Gem in a Box vulnerable to Cross-site Request Forgery

geminabox aka Gem in a Box before 0.13.7 has CSRF, as demonstrated by an unintended gem upload...

GHSA-QWV2-2X8G-G43G Gem in a Box vulnerable to Cross-site Request Forgery

geminabox aka Gem in a Box before 0.13.7 has CSRF, as demonstrated by an unintended gem upload...

GHSA-98HQ-3QVG-PG78 Gem in a Box vulnerable to Cross-site Scripting

geminabox aka Gem in a Box before 0.13.6 is vulnerable to Cross-site Scripting XSS, as demonstrated by uploading a gem file that has a crafted gem.homepage value in its .gemspec file...

Gem in a Box vulnerable to Cross-site Request Forgery

geminabox aka Gem in a Box before 0.13.7 has CSRF, as demonstrated by an unintended gem upload...

GHSA-653M-R33X-39FF Geminabox contains Cross-site Scripting

Stored cross-site scripting XSS vulnerability in "geminabox" Gem in a Box before 0.13.10 allows attackers to inject arbitrary web script via the "homepage" value of a ".gemspec" file, related to views/gem.erb and views/index.erb...

CVE-2017-16792

Gem in a Box (geminabox) prior to version 0.13.10 is affected by a stored XSS vulnerability. An attacker can inject arbitrary script via the homepage field in a .gemspec, related to the views/gem.erb and views/index.erb templates. The CVE-2017-16792 entry is corroborated by multiple sources (incl...

CVE-2017-16792

Stored cross-site scripting XSS vulnerability in "geminabox" Gem in a Box before 0.13.10 allows attackers to inject arbitrary web script via the "homepage" value of a ".gemspec" file, related to views/gem.erb and views/index.erb...

Cross site request forgery (csrf)

geminabox aka Gem in a Box before 0.13.7 has CSRF, as demonstrated by an unintended gem upload...

CVE-2017-14506

geminabox aka Gem in a Box before 0.13.6 has XSS, as demonstrated by uploading a gem file that has a crafted gem.homepage value in its .gemspec file...

CVE-2017-14683

Gem in a Box (geminabox) CVE-2017-14683 affects versions before 0.13.7 and is due to a Cross-Site Request Forgery (CSRF) flaw demonstrated by an unintended gem upload. Affected software is geminabox, a Ruby-based personal code hosting platform. The Root Cause, per the description, is CSRF allowin...

CVE-2017-14506

Gem in a Box (geminabox) prior to 0.13.6 is vulnerable to Cross-site Scripting (XSS) via a crafted gem.homepage value in a .gemspec file uploaded as a gem. Affected product: geminabox (Ruby) before 0.13.6. Impact: XSS that may affect users accessing the web interface; some sources note potential ...