DEBIAN-CVE-2017-0900

RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications to cause a denial of service attack against RubyGems clients who have issued a query command...

DEBIAN-CVE-2017-0902

RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls...

UBUNTU-CVE-2017-0902

RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls...

UBUNTU-CVE-2017-0901

RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem...

MGASA-2017-0060 Updated ruby-archive-tar-minitar packages fix security vulnerability

Directory traversal vulnerability in the minitar before 0.6 and archive-tar-minitar 0.5.2 gems for Ruby allows remote attackers to write to arbitrary files via a .. dot dot in a TAR archive entry. CVE-2016-10173 Moreover the updated packages replace deprecated requiregem by gem to make minitar wo...

CVE-2016-10173

Directory traversal vulnerability in the minitar before 0.6 and archive-tar-minitar 0.5.2 gems for Ruby allows remote attackers to write to arbitrary files via a .. dot dot in a TAR archive entry...

UBUNTU-CVE-2016-10173

Directory traversal vulnerability in the minitar before 0.6 and archive-tar-minitar 0.5.2 gems for Ruby allows remote attackers to write to arbitrary files via a .. dot dot in a TAR archive entry...

RubyGems Administrate Cross-Site Request Forgery Vulnerability

RubyGems is a Ruby package manager organized by RubyGems.Administrate is one of the plugins that supports developers to customize the content. A cross-site request forgery vulnerability exists in RubyGems Administrate versions prior to 0.1.5. An attacker could use this vulnerability to perform...

RubyGems Paperclip Excessive Logging Content Spoofing Vulnerability

RubyGems Paperclip is a plugin for extending ActiveRecord ORM model and providing simple file attachment functionality. A content spoofing vulnerability exists in RubyGems Paperclip versions 4.2.2 through 4.3.5. An attacker can exploit this vulnerability to spoof content...

Unspecified vulnerability in RubyGems ruby-saml

RubyGems ruby-saml is a set of SAML Security Assertion Markup Language development toolkits for the Ruby on Rails framework organized by RubyGems. A security vulnerability exists in RubyGems Ruby-saml versions prior to 1.3.0. An attacker could exploit this vulnerability to perform an XML signatur...

rubygems: DNS hijacking vulnerability in api_endpoint()

A flaw was found in a way rubygems verified the API endpoint hostname retrieved through a DNS SRV record. A man-in-the-middle attacker could use this flaw to force a client to download content from an untrusted domain...

RubyGems Paperclip Input Validation Vulnerability

RubyGems Paperclip is a file attachment management library for Active Record. RubyGems Paperclip fails to adequately filter user-submitted input, allowing remote attackers to manipulate pages and spoof content...

RubyGems BSON Denial of Service Vulnerability (CNVD-2015-03762)

RubyGems or gems for short is a Ruby packaging system for packaging Ruby components. A denial of service vulnerability exists in RubyGems BSON. This vulnerability allows attackers to launch denial of service attacks...

RubyGems BSON Denial of Service Vulnerability (CNVD-2015-03761)

RubyGems gems is a Ruby packaging system for packaging Ruby components. A denial of service vulnerability exists in RubyGems BSON. This vulnerability can be exploited to launch a denial of service attack...

RubyGems xaviershay-dm-rails 'storage.rb' MySQL Information Disclosure Vulnerability

RubyGems xaviershay-dm-rails is a Ruby application. A security vulnerability in RubyGems xaviershay-dm-rails 'storage.rb' allows remote attackers to exploit a vulnerability to obtain sensitive MySQL authentication credential information...

Different Ruby gems security vulnerabilities

Crossite scripting, code execution, information leakage...

rubygems: version regex algorithmic complexity vulnerability

A denial of service vulnerability exists in the RubyGems versions 2.0.7 or older, such that when RubyGems validates versioning it performs a wrong regular expression causing resource consumption due to algorithmic complexity...

rubygems: Two security fixes in v1.8.23

RubyGems before 1.8.23 can redirect HTTPS connections to HTTP, which makes it easier for remote attackers to observe or modify a gem during installation via a man-in-the-middle attack...

FreeBSD : ruby-gems -- Algorithmic Complexity Vulnerability (742eb9e4-e3cb-4f5a-b94e-0e9a39420600)

Ruby Gem developers report : The patch for CVE-2013-4363 was insufficiently verified so the combined regular expression for verifying gem version remains vulnerable following CVE-2013-4363. RubyGems validates versions with a regular expression that is vulnerable to denial of service due to...

FreeBSD : ruby-gems -- Algorithmic Complexity Vulnerability (54237182-9635-4a8b-92d7-33bfaeed84cd)

Ruby Gem developers report : RubyGems validates versions with a regular expression that is vulnerable to denial of service due to backtracking. For specially crafted RubyGems versions attackers can cause denial of service through CPU consumption. %NASLMINLEVEL 70300 C Tenable Network Security, In...