# RubyGems Advisories.

Every RubyGems Advisory we hold (Ruby), newest first.

## Records, newest first (an older page)

- [Sprockets path traversal leads to information leak](https://agentprime.io/advisories/GHSA-pr3h-jjhj-573x.md)
  `GHSA-pr3h-jjhj-573x`, `CVE-2018-3760` · RubyGems `sprockets`: affected `<2.12.5 || >=3.0.0, <3.7.2 || >=4.0.0.beta1, <4.0.0.beta8`, fixed in `2.12.5`, `3.7.2`, `4.0.0.beta8` · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.26 · Not analysed yet · Published 20 Jun 2018 · Tags: Path traversal, Information disclosure
- [Sinatra Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-mq35-wqvf-r23c.md)
  `GHSA-mq35-wqvf-r23c`, `CVE-2018-11627` · RubyGems `sinatra`: affected `>=2.0.0, <2.0.2`, fixed in `2.0.2` · CVSS 6.1 Medium · Not analysed yet · Published 5 Jun 2018 · Tags: Cross-site scripting (XSS)
- [rails-html-sanitizer Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-px3r-jm9g-c8w8.md)
  `GHSA-px3r-jm9g-c8w8`, `CVE-2018-3741` · RubyGems `rails-html-sanitizer`: affected `<1.0.4`, fixed in `1.0.4` · CVSS 6.1 Medium · Not analysed yet · Published 26 Apr 2018 · Tags: Cross-site scripting (XSS)
- [Uncontrolled resource consumption in nokogiri](https://agentprime.io/advisories/GHSA-882p-jqgm-f45g.md)
  `GHSA-882p-jqgm-f45g`, `CVE-2017-18258` · RubyGems `nokogiri`: affected `<1.8.2`, fixed in `1.8.2` · CVSS 6.5 Medium · Not analysed yet · Published 13 Apr 2018 · Tags: Denial of service
- [Cross-site Scripting in loofah](https://agentprime.io/advisories/GHSA-x7rv-cr6v-4vm4.md)
  `GHSA-x7rv-cr6v-4vm4`, `CVE-2018-8048` · RubyGems `loofah` and 1 more: affected `<2.2.1`, fixed in `2.2.1` · CVSS 6.1 Medium · Not analysed yet · Published 21 Mar 2018 · Tags: Cross-site scripting (XSS)
- [Sanitize vulnerable to Improper Input Validation and Cross-site Scripting](https://agentprime.io/advisories/GHSA-7f42-p84j-f58p.md)
  `GHSA-7f42-p84j-f58p`, `CVE-2018-3740` · RubyGems `sanitize`: affected `>=3.0.0, <4.6.3`, fixed in `4.6.3` · CVSS 7.5 High · Not analysed yet · Published 21 Mar 2018 · Tags: Cross-site scripting (XSS), CWE-20
- [Cap-Strap gem for Ruby places credentials on the useradd command line](https://agentprime.io/advisories/GHSA-pcm6-g2qp-9gw8.md)
  `GHSA-pcm6-g2qp-9gw8`, `CVE-2014-4992` · RubyGems `cap-strap`: affected `=0.1.5`, no fixed version yet · CVSS 7.8 High · Not analysed yet · Published 16 Mar 2018 · Tags: Information disclosure
- [Doorkeeper is vulnerable to stored XSS and code execution](https://agentprime.io/advisories/GHSA-hwhh-2fwm-cfgw.md)
  `GHSA-hwhh-2fwm-cfgw`, `CVE-2018-1000088` · RubyGems `doorkeeper`: affected `>=2.1.0, <4.2.6`, fixed in `4.2.6` · CVSS 6.1 Medium · Not analysed yet · Published 13 Mar 2018 · Tags: Cross-site scripting (XSS)
- [http vulnerable to Exposure of Sensitive Information to an Unauthorized Actor](https://agentprime.io/advisories/GHSA-6wpv-cj6x-v3jw.md)
  `GHSA-6wpv-cj6x-v3jw`, `CVE-2015-1828` · RubyGems `http`: affected `<0.6.4 || >=0.7.0, <0.7.3`, fixed in `0.6.4`, `0.7.3` · CVSS 5.9 Medium · Not analysed yet · Published 13 Mar 2018 · Tags: Information disclosure
- [rack-protection gem timing attack vulnerability when validating CSRF token](https://agentprime.io/advisories/GHSA-688c-3x49-6rqj.md)
  `GHSA-688c-3x49-6rqj`, `CVE-2018-1000119` · RubyGems `rack-protection`: affected `<1.5.5 || >=2.0.0.beta1, <2.0.0`, fixed in `1.5.5`, `2.0.0` · CVSS 5.9 Medium · Not analysed yet · Published 7 Mar 2018 · Tags: Information disclosure
- [bson is vulnerable to denial of service due to incorrect regex validation](https://agentprime.io/advisories/GHSA-h6rj-8r3c-9gpj.md)
  `GHSA-h6rj-8r3c-9gpj`, `CVE-2015-4412` · RubyGems `bson`: affected `<1.12.3 || >=2.0, <3.0.4`, fixed in `1.12.3`, `3.0.4` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2018 · Tags: Denial of service
- [rails_admin ruby gem XSS](https://agentprime.io/advisories/GHSA-pxr8-w3jq-rcwj.md)
  `GHSA-pxr8-w3jq-rcwj`, `CVE-2017-12098` · RubyGems `rails_admin`: affected `<1.3.0`, fixed in `1.3.0` · CVSS 6.1 Medium · Not analysed yet · Published 5 Mar 2018 · Tags: Cross-site scripting (XSS)
- [brbackup exposes database password to unauthorized users](https://agentprime.io/advisories/GHSA-vqcm-7f7f-r539.md)
  `GHSA-vqcm-7f7f-r539`, `CVE-2014-5004` · RubyGems `brbackup`: affected `=0.1.1`, no fixed version yet · CVSS 7.8 High · Not analysed yet · Published 5 Mar 2018 · Tags: Information disclosure
- [delayed_job_web Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-w7q9-xr2x-wh7x.md)
  `GHSA-w7q9-xr2x-wh7x`, `CVE-2017-12097` · RubyGems `delayed_job_web`: affected `>=1.2.9, <1.4.2`, fixed in `1.4.2` · CVSS 6.1 Medium · Not analysed yet · Published 5 Mar 2018 · Tags: Cross-site scripting (XSS)
- [Ox gem stack overflow in sax_parse](https://agentprime.io/advisories/GHSA-wfwm-chj7-w59r.md)
  `GHSA-wfwm-chj7-w59r`, `CVE-2017-16229` · RubyGems `ox`: affected `<2.8.2`, fixed in `2.8.2` · CVSS 5.5 Medium · Not analysed yet · Published 5 Mar 2018 · Tags: Memory corruption
- [Sinatra Path Traversal vulnerability](https://agentprime.io/advisories/GHSA-h29f-7f56-j8wh.md)
  `GHSA-h29f-7f56-j8wh`, `CVE-2018-7212` · RubyGems `sinatra`: affected `>=2.0.0.beta1, <2.0.1`, fixed in `2.0.1` · CVSS 5.3 Medium · Not analysed yet · Published 20 Feb 2018 · Tags: Path traversal
- [Omniauth allows POST parameters to be stored in session](https://agentprime.io/advisories/GHSA-9pr6-grf4-x2fr.md)
  `GHSA-9pr6-grf4-x2fr`, `CVE-2017-18076` · RubyGems `omniauth`: affected `<1.3.2`, fixed in `1.3.2` · CVSS 7.5 High · Not analysed yet · Published 29 Jan 2018
- [lynx doesn't properly sanitize user input and exposes database password to unauthorized users](https://agentprime.io/advisories/GHSA-94cq-7ccq-cmcm.md)
  `GHSA-94cq-7ccq-cmcm`, `CVE-2014-5002` · RubyGems `lynx`: affected `<1.0.0`, fixed in `1.0.0` · CVSS 7.8 High · Not analysed yet · Published 24 Jan 2018 · Tags: Information disclosure
- [lawn-login exposes database password to unauthorized users](https://agentprime.io/advisories/GHSA-rhgq-vv9x-j4p5.md)
  `GHSA-rhgq-vv9x-j4p5`, `CVE-2014-5000` · RubyGems `lawn-login`: affected `=0.0.7`, no fixed version yet · CVSS 7.8 High · Not analysed yet · Published 22 Jan 2018 · Tags: Information disclosure
- [Gyazo allows local users to write arbitrary files](https://agentprime.io/advisories/GHSA-6x45-86q6-rcmr.md)
  `GHSA-6x45-86q6-rcmr`, `CVE-2014-4994` · RubyGems `gyazo`: affected `>=1.0.0, <2.0.0`, fixed in `2.0.0` · CVSS 5.5 Medium · Not analysed yet · Published 22 Jan 2018 · Tags: CWE-20
- [Denial of Service in jquery](https://agentprime.io/advisories/GHSA-mhpp-875w-9cpv.md)
  `GHSA-mhpp-875w-9cpv`, `CVE-2016-10707` · Maven `org.webjars.npm:jquery` and 3 more: affected `>=3.0.0-rc1, <3.0.0`, fixed in `3.0.0` · CVSS 7.5 High · Not analysed yet · Published 22 Jan 2018 · Tags: Denial of service
- [Cross-Site Scripting (XSS) in jquery](https://agentprime.io/advisories/GHSA-rmxg-73gg-4p98.md)
  `GHSA-rmxg-73gg-4p98`, `CVE-2015-9251` · Maven `org.webjars.npm:jquery` and 3 more: affected `<1.12.2 || >=1.12.3, <3.0.0`, fixed in `1.12.2`, `3.0.0` · CVSS 6.1 Medium · EPSS 0.30 · Not analysed yet · Published 22 Jan 2018 · Tags: Cross-site scripting (XSS)
- [paperclip Server-Side Request Forgery vulnerability](https://agentprime.io/advisories/GHSA-5jcf-c5rg-rmm8.md)
  `GHSA-5jcf-c5rg-rmm8`, `CVE-2017-0889` · RubyGems `paperclip`: affected `>=3.1.4, <5.2.0`, fixed in `5.2.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jan 2018 · Tags: Server-side request forgery (SSRF)
- [Radiant CMS vulnerable to Cross-site Scripting](https://agentprime.io/advisories/GHSA-mvw8-v767-qhjm.md)
  `GHSA-mvw8-v767-qhjm`, `CVE-2018-5216` · RubyGems `radiant`: affected `<=1.1.4`, no fixed version yet · CVSS 5.4 Medium · Not analysed yet · Published 6 Jan 2018 · Tags: Cross-site scripting (XSS)
- [net-ldap Improper Certificate Validation vulnerability](https://agentprime.io/advisories/GHSA-m7p8-9w66-9frm.md)
  `GHSA-m7p8-9w66-9frm`, `CVE-2017-17718` · RubyGems `net-ldap`: affected `<0.16.0`, fixed in `0.16.0` · CVSS 5.9 Medium · Not analysed yet · Published 6 Jan 2018 · Tags: Weak cryptography or TLS
- [Arbitrary file read vulnerability in yard server](https://agentprime.io/advisories/GHSA-gj4p-3wh3-2rmf.md)
  `GHSA-gj4p-3wh3-2rmf`, `CVE-2017-17042` · RubyGems `yard`: affected `<0.9.11`, fixed in `0.9.11` · CVSS 7.5 High · Not analysed yet · Published 21 Dec 2017 · Tags: Path traversal
- [Out-of-bounds read in nokogiri](https://agentprime.io/advisories/GHSA-8c56-cpmw-89x7.md)
  `GHSA-8c56-cpmw-89x7`, `CVE-2017-9050` · RubyGems `nokogiri`: affected `<1.8.1`, fixed in `1.8.1` · CVSS 7.5 High · Not analysed yet · Published 13 Dec 2017 · Tags: Memory corruption
- [Recurly gem Server-Side Request Forgery in Resource#find method](https://agentprime.io/advisories/GHSA-x27v-x225-gq8g.md)
  `GHSA-x27v-x225-gq8g`, `CVE-2017-0905` · RubyGems `recurly`: affected `>=2.0.0, <2.0.13 || >=2.1.0, <2.1.11 || >=2.2.0, <2.2.5 || >=2.3.0, <2.3.10 || >=2.4.0, <2.4.11 || >=2.5.0, <2.5.4 || >=2.6.0, <2.6.3 || >=2.7.0, <2.7.8 || >=2.8.0, <2.8.2 || >=2.9.0, <2.9.2 || >=2.10.0, <2.10.4 || >=2.11.0, <2.11.3`, fixed in `2.0.13`, `2.1.11`, `2.2.5`, `2.3.10`, `2.4.11`, `2.5.4`, `2.6.3`, `2.7.8`, `2.8.2`, `2.9.2`, `2.10.4`, `2.11.3` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Dec 2017 · Tags: Server-side request forgery (SSRF)
- [redis-store deserializes untrusted data](https://agentprime.io/advisories/GHSA-2w67-526p-gm73.md)
  `GHSA-2w67-526p-gm73`, `CVE-2017-1000248` · RubyGems `redis-store`: affected `<1.4.0`, fixed in `1.4.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Dec 2017 · Tags: Insecure deserialization
- [private_address_check contains Incomplete List of Disallowed Inputs](https://agentprime.io/advisories/GHSA-3v3c-r5v2-68ph.md)
  `GHSA-3v3c-r5v2-68ph`, `CVE-2017-0909` · RubyGems `private_address_check`: affected `<0.4.1`, fixed in `0.4.1` · No CVSS score · Not analysed yet · Published 30 Nov 2017 · Tags: CWE-184
- [private_address_check vulnerable to bypass of Resolv.getaddresses method](https://agentprime.io/advisories/GHSA-hxhj-hp9m-qwc4.md)
  `GHSA-hxhj-hp9m-qwc4`, `CVE-2017-0904` · RubyGems `private_address_check`: affected `<0.4.0`, fixed in `0.4.0` · No CVSS score · Not analysed yet · Published 29 Nov 2017 · Tags: CWE-242
- [Geminabox contains Cross-site Scripting](https://agentprime.io/advisories/GHSA-653m-r33x-39ff.md)
  `GHSA-653m-r33x-39ff`, `CVE-2017-16792` · RubyGems `geminabox`: affected `<0.13.10`, fixed in `0.13.10` · CVSS 6.1 Medium · Not analysed yet · Published 29 Nov 2017 · Tags: Cross-site scripting (XSS)
- [Gemirro Stored XSS in Gemspec "homepage" value](https://agentprime.io/advisories/GHSA-x7p2-x2j6-mwhr.md)
  `GHSA-x7p2-x2j6-mwhr`, `CVE-2017-16833` · RubyGems `gemirro`: affected `<0.16.0`, fixed in `0.16.0` · CVSS 6.1 Medium · Not analysed yet · Published 29 Nov 2017 · Tags: Cross-site scripting (XSS)
- [yajl-ruby gem Denial of Service vulnerability](https://agentprime.io/advisories/GHSA-wwh7-4jw9-33x6.md)
  `GHSA-wwh7-4jw9-33x6`, `CVE-2017-16516` · RubyGems `yajl-ruby`: affected `<1.3.1`, fixed in `1.3.1` · CVSS 7.5 High · Not analysed yet · Published 28 Nov 2017 · Tags: Memory corruption
- [Ox gem crashes due to a crafted input](https://agentprime.io/advisories/GHSA-pjj4-w39g-pw54.md)
  `GHSA-pjj4-w39g-pw54`, `CVE-2017-15928` · RubyGems `ox`: affected `<2.8.1`, fixed in `2.8.1` · CVSS 7.5 High · Not analysed yet · Published 21 Nov 2017 · Tags: CWE-20
- [gollum and gollum-lib allow remote authenticated users to execute arbitrary code](https://agentprime.io/advisories/GHSA-q97v-764g-r2rp.md)
  `GHSA-q97v-764g-r2rp`, `CVE-2014-9489` · RubyGems `gollum` and 1 more: affected `<3.1.1`, fixed in `3.1.1` · CVSS 8.8 High · Not analysed yet · Published 16 Nov 2017 · Tags: Broken access control
- [cairo is vulnerable to denial of service due to a null pointer dereference](https://agentprime.io/advisories/GHSA-5v3f-73gv-x7x5.md)
  `GHSA-5v3f-73gv-x7x5`, `CVE-2017-7475` · RubyGems `cairo`: affected `>=1.15.4, <1.15.5`, fixed in `1.15.5` · CVSS 5.5 Medium · Not analysed yet · Published 15 Nov 2017 · Tags: Memory corruption
- [RuboCop gem Insecure use of /tmp](https://agentprime.io/advisories/GHSA-wmjf-jpjj-9f3j.md)
  `GHSA-wmjf-jpjj-9f3j`, `CVE-2017-8418` · RubyGems `rubocop`: affected `<0.49.0`, fixed in `0.49.0` · CVSS 3.3 Low · Not analysed yet · Published 15 Nov 2017 · Tags: Information disclosure
- [Cross-site Scripting vulnerability in i18n translations helper method](https://agentprime.io/advisories/GHSA-xxr8-833v-c7wc.md)
  `GHSA-xxr8-833v-c7wc`, `CVE-2011-4319` · RubyGems `actionpack`: affected `>=3.0.0, <3.0.11 || >=3.1.0, <3.1.2`, fixed in `3.0.11`, `3.1.2` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Cross-site scripting (XSS)
- [gtk2 vulnerable to Use of Externally-Controlled Format String](https://agentprime.io/advisories/GHSA-xgj6-pgrm-x4r2.md)
  `GHSA-xgj6-pgrm-x4r2`, `CVE-2007-6183` · RubyGems `gtk2`: affected `<0.17.0`, fixed in `0.17.0` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Memory corruption
- [Rails ActiveRecord gem vulnerable to SQL injection](https://agentprime.io/advisories/GHSA-xf96-32q2-9rw2.md)
  `GHSA-xf96-32q2-9rw2`, `CVE-2008-4094` · RubyGems `activerecord`: affected `<2.1.1`, fixed in `2.1.1` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: SQL injection
- [Remote code execution in rwiki](https://agentprime.io/advisories/GHSA-wwmf-6p58-6vj2.md)
  `GHSA-wwmf-6p58-6vj2`, `CVE-2006-2582` · RubyGems `rwiki`: affected `>=2.1.0pre1, <2.1.1`, fixed in `2.1.1` · No CVSS score · Not analysed yet · Published 24 Oct 2017
- [Cross-site Scripting in jquery-ui](https://agentprime.io/advisories/GHSA-wcm2-9c89-wmfm.md)
  `GHSA-wcm2-9c89-wmfm`, `CVE-2010-5312` · Maven `org.webjars.npm:jquery-ui` and 3 more: affected `>=1.7.0, <1.10.0`, fixed in `1.10.0` · CVSS 6.1 Medium · EPSS 0.18 · Not analysed yet · Published 24 Oct 2017 · Tags: Cross-site scripting (XSS)
- [Puppet supports use of IP addresses in certnames without warning of potential risks](https://agentprime.io/advisories/GHSA-vxf6-w9mp-95hm.md)
  `GHSA-vxf6-w9mp-95hm`, `CVE-2012-3408` · RubyGems `puppet`: affected `<2.7.18`, fixed in `2.7.18` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Authentication bypass
- [rails Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-v9v4-7jp6-8c73.md)
  `GHSA-v9v4-7jp6-8c73`, `CVE-2011-2197` · RubyGems `actionpack` and 1 more: affected `>=2.0.0, <2.3.12 || >=3.0.0, <3.0.8`, fixed in `2.3.12`, `3.0.8` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Cross-site scripting (XSS)
- [actionpack Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-v5jg-558j-q67c.md)
  `GHSA-v5jg-558j-q67c`, `CVE-2011-2931` · RubyGems `actionpack`: affected `>=2.0.0, <2.3.13 || >=3.0.0, <3.0.10`, fixed in `2.3.13`, `3.0.10` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Cross-site scripting (XSS)
- [rails vulnerable to improper authentication](https://agentprime.io/advisories/GHSA-rxq3-gm4p-5fj4.md)
  `GHSA-rxq3-gm4p-5fj4`, `CVE-2009-2422` · RubyGems `rails`: affected `<2.3.3`, fixed in `2.3.3` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Oct 2017 · Tags: Authentication bypass
- [Ruby on Rails vulnerable to code injection](https://agentprime.io/advisories/GHSA-rvpq-5xqx-pfpp.md)
  `GHSA-rvpq-5xqx-pfpp`, `CVE-2006-4111` · RubyGems `rails`: affected `>=1.1.0, <1.1.6`, fixed in `1.1.6` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Code injection
- [Mail Gem Improper Input Validation vulnerability](https://agentprime.io/advisories/GHSA-rp63-jfmw-532w.md)
  `GHSA-rp63-jfmw-532w`, `CVE-2012-2140` · RubyGems `mail`: affected `<2.4.3`, fixed in `2.4.3` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: CWE-20
- [actionpack Improper Input Validation vulnerability](https://agentprime.io/advisories/GHSA-r7q2-5gqg-6c7q.md)
  `GHSA-r7q2-5gqg-6c7q`, `CVE-2011-2929` · RubyGems `actionpack`: affected `>=3.0.0, <3.0.10`, fixed in `3.0.10` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: CWE-20
- [activesupport Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-qv8p-v9qw-wc7g.md)
  `GHSA-qv8p-v9qw-wc7g`, `CVE-2012-1098` · RubyGems `activesupport`: affected `>=3.0.0, <3.0.12 || >=3.1.0, <3.1.4 || >=3.2.0, <3.2.2`, fixed in `3.0.12`, `3.1.4`, `3.2.2` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Cross-site scripting (XSS)
- [actionpack allows remote attackers to bypass database-query restrictions, perform NULL checks via crafted request](https://agentprime.io/advisories/GHSA-q34c-48gc-m9g8.md)
  `GHSA-q34c-48gc-m9g8`, `CVE-2012-2694` · RubyGems `actionpack`: affected `>=3.0.13, <3.0.14 || >=3.1.0, <3.1.6 || >=3.2.0, <3.2.6`, fixed in `3.0.14`, `3.1.6`, `3.2.6` · No CVSS score · Not analysed yet · Published 24 Oct 2017
- [session fixation protection mechanism in cgi_process.rb in Rails](https://agentprime.io/advisories/GHSA-p4c6-77gc-694x.md)
  `GHSA-p4c6-77gc-694x`, `CVE-2007-6077` · RubyGems `rails`: affected `<1.2.6`, fixed in `1.2.6` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Race condition
- [Session fixation vulnerability in Rails](https://agentprime.io/advisories/GHSA-jwhv-rgqc-fqj5.md)
  `GHSA-jwhv-rgqc-fqj5`, `CVE-2007-5380` · RubyGems `rails`: affected `<1.2.4`, fixed in `1.2.4` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Authentication bypass
- [activerecord vulnerable to SQL Injection](https://agentprime.io/advisories/GHSA-jmm9-2p29-vh2w.md)
  `GHSA-jmm9-2p29-vh2w`, `CVE-2011-0448` · RubyGems `activerecord`: affected `>=3.0.0, <3.0.4`, fixed in `3.0.4` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: SQL injection
- [rails is vulnerable to CRLF injection](https://agentprime.io/advisories/GHSA-jmgf-p46x-982h.md)
  `GHSA-jmgf-p46x-982h`, `CVE-2008-5189` · RubyGems `rails`: affected `<2.0.5`, fixed in `2.0.5` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Cross-site request forgery (CSRF)
- [High severity vulnerability that affects thin](https://agentprime.io/advisories/GHSA-j24p-r6wx-r79w.md)
  `GHSA-j24p-r6wx-r79w`, `CVE-2009-3287` · RubyGems `thin`: affected `<1.2.4`, fixed in `1.2.4` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: CWE-20
- [Action Pack contains database-query restrictions bypass](https://agentprime.io/advisories/GHSA-hgpp-pp89-4fgf.md)
  `GHSA-hgpp-pp89-4fgf`, `CVE-2012-2660` · RubyGems `actionpack`: affected `<2.3.16 || >=3.0.0.beta, <3.0.13 || >=3.1.0, <3.1.5 || >=3.2.0, <3.2.4`, fixed in `2.3.16`, `3.0.13`, `3.1.5`, `3.2.4` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Broken access control
- [activerecord vulnerable to SQL Injection](https://agentprime.io/advisories/GHSA-h6w6-xmqv-7q78.md)
  `GHSA-h6w6-xmqv-7q78`, `CVE-2011-2930` · RubyGems `activerecord`: affected `>=2.0.0, <2.3.13 || >=3.0.0.beta, <3.0.10 || >=3.1.0.beta1, <3.1.0.rc5`, fixed in `2.3.13`, `3.0.10`, `3.1.0.rc5` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: SQL injection
- [Moderate severity vulnerability that affects rails](https://agentprime.io/advisories/GHSA-gm25-fpmr-43fj.md)
  `GHSA-gm25-fpmr-43fj`, `CVE-2007-3227` · RubyGems `rails`: affected `<1.2.5`, fixed in `1.2.5` · No CVSS score · Not analysed yet · Published 24 Oct 2017 · Tags: Cross-site scripting (XSS)

Newest: <https://agentprime.io/advisories/ecosystem/rubygems.md>
Older: <https://agentprime.io/advisories/ecosystem/rubygems.md?cursor=WyIyMDE3LTEwLTI0VDE4OjMzOjM4LjAwMDAwMFoiLCJHSFNBLWdtMjUtZnBtci00M2ZqIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=RubyGems&cursor=WyIyMDE4LTA3LTIzVDE5OjUwOjExLjAwMDAwMFoiLCJHSFNBLTZmY3EtM2NtMi1qM2o1Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/rubygems/?cursor=WyIyMDE4LTA3LTIzVDE5OjUwOjExLjAwMDAwMFoiLCJHSFNBLTZmY3EtM2NtMi1qM2o1Il0>. Everything for agents: <https://agentprime.io/llms.txt>.