Stored Cross-Site Scripting (XSS)

gemirro is vulnerable to stored cross-site scripting XSS attacks. The attack is possible because the library does not escape the "homepage" value of a ".gemspec" file...

FreeBSD : rubygem-geminabox -- XSS & CSRF vulnerabilities (2bffdf2f-9d45-11e7-a25c-471bafc3262f)

Gem in a box XSS vulenrability - CVE-2017-14506 : Malicious attacker create GEM file with crafted homepage value gem.homepage in .gemspec file includes XSS payload. The attacker access geminabox system and uploads the gem file or uses CSRF/SSRF attack to do so. From now on, any user access...