# RubyGems Advisories.

Every RubyGems Advisory we hold (Ruby), newest first.

## Records, newest first (an older page)

- [Puppet Improper Input Validation vulnerability](https://agentprime.io/advisories/GHSA-f7p5-w2cr-7cp7.md)
  `GHSA-f7p5-w2cr-7cp7`, `CVE-2013-3567` · RubyGems `puppet`: affected `>=2.7.0, <2.7.22 || >=3.2.0, <3.2.2`, fixed in `2.7.22`, `3.2.2` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: CWE-20
- [Puppet allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service](https://agentprime.io/advisories/GHSA-cj43-9h3w-v976.md)
  `GHSA-cj43-9h3w-v976`, `CVE-2013-4761` · RubyGems `puppet`: affected `>=2.7.0, <2.7.23 || >=3.2.0, <3.2.4`, fixed in `2.7.23`, `3.2.4` · No CVSS score · Not analysed yet · Published 24 Oct 2017
- [omniauth-facebook Cross-Site Request Forgery vulnerability](https://agentprime.io/advisories/GHSA-cf36-985g-v73c.md)
  `GHSA-cf36-985g-v73c`, `CVE-2013-4562` · RubyGems `omniauth-facebook`: affected `>=1.4.1, <1.5.0`, fixed in `1.5.0` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Cross-site request forgery (CSRF)
- [Cocaine Gem OS Command Injection vulnerability](https://agentprime.io/advisories/GHSA-c43v-hrmg-56r4.md)
  `GHSA-c43v-hrmg-56r4`, `CVE-2013-4457` · RubyGems `cocaine`: affected `>=0.4.0, <0.5.3`, fixed in `0.5.3` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Command injection
- [Phusion Passenger Denial of Service](https://agentprime.io/advisories/GHSA-9qj7-jvg4-qr2x.md)
  `GHSA-9qj7-jvg4-qr2x`, `CVE-2013-2119` · RubyGems `passenger`: affected `<3.0.21 || >=4.0.1, <4.0.5`, fixed in `3.0.21`, `4.0.5` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: CWE-377
- [Script Injection in Show In Browser gem](https://agentprime.io/advisories/GHSA-9hx9-w2j6-rw76.md)
  `GHSA-9hx9-w2j6-rw76`, `CVE-2013-2105` · RubyGems `show_in_browser`: affected `=0.0.3`, no fixed version yet · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Path traversal
- [extlib does not properly restrict casts of string values](https://agentprime.io/advisories/GHSA-9h36-4jf2-hx53.md)
  `GHSA-9h36-4jf2-hx53`, `CVE-2013-1802` · RubyGems `extlib`: affected `<0.9.16`, fixed in `0.9.16` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: CWE-704
- [activesupport Improper Input Validation vulnerability](https://agentprime.io/advisories/GHSA-9c2j-593q-3g82.md)
  `GHSA-9c2j-593q-3g82`, `CVE-2013-1856` · RubyGems `activesupport`: affected `>=3.0.0, <3.1.12 || >=3.2.0, <3.2.13`, fixed in `3.1.12`, `3.2.13` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: CWE-20
- [md2pdf allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename](https://agentprime.io/advisories/GHSA-99ch-8mvp-g7m5.md)
  `GHSA-99ch-8mvp-g7m5`, `CVE-2013-1948` · RubyGems `md2pdf`: affected `<=0.0.1`, no fixed version yet · No CVSS score · Not analysed yet · Published 24 Oct 2017
- [actionpack Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-98mf-8f57-64qf.md)
  `GHSA-98mf-8f57-64qf`, `CVE-2012-3463` · RubyGems `actionpack`: affected `>=3.0, <3.0.17 || >=3.1.0, <3.1.8 || >=3.2.0, <3.2.8`, fixed in `3.0.17`, `3.1.8`, `3.2.8` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Cross-site scripting (XSS)
- [Puppet allows local users to obtain sensitive configuration information](https://agentprime.io/advisories/GHSA-8jxj-9r5f-w3m2.md)
  `GHSA-8jxj-9r5f-w3m2`, `CVE-2012-3866` · RubyGems `puppet`: affected `>=2.7.0, <2.7.18`, fixed in `2.7.18` · No CVSS score · Not analysed yet · Published 24 Oct 2017
- [Rack Vulnerable to Path Traversal](https://agentprime.io/advisories/GHSA-85r7-w5mv-c849.md)
  `GHSA-85r7-w5mv-c849`, `CVE-2013-0262` · RubyGems `rack`: affected `>=1.4.0, <1.4.5 || >=1.5.0, <1.5.2`, fixed in `1.4.5`, `1.5.2` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Path traversal
- [actionpack Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-7g65-ghrg-hpf5.md)
  `GHSA-7g65-ghrg-hpf5`, `CVE-2012-3465` · RubyGems `actionpack`: affected `<2.3.16 || >=3.0.0.beta, <3.0.17 || >=3.1.0, <3.1.8 || >=3.2.0, <3.2.8`, fixed in `2.3.16`, `3.0.17`, `3.1.8`, `3.2.8` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Cross-site scripting (XSS)
- [Thumbshooter vulnerable to Code Injection](https://agentprime.io/advisories/GHSA-7fqj-cg79-f2pv.md)
  `GHSA-7fqj-cg79-f2pv`, `CVE-2013-1898` · RubyGems `thumbshooter`: affected `<=0.1.5`, no fixed version yet · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Code injection
- [Shell Metacharacter Injection in kelredd-pruview](https://agentprime.io/advisories/GHSA-78j3-7wpm-qhvp.md)
  `GHSA-78j3-7wpm-qhvp`, `CVE-2013-1947` · RubyGems `kelredd-pruview`: affected `<=0.5.0`, no fixed version yet · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Command injection
- [Denial of service in ruby-openid](https://agentprime.io/advisories/GHSA-6c8p-qphv-668v.md)
  `GHSA-6c8p-qphv-668v`, `CVE-2013-1812` · RubyGems `ruby-openid`: affected `<2.2.2`, fixed in `2.2.2` · No CVSS score · Not analysed yet · Published 24 Oct 2017
- [actionpack vulnerable to Cross-site Scripting](https://agentprime.io/advisories/GHSA-699m-mcjm-9cw8.md)
  `GHSA-699m-mcjm-9cw8`, `CVE-2013-4491` · RubyGems `actionpack`: affected `>=3.0.0, <3.2.16 || >=4.0.0, <4.0.2`, fixed in `3.2.16`, `4.0.2` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Cross-site scripting (XSS)
- [Puppet Improper Input Validation vulnerability](https://agentprime.io/advisories/GHSA-574q-fxfj-wv6h.md)
  `GHSA-574q-fxfj-wv6h`, `CVE-2013-1655` · RubyGems `puppet`: affected `>=2.7.0, <2.7.21 || >=3.1.0, <3.1.1`, fixed in `2.7.21`, `3.1.1` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: CWE-20
- [nori contains Improper Input Validation](https://agentprime.io/advisories/GHSA-4936-rj25-6wm6.md)
  `GHSA-4936-rj25-6wm6`, `CVE-2013-0285` · RubyGems `nori`: affected `>=1.0.0, <1.0.3 || >=1.1.0, <1.1.4 || >=2.0.0, <2.0.2`, fixed in `1.0.3`, `1.1.4`, `2.0.2` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: CWE-20
- [Rack rubygems receiving excessively long lines triggers out-of-memory error](https://agentprime.io/advisories/GHSA-3pxh-h8hw-mj8w.md)
  `GHSA-3pxh-h8hw-mj8w`, `CVE-2013-0183` · RubyGems `rack`: affected `>=1.3.0, <1.3.8 || >=1.4.0, <1.4.3`, fixed in `1.3.8`, `1.4.3` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Memory corruption, Denial of service
- [Active Record Improper Input Validation](https://agentprime.io/advisories/GHSA-3crr-9vmg-864v.md)
  `GHSA-3crr-9vmg-864v`, `CVE-2013-1854` · RubyGems `activerecord`: affected `>=2.3.0, <2.3.18 || >=3.1.0, <3.1.12 || >=3.2.0, <3.2.13`, fixed in `2.3.18`, `3.1.12`, `3.2.13` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: CWE-20
- [Exposure of Sensitive Information in bio-basespace-sdk](https://agentprime.io/advisories/GHSA-xwr3-fmgj-mmfr.md)
  `GHSA-xwr3-fmgj-mmfr`, `CVE-2013-7111` · RubyGems `bio-basespace-sdk`: affected `<=0.1.7`, no fixed version yet · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Information disclosure
- [Active Record Improper Access Control](https://agentprime.io/advisories/GHSA-xrr6-3pc4-m447.md)
  `GHSA-xrr6-3pc4-m447`, `CVE-2015-7577` · RubyGems `activerecord`: affected `>=3.1.0, <3.2.22.1 || >=4.0.0, <4.1.14.1 || >=4.2.0, <4.2.5.1 || >=5.0.0.beta1, <5.0.0.beta1.1`, fixed in `3.2.22.1`, `4.1.14.1`, `4.2.5.1`, `5.0.0.beta1.1` · CVSS 5.3 Medium · Not analysed yet · Published 24 Oct 2017 · Tags: Broken access control
- [rbovirt uses the rest-client gem with SSL verification disabled](https://agentprime.io/advisories/GHSA-ww79-8xwv-932x.md)
  `GHSA-ww79-8xwv-932x`, `CVE-2014-0036` · RubyGems `rbovirt`: affected `<0.0.24`, fixed in `0.0.24` · No CVSS score · Not analysed yet · Published 24 Oct 2017
- [actionpack allows bypass of database-query restrictions](https://agentprime.io/advisories/GHSA-wpw7-wxjm-cw8r.md)
  `GHSA-wpw7-wxjm-cw8r`, `CVE-2013-6417` · RubyGems `actionpack`: affected `>=3.0.0, <3.2.16 || >=4.0.0, <4.0.2`, fixed in `3.2.16`, `4.0.2` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Broken access control
- [actionpack Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-w37c-q653-qg95.md)
  `GHSA-w37c-q653-qg95`, `CVE-2013-6416` · RubyGems `actionpack`: affected `>=4.0.0, <4.0.2`, fixed in `4.0.2` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Cross-site scripting (XSS)
- [activesupport Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-vxvp-4xwc-jpp6.md)
  `GHSA-vxvp-4xwc-jpp6`, `CVE-2015-3226` · RubyGems `activesupport`: affected `>=4.1.0, <4.1.11 || >=4.2.0, <4.2.2`, fixed in `4.1.11`, `4.2.2` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Cross-site scripting (XSS)
- [sfpagent Command Injection vulnerability](https://agentprime.io/advisories/GHSA-vm28-mrm7-fpjq.md)
  `GHSA-vm28-mrm7-fpjq`, `CVE-2014-2888` · RubyGems `sfpagent`: affected `<0.4.15`, fixed in `0.4.15` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Command injection
- [rack-ssl Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-v3rr-cph9-2g2q.md)
  `GHSA-v3rr-cph9-2g2q`, `CVE-2014-2538` · RubyGems `rack-ssl`: affected `<1.4.0`, fixed in `1.4.0` · CVSS 4.0, no score published · Not analysed yet · Published 24 Oct 2017 · Tags: Cross-site scripting (XSS)
- [Rack vulnerable to Denial of Service via large parameter depth request](https://agentprime.io/advisories/GHSA-rgr4-9jh5-j4j6.md)
  `GHSA-rgr4-9jh5-j4j6`, `CVE-2015-3225` · RubyGems `rack`: affected `>=1.4.0, <1.4.6 || >=1.5.0, <1.5.4 || >=1.6.0, <1.6.2`, fixed in `1.4.6`, `1.5.4`, `1.6.2` · No CVSS score · Not analysed yet · Published 24 Oct 2017
- [rails-html-sanitizer Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-r9c2-cr39-c8g6.md)
  `GHSA-r9c2-cr39-c8g6`, `CVE-2015-7579` · RubyGems `rails-html-sanitizer`: affected `<1.0.3`, fixed in `1.0.3` · CVSS 6.1 Medium · Not analysed yet · Published 24 Oct 2017 · Tags: Cross-site scripting (XSS)
- [Active Record contains SQL Injection via improper range quoting](https://agentprime.io/advisories/GHSA-r8fh-hq2p-7qhq.md)
  `GHSA-r8fh-hq2p-7qhq`, `CVE-2014-3483` · RubyGems `activerecord`: affected `>=4.0.0, <4.0.7 || >=4.1.0, <4.1.3`, fixed in `4.0.7`, `4.1.3` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: SQL injection
- [Mail Gem CRLF Injection vulnerability](https://agentprime.io/advisories/GHSA-q86f-fmqf-qrf6.md)
  `GHSA-q86f-fmqf-qrf6`, `CVE-2015-9097` · RubyGems `mail`: affected `<2.5.5`, fixed in `2.5.5` · CVSS 6.1 Medium · Not analysed yet · Published 24 Oct 2017 · Tags: Other injection
- [actionpack is vulnerable to remote bypass authentication](https://agentprime.io/advisories/GHSA-p692-7mm3-3fxg.md)
  `GHSA-p692-7mm3-3fxg`, `CVE-2015-7576` · RubyGems `actionpack`: affected `>=3.1.0, <3.2.22.1 || >=4.0.0, <4.1.14.1`, fixed in `3.2.22.1`, `4.1.14.1` · CVSS 3.7 Low · Not analysed yet · Published 24 Oct 2017
- [Webbynode Code Injection vulnerability](https://agentprime.io/advisories/GHSA-p65m-qr5x-rrqq.md)
  `GHSA-p65m-qr5x-rrqq`, `CVE-2013-7086` · RubyGems `webbynode`: affected `<=1.0.5.3`, no fixed version yet · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Code injection
- [rest-client allows local users to obtain sensitive information by reading the log](https://agentprime.io/advisories/GHSA-mx9f-w8qq-q5jf.md)
  `GHSA-mx9f-w8qq-q5jf`, `CVE-2015-3448` · RubyGems `rest-client`: affected `<1.7.3`, fixed in `1.7.3` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Information disclosure
- [SQL Injection in Active Record](https://agentprime.io/advisories/GHSA-mhwp-qhpc-h3jm.md)
  `GHSA-mhwp-qhpc-h3jm`, `CVE-2014-3482` · RubyGems `activerecord`: affected `>=2.0.0, <3.2.19`, fixed in `3.2.19` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: SQL injection
- [Rails vulnerable to Cross-site Scripting](https://agentprime.io/advisories/GHSA-m46p-ggm5-5j83.md)
  `GHSA-m46p-ggm5-5j83`, `CVE-2014-0081` · RubyGems `actionpack` and 1 more: affected `>=3.0.0, <3.2.17 || >=4.0.0, <4.0.3`, fixed in `3.2.17`, `4.0.3` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Cross-site scripting (XSS)
- [activesupport vulnerable to Denial of Service via large XML document depth](https://agentprime.io/advisories/GHSA-j96r-xvjq-r9pg.md)
  `GHSA-j96r-xvjq-r9pg`, `CVE-2015-3227` · RubyGems `activesupport`: affected `<3.2.22 || >=4.0.0.beta1, <4.1.11 || >=4.2.0.beta1, <4.2.2`, fixed in `3.2.22`, `4.1.11`, `4.2.2` · No CVSS score · Not analysed yet · Published 24 Oct 2017
- [Array data injection vulnerability in activerecord](https://agentprime.io/advisories/GHSA-hqf9-rc9j-5fmj.md)
  `GHSA-hqf9-rc9j-5fmj`, `CVE-2014-0080` · RubyGems `activerecord`: affected `>=4.0.0, <4.0.3 || >=4.1.0.beta1, <4.1.0.beta2`, fixed in `4.0.3`, `4.1.0.beta2` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: SQL injection
- [Arabic Prawn allows remote attackers to execute arbitrary commands via shell metacharacters](https://agentprime.io/advisories/GHSA-hgmw-x865-hf9x.md)
  `GHSA-hgmw-x865-hf9x`, `CVE-2014-2322` · RubyGems `Arabic-Prawn`: affected `<=0.0.1`, no fixed version yet · No CVSS score · Not analysed yet · Published 24 Oct 2017
- [Directory traversal vulnerability in actionpack](https://agentprime.io/advisories/GHSA-h56m-vwxc-3qpw.md)
  `GHSA-h56m-vwxc-3qpw`, `CVE-2014-7829` · RubyGems `actionpack`: affected `>=3.0.0, <3.2.21 || >=4.0.0, <4.0.12 || >=4.1.0, <4.1.8 || >=4.2.0.beta1, <4.2.0.beta4`, fixed in `3.2.21`, `4.0.12`, `4.1.8`, `4.2.0.beta4` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Path traversal
- [rails-html-sanitizer Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-ghqm-pgxj-37gq.md)
  `GHSA-ghqm-pgxj-37gq`, `CVE-2015-7580` · RubyGems `rails-html-sanitizer`: affected `<1.0.3`, fixed in `1.0.3` · CVSS 6.1 Medium · Not analysed yet · Published 24 Oct 2017 · Tags: Cross-site scripting (XSS)
- [Local API Login Credentials Disclosure in paratrooper-pingdom](https://agentprime.io/advisories/GHSA-fqrr-rrwg-69pv.md)
  `GHSA-fqrr-rrwg-69pv`, `CVE-2014-1233` · RubyGems `paratrooper-pingdom`: affected `<=1.0.0`, no fixed version yet · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Information disclosure
- [sentry-raven allows remote attackers to cause a denial of service via a large exponent value in a scientific number](https://agentprime.io/advisories/GHSA-c9c5-9fpr-m882.md)
  `GHSA-c9c5-9fpr-m882`, `CVE-2014-9490` · RubyGems `sentry-raven`: affected `<0.12.2`, fixed in `0.12.2` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Denial of service
- [Active Record subject to strong parameters protection bypass](https://agentprime.io/advisories/GHSA-9rf5-jm6f-2fmm.md)
  `GHSA-9rf5-jm6f-2fmm`, `CVE-2014-3514` · RubyGems `activerecord`: affected `>=4.0.0, <4.0.9 || >=4.1.0, <4.1.5`, fixed in `4.0.9`, `4.1.5` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Broken access control
- [actionpack is vulnerable to denial of service because of a wildcard controller route](https://agentprime.io/advisories/GHSA-9h6g-gp95-x3q5.md)
  `GHSA-9h6g-gp95-x3q5`, `CVE-2015-7581` · RubyGems `actionpack`: affected `>=4.0.0, <4.2.5.1`, fixed in `4.2.5.1` · CVSS 7.5 High · Not analysed yet · Published 24 Oct 2017
- [Paratrooper-newrelic Exposes of Sensitive Information to an Unauthorized Actor](https://agentprime.io/advisories/GHSA-959j-5g9v-3fpq.md)
  `GHSA-959j-5g9v-3fpq`, `CVE-2014-1234` · RubyGems `paratrooper-newrelic`: affected `<=1.0.1`, no fixed version yet · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Information disclosure
- [facter, hiera, mcollective-client, and puppet affected by untrusted search path vulnerability](https://agentprime.io/advisories/GHSA-92v7-pq4h-58j5.md)
  `GHSA-92v7-pq4h-58j5`, `CVE-2014-3248` · RubyGems `facter` and 3 more: affected `<1.7.6 || >=2.0.0, <2.0.2`, fixed in `1.7.6`, `2.0.2` · No CVSS score · Not analysed yet · Published 24 Oct 2017
- [will_paginate Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-8r6h-7x9g-xmw9.md)
  `GHSA-8r6h-7x9g-xmw9`, `CVE-2013-6459` · RubyGems `will_paginate`: affected `<3.0.5`, fixed in `3.0.5` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Cross-site scripting (XSS)
- [actionpack Improper Input Validation vulnerability](https://agentprime.io/advisories/GHSA-7cgp-c3g7-qvrw.md)
  `GHSA-7cgp-c3g7-qvrw`, `CVE-2014-0082` · RubyGems `actionpack`: affected `>=3.0.0, <3.2.17`, fixed in `3.2.17` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: CWE-20
- [colorscore Command Injection vulnerability](https://agentprime.io/advisories/GHSA-73qw-ww62-m54x.md)
  `GHSA-73qw-ww62-m54x`, `CVE-2015-7541` · RubyGems `colorscore`: affected `<0.0.5`, fixed in `0.0.5` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Oct 2017 · Tags: Command injection
- [actionpack Path Traversal vulnerability](https://agentprime.io/advisories/GHSA-6x85-j5j2-27jx.md)
  `GHSA-6x85-j5j2-27jx`, `CVE-2014-0130` · RubyGems `actionpack`: affected `>=3.0.0, <3.2.18 || >=4.0.0, <4.0.5 || >=4.1.0, <4.1.1`, fixed in `3.2.18`, `4.0.5`, `4.1.1` · CVSS 7.5 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.54 · Not analysed yet · Published 24 Oct 2017 · Tags: Path traversal
- [paperclip Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-6jvm-3j5h-79f6.md)
  `GHSA-6jvm-3j5h-79f6`, `CVE-2015-2963` · RubyGems `paperclip`: affected `<4.2.2`, fixed in `4.2.2` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Cross-site scripting (XSS)
- [actionpack vulnerable to Cross-site Scripting](https://agentprime.io/advisories/GHSA-6h5q-96hp-9jgm.md)
  `GHSA-6h5q-96hp-9jgm`, `CVE-2013-6415` · RubyGems `actionpack`: affected `>=3.0.0, <3.2.16 || >=4.0.0, <4.0.2`, fixed in `3.2.16`, `4.0.2` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Cross-site scripting (XSS)
- [Web Console (Ruby gem) contains whitelisted_ips bypass](https://agentprime.io/advisories/GHSA-67j6-xv27-w6ww.md)
  `GHSA-67j6-xv27-w6ww`, `CVE-2015-3224` · RubyGems `web-console`: affected `<2.1.3`, fixed in `2.1.3` · No CVSS score · EPSS 0.49 · Not analysed yet · Published 24 Oct 2017 · Tags: Broken access control
- [rails-html-sanitizer Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-59c7-4xj2-hgvw.md)
  `GHSA-59c7-4xj2-hgvw`, `CVE-2015-7578` · RubyGems `rails-html-sanitizer`: affected `<1.0.3`, fixed in `1.0.3` · CVSS 6.1 Medium · Not analysed yet · Published 24 Oct 2017 · Tags: Cross-site scripting (XSS)
- [jquery-rails and jquery-ujs subject to Exposure of Sensitive Information](https://agentprime.io/advisories/GHSA-4whc-pp4x-9pf3.md)
  `GHSA-4whc-pp4x-9pf3`, `CVE-2015-1840` · RubyGems `jquery-rails` and 1 more: affected `<3.1.3 || >=4.0.0, <4.0.4`, fixed in `3.1.3`, `4.0.4` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Information disclosure
- [Aescrypt does not sufficiently use random values](https://agentprime.io/advisories/GHSA-4c4w-3q45-hp9j.md)
  `GHSA-4c4w-3q45-hp9j`, `CVE-2013-7463` · RubyGems `aescrypt`: affected `<=1.0.0`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 24 Oct 2017 · Tags: Weak cryptography or TLS
- [Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js](https://agentprime.io/advisories/GHSA-34r7-q49f-h37c.md)
  `GHSA-34r7-q49f-h37c`, `CVE-2015-8857` · npm `uglify-js` and 1 more: affected `<2.4.24`, fixed in `2.4.24` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Oct 2017 · Tags: CWE-670, CWE-1254

Newest: <https://agentprime.io/advisories/ecosystem/rubygems.md>
Older: <https://agentprime.io/advisories/ecosystem/rubygems.md?cursor=WyIyMDE3LTEwLTI0VDE4OjMzOjM2LjAwMDAwMFoiLCJHSFNBLTM0cjctcTQ5Zi1oMzdjIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=RubyGems&cursor=WyIyMDE3LTEwLTI0VDE4OjMzOjM3LjAwMDAwMFoiLCJHSFNBLWZnbXgtOGg5My0yNmZoIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/rubygems/?cursor=WyIyMDE3LTEwLTI0VDE4OjMzOjM3LjAwMDAwMFoiLCJHSFNBLWZnbXgtOGg5My0yNmZoIl0>. Everything for agents: <https://agentprime.io/llms.txt>.