# RubyGems Advisories.

Every RubyGems Advisory we hold (Ruby), newest first.

## Records, newest first (an older page)

- [Rails activerecord gem has Improper Input Validation vulnerability](https://agentprime.io/advisories/GHSA-gjxw-5w2q-7grf.md)
  `GHSA-gjxw-5w2q-7grf`, `CVE-2010-3933` · RubyGems `activerecord`: affected `>=2.3.9, <2.3.10 || >=3.0.0, <3.0.1`, fixed in `2.3.10`, `3.0.1` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: CWE-20
- [Moderate severity vulnerability that affects rails](https://agentprime.io/advisories/GHSA-fjfg-q662-gm6j.md)
  `GHSA-fjfg-q662-gm6j`, `CVE-2007-5379` · RubyGems `rails`: affected `<1.2.4`, fixed in `1.2.4` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Information disclosure
- [Active Record vulnerable to SQL Injection via nested query parameters](https://agentprime.io/advisories/GHSA-fh39-v733-mxfr.md)
  `GHSA-fh39-v733-mxfr`, `CVE-2012-2661` · RubyGems `activerecord`: affected `>=3.0.0, <3.0.13 || >=3.1.0, <3.1.5 || >=3.2.0, <3.2.4`, fixed in `3.0.13`, `3.1.5`, `3.2.4` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: SQL injection
- [actionpack and activesupport vulnerable to information leaks](https://agentprime.io/advisories/GHSA-fg9w-g6m4-557j.md)
  `GHSA-fg9w-g6m4-557j`, `CVE-2009-3086` · RubyGems `actionpack` and 1 more: affected `>=2.1.0, <2.2.3 || >=2.3.0, <2.3.4`, fixed in `2.2.3`, `2.3.4` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Information disclosure
- [actionpack CRLF injection vulnerability](https://agentprime.io/advisories/GHSA-fcqf-h4h4-695m.md)
  `GHSA-fcqf-h4h4-695m`, `CVE-2011-3186` · RubyGems `actionpack`: affected `>=2.3.0, <2.3.13`, fixed in `2.3.13` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Code injection
- [Mail Improper Input Validation vulnerability](https://agentprime.io/advisories/GHSA-cpjc-p7fc-j9xh.md)
  `GHSA-cpjc-p7fc-j9xh`, `CVE-2011-0739` · RubyGems `mail`: affected `<2.2.15`, fixed in `2.2.15` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: CWE-20
- [Mail Gem Path Traversal vulnerability](https://agentprime.io/advisories/GHSA-cj92-c4fj-w9c5.md)
  `GHSA-cj92-c4fj-w9c5`, `CVE-2012-2139` · RubyGems `mail`: affected `<2.4.4`, fixed in `2.4.4` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Path traversal
- [Puppet allows local users to overwrite arbitrary files via a symlink attack](https://agentprime.io/advisories/GHSA-c5qq-g673-5p49.md)
  `GHSA-c5qq-g673-5p49`, `CVE-2012-1989` · RubyGems `puppet`: affected `>=2.7.1, <2.7.13`, fixed in `2.7.13` · No CVSS score · Not analysed yet · Published 24 Oct 2017
- [Rails Denial of Service vulnerability](https://agentprime.io/advisories/GHSA-9wrq-xvmp-xjc8.md)
  `GHSA-9wrq-xvmp-xjc8`, `CVE-2006-4112` · RubyGems `rails`: affected `>=1.1.0, <1.1.6`, fixed in `1.1.6` · No CVSS score · Not analysed yet · Published 24 Oct 2017
- [Moderate severity vulnerability that affects rails](https://agentprime.io/advisories/GHSA-9p3v-wf2w-v29c.md)
  `GHSA-9p3v-wf2w-v29c`, `CVE-2009-4214` · RubyGems `rails`: affected `<2.2.2 || >=2.3.0, <2.3.5`, fixed in `2.2.2`, `2.3.5` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Cross-site scripting (XSS)
- [activesupport Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-9fh3-vh3h-q4g3.md)
  `GHSA-9fh3-vh3h-q4g3`, `CVE-2011-2932` · RubyGems `activesupport`: affected `>=2.0.0, <2.3.13 || >=3.0.0, <3.0.10`, fixed in `2.3.13`, `3.0.10` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Cross-site scripting (XSS)
- [actionpack Improper Authentication vulnerability](https://agentprime.io/advisories/GHSA-92w9-2pqw-rhjj.md)
  `GHSA-92w9-2pqw-rhjj`, `CVE-2012-3424` · RubyGems `actionpack`: affected `<2.3.5 || >=3.0.0.beta, <3.0.16 || >=3.1.0, <3.1.7 || >=3.2.0, <3.2.7`, fixed in `2.3.5`, `3.0.16`, `3.1.7`, `3.2.7` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Authentication bypass
- [Cross site scripting that affects rails](https://agentprime.io/advisories/GHSA-8qrh-h9m2-5fvf.md)
  `GHSA-8qrh-h9m2-5fvf`, `CVE-2009-3009` · RubyGems `actionpack` and 1 more: affected `>=2.0.0, <2.2.3 || >=2.3.0, <2.3.4`, fixed in `2.2.3`, `2.3.4` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Cross-site scripting (XSS)
- [Improper Input Validation in actionpack](https://agentprime.io/advisories/GHSA-8fqx-7pv4-3jwm.md)
  `GHSA-8fqx-7pv4-3jwm`, `CVE-2008-7248` · RubyGems `actionpack`: affected `>=2.1.0, <2.1.3 || >=2.2.0, <2.2.2`, fixed in `2.1.3`, `2.2.2` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: CWE-20
- [activerecord vulnerable to SQL Injection](https://agentprime.io/advisories/GHSA-76wq-xw4h-f8wj.md)
  `GHSA-76wq-xw4h-f8wj`, `CVE-2012-2695` · RubyGems `activerecord`: affected `<2.3.15 || >=3.0.0.beta, <3.0.14 || >=3.1.0, <3.1.6 || >=3.2.0, <3.2.6`, fixed in `2.3.15`, `3.0.14`, `3.1.6`, `3.2.6` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: SQL injection
- [Rails actionpack gem vulnerable to Cross-site Scripting](https://agentprime.io/advisories/GHSA-75w6-p6mg-vh8j.md)
  `GHSA-75w6-p6mg-vh8j`, `CVE-2011-0446` · RubyGems `actionpack` and 1 more: affected `<2.3.11 || >=3.0.0, <3.0.4`, fixed in `2.3.11`, `3.0.4` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Cross-site scripting (XSS)
- [sqlite3-ruby uses weak permissions for unspecified files, which allows local users to gain privileges](https://agentprime.io/advisories/GHSA-6x46-7rrv-m4h8.md)
  `GHSA-6x46-7rrv-m4h8`, `CVE-2011-0995` · RubyGems `sqlite3-ruby`: affected `<1.2.4`, fixed in `1.2.4` · No CVSS score · Not analysed yet · Published 24 Oct 2017
- [WEBrick Improper Input Validation vulnerability](https://agentprime.io/advisories/GHSA-6mq2-37j5-w6r6.md)
  `GHSA-6mq2-37j5-w6r6`, `CVE-2009-4492` · RubyGems `webrick`: affected `<1.4.0`, fixed in `1.4.0` · No CVSS score · EPSS 0.16 · Not analysed yet · Published 24 Oct 2017 · Tags: CWE-20
- [actionpack allows remote attackers to bypass intended access restrictions](https://agentprime.io/advisories/GHSA-4ww3-3rxj-8v6q.md)
  `GHSA-4ww3-3rxj-8v6q`, `CVE-2011-0449` · RubyGems `actionpack`: affected `>=3.0.0, <3.0.4`, fixed in `3.0.4` · No CVSS score · Not analysed yet · Published 24 Oct 2017
- [actionpack Improper Input Validation vulnerability](https://agentprime.io/advisories/GHSA-3vfw-7rcp-3xgm.md)
  `GHSA-3vfw-7rcp-3xgm`, `CVE-2011-3187` · RubyGems `actionpack`: affected `>=2.3.0, <2.3.13`, fixed in `2.3.13` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: CWE-20
- [Cross-site Scripting in actionpack](https://agentprime.io/advisories/GHSA-2xjj-5x6h-8vmf.md)
  `GHSA-2xjj-5x6h-8vmf`, `CVE-2012-1099` · RubyGems `actionpack`: affected `>=3.0.0, <3.0.12 || >=3.1.0, <3.1.4 || >=3.2.0, <3.2.2`, fixed in `3.0.12`, `3.1.4`, `3.2.2` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Cross-site scripting (XSS)
- [actionpack Cross-Site Request Forgery vulnerability](https://agentprime.io/advisories/GHSA-24fg-p96v-hxh8.md)
  `GHSA-24fg-p96v-hxh8`, `CVE-2011-0447` · RubyGems `actionpack`: affected `>=2.1.0, <2.3.11 || >=3.0.0, <3.0.4`, fixed in `2.3.11`, `3.0.4` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Cross-site request forgery (CSRF)
- [activesupport in Rails vulnerable to incorrect data conversion](https://agentprime.io/advisories/GHSA-xgr2-v94m-rc9g.md)
  `GHSA-xgr2-v94m-rc9g`, `CVE-2013-0333` · RubyGems `activesupport`: affected `>=2.3.2, <2.3.16 || >=3.0.0, <3.0.20`, fixed in `2.3.16`, `3.0.20` · No CVSS score · EPSS 0.96 · Not analysed yet · Published 24 Oct 2017 · Tags: Other injection
- [JSON gem has Improper Input Validation vulnerability](https://agentprime.io/advisories/GHSA-x457-cw4h-hq5f.md)
  `GHSA-x457-cw4h-hq5f`, `CVE-2013-0269` · RubyGems `json`: affected `<1.5.5 || >=1.6.0, <1.6.8 || >=1.7.0, <1.7.7`, fixed in `1.5.5`, `1.6.8`, `1.7.7` · No CVSS score · EPSS 0.14 · Not analysed yet · Published 24 Oct 2017 · Tags: CWE-20
- [MiniMagick Gem for Ruby URI Handling Arbitrary Command Injection](https://agentprime.io/advisories/GHSA-w754-gq8r-pf5f.md)
  `GHSA-w754-gq8r-pf5f`, `CVE-2013-2616` · RubyGems `mini_magick`: affected `<3.6.0`, fixed in `3.6.0` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Code injection
- [insecure temporary directory usage in passenger](https://agentprime.io/advisories/GHSA-w6rc-q387-vpgq.md)
  `GHSA-w6rc-q387-vpgq`, `CVE-2013-4136` · RubyGems `passenger`: affected `<4.0.6`, fixed in `4.0.6` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Path traversal
- [fastreader Gem for Ruby URI Handling Arbitrary Command Injection](https://agentprime.io/advisories/GHSA-w248-xr37-jx8m.md)
  `GHSA-w248-xr37-jx8m`, `CVE-2013-2615` · RubyGems `fastreader`: affected `>=1.0.0`, no fixed version yet · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Code injection
- [RDoc contains XSS vulnerability](https://agentprime.io/advisories/GHSA-v2r9-c84j-v7xm.md)
  `GHSA-v2r9-c84j-v7xm`, `CVE-2013-0256` · RubyGems `rdoc`: affected `>=2.3.0, <3.12.1`, fixed in `3.12.1` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Cross-site scripting (XSS)
- [Wicked gem contains Path traversal vulnerability](https://agentprime.io/advisories/GHSA-rprj-g6xc-p5gq.md)
  `GHSA-rprj-g6xc-p5gq`, `CVE-2013-4413` · RubyGems `wicked`: affected `<1.0.1`, fixed in `1.0.1` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Path traversal
- [actionmailer email address processing causes Denial of service](https://agentprime.io/advisories/GHSA-rg5m-3fqp-6px8.md)
  `GHSA-rg5m-3fqp-6px8`, `CVE-2013-4389` · RubyGems `actionmailer`: affected `>=3.0.0, <3.2.15`, fixed in `3.2.15` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Memory corruption
- [Sounder Contains Arbitrary Command Execution Vulnerability](https://agentprime.io/advisories/GHSA-rfmf-rx8w-935w.md)
  `GHSA-rfmf-rx8w-935w`, `CVE-2013-5647` · RubyGems `sounder`: affected `<1.0.2`, fixed in `1.0.2` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Code injection
- [i18n gem Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-r5hc-9xx5-97rw.md)
  `GHSA-r5hc-9xx5-97rw`, `CVE-2013-4492` · RubyGems `i18n`: affected `<0.6.6`, fixed in `0.6.6` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Cross-site scripting (XSS)
- [RedCloth Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-r23g-3qw4-gfh2.md)
  `GHSA-r23g-3qw4-gfh2`, `CVE-2012-6684` · RubyGems `RedCloth`: affected `<4.3.0`, fixed in `4.3.0` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Cross-site scripting (XSS)
- [Code injection in dragonfly gem](https://agentprime.io/advisories/GHSA-qrgf-jqqm-x7xv.md)
  `GHSA-qrgf-jqqm-x7xv`, `CVE-2013-5671` · RubyGems `dragonfly` and 1 more: affected `<1.0.0`, fixed in `1.0.0` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Other injection
- [jquery-ui Tooltip widget vulnerable to XSS](https://agentprime.io/advisories/GHSA-qqxp-xp9v-vvx6.md)
  `GHSA-qqxp-xp9v-vvx6`, `CVE-2012-6662` · Maven `org.webjars.npm:jquery-ui` and 3 more: affected `<1.10.0`, fixed in `1.10.0` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Cross-site scripting (XSS)
- [actionpack Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-q759-hwvc-m3jg.md)
  `GHSA-q759-hwvc-m3jg`, `CVE-2013-1855` · RubyGems `actionpack`: affected `<2.3.18 || >=3.0.0, <3.1.12 || >=3.2.0, <3.2.13`, fixed in `2.3.18`, `3.1.12`, `3.2.13` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Cross-site scripting (XSS)
- [newrelic_rpm Gem Discloses Sensitive Information](https://agentprime.io/advisories/GHSA-q6cw-2553-7837.md)
  `GHSA-q6cw-2553-7837`, `CVE-2013-0284` · RubyGems `newrelic_rpm`: affected `>=3.2.0, <3.5.3.24`, fixed in `3.5.3.24` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Information disclosure
- [Pupper does not properly restrict characters in Common Name field of Certificate Signing Request](https://agentprime.io/advisories/GHSA-q44r-f2hm-v76v.md)
  `GHSA-q44r-f2hm-v76v`, `CVE-2012-3867` · RubyGems `puppet`: affected `<2.6.17 || >=2.7.0, <2.7.18`, fixed in `2.6.17`, `2.7.18` · No CVSS score · Not analysed yet · Published 24 Oct 2017
- [Improper Input Validation in multi_xml](https://agentprime.io/advisories/GHSA-pchc-949f-53m5.md)
  `GHSA-pchc-949f-53m5`, `CVE-2013-0175` · RubyGems `multi_xml`: affected `<0.5.2`, fixed in `0.5.2` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: CWE-20
- [Shell command injection in command_wrap](https://agentprime.io/advisories/GHSA-p673-hjf2-pwfr.md)
  `GHSA-p673-hjf2-pwfr`, `CVE-2013-1875` · RubyGems `command_wrap`: affected `<=0.6.2`, no fixed version yet · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Code injection
- [Dragonfly Code Injection vulnerability](https://agentprime.io/advisories/GHSA-p463-639r-q9g9.md)
  `GHSA-p463-639r-q9g9`, `CVE-2013-1756` · RubyGems `dragonfly`: affected `>=0.7, <0.8.6 || >=0.9, <0.9.13`, fixed in `0.8.6`, `0.9.13` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Code injection
- [actionpack Improper Input Validation vulnerability](https://agentprime.io/advisories/GHSA-mpxf-gcw2-pw5q.md)
  `GHSA-mpxf-gcw2-pw5q`, `CVE-2013-6414` · RubyGems `actionpack`: affected `>=3.0.0, <3.2.16 || >=4.0.0, <4.0.2`, fixed in `3.2.16`, `4.0.2` · No CVSS score · EPSS 0.21 · Not analysed yet · Published 24 Oct 2017 · Tags: CWE-20
- [HTTParty does not restrict casts of string values](https://agentprime.io/advisories/GHSA-mgx3-27hr-mfgp.md)
  `GHSA-mgx3-27hr-mfgp`, `CVE-2013-1801` · RubyGems `httparty`: affected `<0.10.0`, fixed in `0.10.0` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Other injection
- [crack does not properly restrict casts of string values](https://agentprime.io/advisories/GHSA-m7fq-cf8q-35q7.md)
  `GHSA-m7fq-cf8q-35q7`, `CVE-2013-1800` · RubyGems `crack`: affected `<0.3.2`, fixed in `0.3.2` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Other injection, CWE-704
- [Creme Fraiche contains OS Command Injection](https://agentprime.io/advisories/GHSA-m6f7-46hw-grcj.md)
  `GHSA-m6f7-46hw-grcj`, `CVE-2013-2090` · RubyGems `cremefraiche`: affected `<0.6.1`, fixed in `0.6.1` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Command injection
- [Spree Improper Input Validation vulnerability](https://agentprime.io/advisories/GHSA-jxx8-v83v-rhw3.md)
  `GHSA-jxx8-v83v-rhw3`, `CVE-2013-1656` · RubyGems `spree`: affected `>=1.0.0, <2.0.0.rc1`, fixed in `2.0.0.rc1` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: CWE-20
- [Devise does not properly perform type conversion when performing database queries](https://agentprime.io/advisories/GHSA-jxhw-mg8m-2pj8.md)
  `GHSA-jxhw-mg8m-2pj8`, `CVE-2013-0233` · RubyGems `devise`: affected `>=1.5.0, <1.5.4 || >=2.0.0, <2.0.5 || >=2.1.0, <2.1.3 || >=2.2.0, <2.2.3`, fixed in `1.5.4`, `2.0.5`, `2.1.3`, `2.2.3` · No CVSS score · EPSS 0.14 · Not analysed yet · Published 24 Oct 2017 · Tags: CWE-704
- [actionpack Improper Input Validation vulnerability](https://agentprime.io/advisories/GHSA-jmgw-6vjg-jjwg.md)
  `GHSA-jmgw-6vjg-jjwg`, `CVE-2013-0156` · RubyGems `actionpack`: affected `<2.3.15 || >=3.0.0, <3.0.19 || >=3.1.0, <3.1.10 || >=3.2.0, <3.2.11`, fixed in `2.3.15`, `3.0.19`, `3.1.10`, `3.2.11` · No CVSS score · EPSS 0.99 · Not analysed yet · Published 24 Oct 2017 · Tags: CWE-20
- [rgpg Code Injection vulnerability](https://agentprime.io/advisories/GHSA-jg4m-q6w8-vrjp.md)
  `GHSA-jg4m-q6w8-vrjp`, `CVE-2013-4203` · RubyGems `rgpg`: affected `<0.2.3`, fixed in `0.2.3` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Code injection
- [actionpack Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-j838-vfpq-fmf2.md)
  `GHSA-j838-vfpq-fmf2`, `CVE-2013-1857` · RubyGems `actionpack`: affected `<2.3.18 || >=3.0.0, <3.1.12 || >=3.2.0, <3.2.13`, fixed in `2.3.18`, `3.1.12`, `3.2.13` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Cross-site scripting (XSS)
- [Curl Gem insufficient URL escaping command injection](https://agentprime.io/advisories/GHSA-hxx6-p24v-wg8c.md)
  `GHSA-hxx6-p24v-wg8c`, `CVE-2013-2617` · RubyGems `curl`: affected `<=0.0.9`, no fixed version yet · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Code injection
- [activesupport Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-h835-75hw-pj89.md)
  `GHSA-h835-75hw-pj89`, `CVE-2012-3464` · RubyGems `activesupport`: affected `<2.3.16 || >=3.0.0.beta, <3.0.17 || >=3.1.0, <3.1.8 || >=3.2.0, <3.2.8`, fixed in `2.3.16`, `3.0.17`, `3.1.8`, `3.2.8` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Cross-site scripting (XSS)
- [Rack vulnerable to REDoS](https://agentprime.io/advisories/GHSA-h77x-m5q8-c29h.md)
  `GHSA-h77x-m5q8-c29h`, `CVE-2012-6109` · RubyGems `rack`: affected `<1.1.4 || >=1.2.0, <1.2.6 || >=1.3.0, <1.3.7 || >=1.4.0, <1.4.2`, fixed in `1.1.4`, `1.2.6`, `1.3.7`, `1.4.2` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Denial of service
- [ActiveRecord vulnerable to modification of protected model attributes](https://agentprime.io/advisories/GHSA-gr44-7grc-37vq.md)
  `GHSA-gr44-7grc-37vq`, `CVE-2013-0276` · RubyGems `activerecord`: affected `<2.3.17 || >=3.1.0, <3.1.11 || >=3.2.0, <3.2.12`, fixed in `2.3.17`, `3.1.11`, `3.2.12` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Broken access control
- [Active Record allows bypassing of database-query restrictions](https://agentprime.io/advisories/GHSA-gppp-5xc5-wfpx.md)
  `GHSA-gppp-5xc5-wfpx`, `CVE-2013-0155` · RubyGems `activerecord`: affected `>=3.0.0, <3.0.19 || >=3.1.0, <3.1.10 || >=3.2.0, <3.2.11`, fixed in `3.0.19`, `3.1.10`, `3.2.11` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Broken access control
- [Active Record contains SQL Injection](https://agentprime.io/advisories/GHSA-gh2w-j7cx-2664.md)
  `GHSA-gh2w-j7cx-2664`, `CVE-2012-6496` · RubyGems `activerecord`: affected `<2.3.15 || >=3.0.0.beta, <3.0.18 || >=3.1.0, <3.1.9 || >=3.2.0, <3.2.10`, fixed in `2.3.15`, `3.0.18`, `3.1.9`, `3.2.10` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: SQL injection
- [Puppet vulnerable to Path Traversal](https://agentprime.io/advisories/GHSA-g89m-3wjw-h857.md)
  `GHSA-g89m-3wjw-h857`, `CVE-2012-3865` · RubyGems `puppet`: affected `<2.6.17 || >=2.7.0, <2.7.18`, fixed in `2.6.17`, `2.7.18` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Path traversal
- [ldoce Gem Arbitrary Command Execution](https://agentprime.io/advisories/GHSA-g266-3crh-h7gj.md)
  `GHSA-g266-3crh-h7gj`, `CVE-2013-1911` · RubyGems `ldoce`: affected `<=0.0.2`, no fixed version yet · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: CWE-20
- [Active Record contains deserialization of arbitrary YAML](https://agentprime.io/advisories/GHSA-fhj9-cjjh-27vm.md)
  `GHSA-fhj9-cjjh-27vm`, `CVE-2013-0277` · RubyGems `activerecord`: affected `<2.3.17 || >=3.0.0, <3.1.0`, fixed in `2.3.17`, `3.1.0` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Insecure deserialization
- [omniauth-oauth2 Cross-Site Request Forgery vulnerability](https://agentprime.io/advisories/GHSA-fgmx-8h93-26fh.md)
  `GHSA-fgmx-8h93-26fh`, `CVE-2012-6134` · RubyGems `omniauth-oauth2`: affected `<1.1.1`, fixed in `1.1.1` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Cross-site request forgery (CSRF)

Newest: <https://agentprime.io/advisories/ecosystem/rubygems.md>
Older: <https://agentprime.io/advisories/ecosystem/rubygems.md?cursor=WyIyMDE3LTEwLTI0VDE4OjMzOjM3LjAwMDAwMFoiLCJHSFNBLWZnbXgtOGg5My0yNmZoIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=RubyGems&cursor=WyIyMDE3LTEwLTI0VDE4OjMzOjM4LjAwMDAwMFoiLCJHSFNBLWdtMjUtZnBtci00M2ZqIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/rubygems/?cursor=WyIyMDE3LTEwLTI0VDE4OjMzOjM4LjAwMDAwMFoiLCJHSFNBLWdtMjUtZnBtci00M2ZqIl0>. Everything for agents: <https://agentprime.io/llms.txt>.