowned email address. Having access to an account whose email has been changed could enable…

    rubygems rubygems.org
  • High 7.7
    CVE-2022-29218

    Unauthorized takeover for new versions of some platform-specific gems

    RubyGems is a package registry used to supply software for the Ruby language ecosystem. An ordering mistake in the code that accepts gem uploads allowed some gems (with platforms ending in numbers, like `arm64-darwin-21`) to be temporarily replaced in the CDN…

    rubygems rubygems.org