# RubyGems Advisories. Every RubyGems Advisory we hold (Ruby), newest first. ## Records, newest first (an older page) - [sprockets vulnerable to Path Traversal](https://agentprime.io/advisories/GHSA-33pp-3763-mrfp.md) `GHSA-33pp-3763-mrfp`, `CVE-2014-7819` · RubyGems `sprockets`: affected `<2.0.5 || >=2.1.0, <2.1.4 || >=2.2.0, <2.2.3 || >=2.3.0, <2.3.3 || >=2.4.0, <2.4.6 || >=2.5.0, <2.5.1 || >=2.6.0, <2.7.1 || >=2.8.0, <2.8.3 || >=2.9.0, <2.9.4 || >=2.10.0, <2.10.2 || >=2.11.0, <2.11.3 || >=2.12.0, <2.12.3`, fixed in `2.0.5`, `2.1.4`, `2.2.3`, `2.3.3`, `2.4.6`, `2.5.1`, `2.7.1`, `2.8.3`, `2.9.4`, `2.10.2`, `2.11.3`, `2.12.3` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Path traversal - [actionpack vulnerable to Path Traversal](https://agentprime.io/advisories/GHSA-29gr-w57f-rpfw.md) `GHSA-29gr-w57f-rpfw`, `CVE-2014-7818` · RubyGems `actionpack`: affected `>=3.0.0, <3.2.20 || >=4.0.0, <4.0.11 || >=4.1.0, <4.1.7 || >=4.2.0.beta1, <4.2.0.beta3`, fixed in `3.2.20`, `4.0.11`, `4.1.7`, `4.2.0.beta3` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Path traversal - [sprout Arbitrary Code Execution vulnerability](https://agentprime.io/advisories/GHSA-229r-pqp6-8w6g.md) `GHSA-229r-pqp6-8w6g`, `CVE-2013-6421` · RubyGems `sprout`: affected `=0.7.246`, no fixed version yet · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Code injection - [Directory traversal vulnerability in Action View in Ruby on Rails](https://agentprime.io/advisories/GHSA-xrr4-p6fq-hjg7.md) `GHSA-xrr4-p6fq-hjg7`, `CVE-2016-0752` · RubyGems `actionpack` and 1 more: affected `<3.2.22.1 || >=4.0.0, <4.1.14.1 || >=4.2.0, <4.2.5.1`, fixed in `3.2.22.1`, `4.1.14.1`, `4.2.5.1` · CVSS 7.5 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.96 · Not analysed yet · Published 24 Oct 2017 · Tags: Path traversal - [actionview contains Path Traversal vulnerability](https://agentprime.io/advisories/GHSA-vx9j-46rh-fqr8.md) `GHSA-vx9j-46rh-fqr8`, `CVE-2016-2097` · RubyGems `actionpack` and 1 more: affected `>=3.0.0, <3.2.22.2 || >=4.0.0, <4.1.14.2`, fixed in `3.2.22.2`, `4.1.14.2` · CVSS 5.3 Medium · Not analysed yet · Published 24 Oct 2017 · Tags: Path traversal - [ActiveRecord in Ruby on Rails allows database-query bypass](https://agentprime.io/advisories/GHSA-pr3r-4wrp-r2pv.md) `GHSA-pr3r-4wrp-r2pv`, `CVE-2016-6317` · RubyGems `activerecord`: affected `>=4.2.0, <4.2.7.1`, fixed in `4.2.7.1` · CVSS 7.5 High · Not analysed yet · Published 24 Oct 2017 · Tags: Broken access control, Memory corruption - [actionview Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-pc3m-v286-2jwj.md) `GHSA-pc3m-v286-2jwj`, `CVE-2016-6316` · RubyGems `actionview`: affected `>=3.0.0, <3.2.22.3 || >=4.0.0, <4.2.7.1 || >=5.0.0, <5.0.0.1`, fixed in `3.2.22.3`, `4.2.7.1`, `5.0.0.1` · CVSS 6.1 Medium · Not analysed yet · Published 24 Oct 2017 · Tags: Cross-site scripting (XSS) - [rack-mini-profiler allows remote attackers to obtain sensitive information about allocated strings and objects](https://agentprime.io/advisories/GHSA-j5hj-fhc9-g24m.md) `GHSA-j5hj-fhc9-g24m`, `CVE-2016-4442` · RubyGems `rack-mini-profiler`: affected `<0.10.1`, fixed in `0.10.1` · CVSS 5.3 Medium · Not analysed yet · Published 24 Oct 2017 · Tags: Information disclosure - [jQuery-UI vulnerable to Cross-site Scripting in dialog closeText](https://agentprime.io/advisories/GHSA-hpcf-8vf9-q4gj.md) `GHSA-hpcf-8vf9-q4gj`, `CVE-2016-7103` · Maven `org.webjars.npm:jquery-ui` and 3 more: affected `<1.12.0`, fixed in `1.12.0` · CVSS 6.1 Medium · EPSS 0.29 · Not analysed yet · Published 24 Oct 2017 · Tags: Cross-site scripting (XSS) - [archive-tar-minitar and minitar vulnerable to Path Traversal](https://agentprime.io/advisories/GHSA-h5g2-38x9-4gv3.md) `GHSA-h5g2-38x9-4gv3`, `CVE-2016-10173` · RubyGems `archive-tar-minitar` and 1 more: affected `<0.5.2`, fixed in `0.5.2` · CVSS 7.5 High · Not analysed yet · Published 24 Oct 2017 · Tags: Path traversal - [Directory traversal vulnerability in RubyZip](https://agentprime.io/advisories/GHSA-gcqq-w6gr-h9j9.md) `GHSA-gcqq-w6gr-h9j9`, `CVE-2017-5946` · RubyGems `rubyzip`: affected `<1.2.1`, fixed in `1.2.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Oct 2017 · Tags: Path traversal - [actionpack is vulnerable to denial of service via a crafted HTTP Accept header](https://agentprime.io/advisories/GHSA-ffpv-c4hm-3x6v.md) `GHSA-ffpv-c4hm-3x6v`, `CVE-2016-0751` · RubyGems `actionpack`: affected `<3.2.22.1 || >=4.0.0, <4.1.14.1 || >=4.2.0, <4.2.5.1`, fixed in `3.2.22.1`, `4.1.14.1`, `4.2.5.1` · CVSS 7.5 High · Not analysed yet · Published 24 Oct 2017 - [festivaltts4r allows arbitrary command execution](https://agentprime.io/advisories/GHSA-f7f4-5w9j-23p2.md) `GHSA-f7f4-5w9j-23p2`, `CVE-2016-10194` · RubyGems `festivaltts4r`: affected `<=0.2.0`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Oct 2017 · Tags: Command injection - [safemode gem allows context-dependent attackers to obtain sensitive information via the inspect method](https://agentprime.io/advisories/GHSA-c92m-rrrc-q5wf.md) `GHSA-c92m-rrrc-q5wf`, `CVE-2016-3693` · RubyGems `safemode`: affected `<1.2.4`, fixed in `1.2.4` · CVSS 8.1 High · Not analysed yet · Published 24 Oct 2017 · Tags: Information disclosure - [actionpack allows remote code execution via application's unrestricted use of render method](https://agentprime.io/advisories/GHSA-78rc-8c29-p45g.md) `GHSA-78rc-8c29-p45g`, `CVE-2016-2098` · RubyGems `actionpack`: affected `>=3.0.0, <3.2.22.2 || >=4.0.0, <4.1.14.2 || >=4.2.0, <4.2.5.2`, fixed in `3.2.22.2`, `4.1.14.2`, `4.2.5.2` · CVSS 7.3 High · Critical (CVSS 7+ and EPSS) · EPSS 0.81 · Not analysed yet · Published 24 Oct 2017 · Tags: CWE-20 - [OpenSSL gem for Ruby using inadequate encryption strength](https://agentprime.io/advisories/GHSA-6h88-qjpv-p32m.md) `GHSA-6h88-qjpv-p32m`, `CVE-2016-7798` · RubyGems `openssl`: affected `<2.0.0`, fixed in `2.0.0` · CVSS 7.5 High · Not analysed yet · Published 24 Oct 2017 · Tags: Weak cryptography or TLS - [Safemode Gem Has Incomplete List of Disallowed Inputs](https://agentprime.io/advisories/GHSA-5vx5-9q73-wgp4.md) `GHSA-5vx5-9q73-wgp4`, `CVE-2017-7540` · RubyGems `safemode`: affected `<1.3.2`, fixed in `1.3.2` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Oct 2017 · Tags: CWE-184 - [activemodel contains Improper Input Validation](https://agentprime.io/advisories/GHSA-543v-gj2c-r3ch.md) `GHSA-543v-gj2c-r3ch`, `CVE-2016-0753` · RubyGems `activemodel`: affected `>=4.1.0, <4.1.14.1 || >=4.2.0, <4.2.5.1`, fixed in `4.1.14.1`, `4.2.5.1` · CVSS 5.3 Medium · Not analysed yet · Published 24 Oct 2017 · Tags: CWE-20 - [espeak-ruby allows arbitrary command execution](https://agentprime.io/advisories/GHSA-4jm3-pfpf-h54p.md) `GHSA-4jm3-pfpf-h54p`, `CVE-2016-10193` · RubyGems `espeak-ruby`: affected `<1.0.3`, fixed in `1.0.3` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Oct 2017 · Tags: Broken access control - [Doorkeeper is vulnerable to replay attacks](https://agentprime.io/advisories/GHSA-3m6r-39p3-jq25.md) `GHSA-3m6r-39p3-jq25`, `CVE-2016-6582` · RubyGems `doorkeeper`: affected `<4.2.0`, fixed in `4.2.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Oct 2017 · Tags: CWE-1254 Newest: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .