# RubyGems Advisories.

Every RubyGems Advisory we hold (Ruby), newest first.

## Records, newest first (an older page)

- [Moderate severity vulnerability that affects activesupport](https://agentprime.io/advisories/GHSA-35c4-f3rq-f9g3.md)
  `GHSA-35c4-f3rq-f9g3` · RubyGems `activesupport`: affected `>=3.2.0, <3.2.22 || >=4.0.0, <4.1.11 || >=4.2.0, <4.2.2`, fixed in `3.2.22`, `4.1.11`, `4.2.2` · No CVSS score · Withdrawn · Not analysed yet · Published 17 Sept 2018
- [Moderate severity vulnerability that affects rack](https://agentprime.io/advisories/GHSA-9vc2-p34x-jhxh.md)
  `GHSA-9vc2-p34x-jhxh` · RubyGems `rack`: affected `<1.4.6 || >=1.5.0, <1.5.4 || >=1.6.0, <1.6.2`, fixed in `1.4.6`, `1.5.4`, `1.6.2` · No CVSS score · Withdrawn · Not analysed yet · Published 17 Sept 2018
- [Moderate severity vulnerability that affects actionview](https://agentprime.io/advisories/GHSA-6834-r92f-jj42.md)
  `GHSA-6834-r92f-jj42` · RubyGems `actionview`: affected `>=4.1.0, <4.1.14.1 || >=4.2.0, <4.2.5.1`, fixed in `4.1.14.1`, `4.2.5.1` · No CVSS score · Withdrawn · Not analysed yet · Published 17 Sept 2018
- [Duplicate Advisory: Moderate severity vulnerability that affects activemodel](https://agentprime.io/advisories/GHSA-v543-gqhh-6gww.md)
  `GHSA-v543-gqhh-6gww` · RubyGems `activemodel`: affected `>=4.1.0, <4.1.14.1 || >=4.2, <4.2.5.1`, fixed in `4.1.14.1`, `4.2.5.1` · No CVSS score · Withdrawn · Not analysed yet · Published 17 Sept 2018
- [Doorkeeper vulnerable to Cross-site Request Forgery](https://agentprime.io/advisories/GHSA-685w-vc84-wxcx.md)
  `GHSA-685w-vc84-wxcx`, `CVE-2014-8144` · RubyGems `doorkeeper`: affected `<1.4.1`, fixed in `1.4.1` · No CVSS score · Not analysed yet · Published 17 Sept 2018 · Tags: Cross-site request forgery (CSRF)
- [Moderate severity vulnerability that affects actionpack](https://agentprime.io/advisories/GHSA-m53f-rhq8-q6hf.md)
  `GHSA-m53f-rhq8-q6hf` · RubyGems `actionpack`: affected `<3.2.22.1 || >=4.0.0, <4.1.14.1 || >=4.2.0, <4.2.5.1`, fixed in `3.2.22.1`, `4.1.14.1`, `4.2.5.1` · No CVSS score · Withdrawn · Not analysed yet · Published 17 Sept 2018
- [Moderate severity vulnerability that affects actionpack](https://agentprime.io/advisories/GHSA-5xmj-wm96-fmw8.md)
  `GHSA-5xmj-wm96-fmw8` · RubyGems `actionpack`: affected `<3.2.21 || >=4.0.0, <4.0.12 || >=4.1.0, <4.1.8`, fixed in `3.2.21`, `4.0.12`, `4.1.8` · No CVSS score · Withdrawn · Not analysed yet · Published 17 Sept 2018
- [Moderate severity vulnerability that affects actionpack](https://agentprime.io/advisories/GHSA-23v3-qfrj-wmgh.md)
  `GHSA-23v3-qfrj-wmgh` · RubyGems `actionpack`: affected `<3.2.20 || >=4.0.0, <4.0.11 || >=4.1.0, <4.1.7`, fixed in `3.2.20`, `4.0.11`, `4.1.7` · No CVSS score · Withdrawn · Not analysed yet · Published 17 Sept 2018
- [Moderate severity vulnerability that affects actionpack](https://agentprime.io/advisories/GHSA-qf5x-qgx7-437h.md)
  `GHSA-qf5x-qgx7-437h` · RubyGems `actionpack`: affected `<3.2.18 || >=4.0.0, <4.0.5 || >=4.1.0, <4.1.1`, fixed in `3.2.18`, `4.0.5`, `4.1.1` · No CVSS score · Withdrawn · Not analysed yet · Published 17 Sept 2018
- [Denial of service or RCE from libxml2 and libxslt](https://agentprime.io/advisories/GHSA-7hp2-xwpj-95jq.md)
  `GHSA-7hp2-xwpj-95jq`, `CVE-2015-8806` · RubyGems `nokogiri`: affected `>=1.6.0, <1.6.8`, fixed in `1.6.8` · CVSS 7.5 High · Not analysed yet · Published 17 Sept 2018 · Tags: Memory corruption
- [Moderate severity vulnerability that affects actionpack](https://agentprime.io/advisories/GHSA-544j-77x9-h938.md)
  `GHSA-544j-77x9-h938` · RubyGems `actionpack`: affected `>=4.0.0, <4.1.14.1 || >=4.2.0, <4.2.5.1`, fixed in `4.1.14.1`, `4.2.5.1` · No CVSS score · Withdrawn · Not analysed yet · Published 17 Sept 2018
- [Bootstrap Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-7mvr-5x2g-wfc8.md)
  `GHSA-7mvr-5x2g-wfc8`, `CVE-2018-14042`, `PKSA-5g9g-4yxq-dm4s` · Maven `org.webjars:bootstrap` and 7 more: affected `>=4.0.0, <4.1.2 || >=2.3.0, <3.4.0`, fixed in `4.1.2`, `3.4.0` · CVSS 6.1 Medium · Not analysed yet · Published 13 Sept 2018 · Tags: Cross-site scripting (XSS)
- [Bootstrap Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-pj7m-g53m-7638.md)
  `GHSA-pj7m-g53m-7638`, `CVE-2018-14041`, `PKSA-6rbt-6s1d-gvry`, `PKSA-rdgg-rccc-bdkf`, `PKSA-ww37-6vs7-z8br` · Maven `org.webjars:bootstrap` and 7 more: affected `>=4.0.0, <4.1.2`, fixed in `4.1.2` · CVSS 6.1 Medium · Not analysed yet · Published 13 Sept 2018 · Tags: Cross-site scripting (XSS)
- [Rubyzip gem contains a Directory Traversal vulnerability in zip file component](https://agentprime.io/advisories/GHSA-vqcq-mrmw-mcmg.md)
  `GHSA-vqcq-mrmw-mcmg`, `CVE-2018-1000544` · RubyGems `rubyzip`: affected `<1.2.2`, fixed in `1.2.2` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Sept 2018 · Tags: Path traversal, Unrestricted file upload
- [Ruby-ffi has a DLL loading issue](https://agentprime.io/advisories/GHSA-2gw2-8q9w-cw8p.md)
  `GHSA-2gw2-8q9w-cw8p`, `CVE-2018-1000201` · RubyGems `ffi`: affected `<1.9.24`, fixed in `1.9.24` · CVSS 7.8 High · Not analysed yet · Published 31 Aug 2018 · Tags: CWE-426
- [ember-source vulnerable to Cross-site Scripting](https://agentprime.io/advisories/GHSA-mp78-r56v-45qc.md)
  `GHSA-mp78-r56v-45qc`, `CVE-2015-1866` · RubyGems `ember-source`: affected `>=1.10.0, <1.10.1 || >=1.11.0, <1.11.2`, fixed in `1.10.1`, `1.11.2` · CVSS 6.1 Medium · Not analysed yet · Published 28 Aug 2018 · Tags: Cross-site scripting (XSS)
- [Spina gem vulnerable to Cross-site request forgery (CSRF) vulnerability](https://agentprime.io/advisories/GHSA-2hxv-mx8x-mcj9.md)
  `GHSA-2hxv-mx8x-mcj9`, `CVE-2015-4619` · RubyGems `spina`: affected `<0.6.29`, fixed in `0.6.29` · CVSS 8.8 High · Not analysed yet · Published 28 Aug 2018 · Tags: Cross-site request forgery (CSRF)
- [Tinfoil Devise-two-factor does not "burn" a successfully validated one-time password (OTP)](https://agentprime.io/advisories/GHSA-x489-jjwm-52g7.md)
  `GHSA-x489-jjwm-52g7`, `CVE-2015-7225` · RubyGems `devise-two-factor`: affected `<2.0.0`, fixed in `2.0.0` · CVSS 5.3 Medium · Not analysed yet · Published 28 Aug 2018
- [Gollum Exposure of Sensitive Information](https://agentprime.io/advisories/GHSA-m2q3-53fq-7h66.md)
  `GHSA-m2q3-53fq-7h66`, `CVE-2015-7314` · RubyGems `gollum`: affected `<4.0.1`, fixed in `4.0.1` · No CVSS score · Not analysed yet · Published 28 Aug 2018 · Tags: Information disclosure
- [ember-source Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-4q53-fqhc-cr46.md)
  `GHSA-4q53-fqhc-cr46`, `CVE-2014-0046` · RubyGems `ember-source`: affected `>=1.2.0, <1.2.2 || >=1.3.0, <1.3.2 || >=1.4.0.beta.1, <1.4.0.beta.6`, fixed in `1.2.2`, `1.3.2`, `1.4.0.beta.6` · No CVSS score · Not analysed yet · Published 28 Aug 2018 · Tags: Cross-site scripting (XSS)
- [ember-source Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-m3q7-rj8g-m457.md)
  `GHSA-m3q7-rj8g-m457`, `CVE-2015-7565` · RubyGems `ember-source`: affected `>=1.8.0, <1.11.4 || >=1.12.0, <1.12.2 || >=1.13.0, <1.13.12 || >=2.0.0, <2.0.3 || >=2.1.0, <2.1.2 || >=2.2.0, <2.2.1`, fixed in `1.11.4`, `1.12.2`, `1.13.12`, `2.0.3`, `2.1.2`, `2.2.1` · CVSS 6.1 Medium · Not analysed yet · Published 28 Aug 2018 · Tags: Cross-site scripting (XSS)
- [Nokogiri does not forbid namespace nodes in XPointer ranges](https://agentprime.io/advisories/GHSA-fr52-4hqw-p27f.md)
  `GHSA-fr52-4hqw-p27f`, `CVE-2016-4658` · RubyGems `nokogiri`: affected `<1.7.1`, fixed in `1.7.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Aug 2018 · Tags: Memory corruption
- [High severity vulnerability that affects activerecord](https://agentprime.io/advisories/GHSA-hm48-76wh-q86v.md)
  `GHSA-hm48-76wh-q86v` · RubyGems `activerecord`: affected `>=4.0.0, <4.0.9 || >=4.1.0, <4.1.5`, fixed in `4.0.9`, `4.1.5` · No CVSS score · Withdrawn · Not analysed yet · Published 21 Aug 2018
- [Nokogiri subject to DoS via libxml2 vulnerability](https://agentprime.io/advisories/GHSA-xjqg-9jvg-fgx2.md)
  `GHSA-xjqg-9jvg-fgx2`, `CVE-2015-5312` · RubyGems `nokogiri`: affected `>=1.6.0, <1.6.7.1`, fixed in `1.6.7.1` · No CVSS score · Not analysed yet · Published 21 Aug 2018 · Tags: Denial of service
- [High severity vulnerability that affects espeak-ruby](https://agentprime.io/advisories/GHSA-w655-w578-99pq.md)
  `GHSA-w655-w578-99pq` · RubyGems `espeak-ruby`: affected `<1.0.3`, fixed in `1.0.3` · No CVSS score · Withdrawn · Not analysed yet · Published 21 Aug 2018
- [Ruby-saml allows attackers to perform XML signature wrapping attacks](https://agentprime.io/advisories/GHSA-36p7-xjw8-h6f2.md)
  `GHSA-36p7-xjw8-h6f2`, `CVE-2016-5697` · RubyGems `ruby-saml`: affected `<1.3.0`, fixed in `1.3.0` · CVSS 7.5 High · Not analysed yet · Published 21 Aug 2018 · Tags: Other injection
- [Phusion Passenger uses a known /tmp filename](https://agentprime.io/advisories/GHSA-cqxw-3p7v-p9gr.md)
  `GHSA-cqxw-3p7v-p9gr`, `CVE-2016-10345` · RubyGems `passenger`: affected `<5.1.0`, fixed in `5.1.0` · CVSS 7.8 High · Not analysed yet · Published 21 Aug 2018
- [Moderate severity vulnerability that affects archive-tar-minitar and minitar](https://agentprime.io/advisories/GHSA-cwp3-834g-x79g.md)
  `GHSA-cwp3-834g-x79g` · RubyGems `archive-tar-minitar` and 1 more: affected `<0.6`, fixed in `0.6` · No CVSS score · Withdrawn · Not analysed yet · Published 21 Aug 2018
- [Git-fastclone passes user modifiable strings directly to a shell command](https://agentprime.io/advisories/GHSA-mf6w-45cf-qhmp.md)
  `GHSA-mf6w-45cf-qhmp`, `CVE-2015-8969` · RubyGems `git-fastclone`: affected `<1.0.5`, fixed in `1.0.5` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Aug 2018 · Tags: Command injection
- [redcarpet Buffer Overflow vulnerability](https://agentprime.io/advisories/GHSA-7322-9mx6-5j2m.md)
  `GHSA-7322-9mx6-5j2m`, `CVE-2015-5147` · RubyGems `redcarpet`: affected `>=3.3.0, <3.3.2`, fixed in `3.3.2` · No CVSS score · Not analysed yet · Published 15 Aug 2018 · Tags: Memory corruption
- [High severity vulnerability that affects festivaltts4r](https://agentprime.io/advisories/GHSA-9wv8-jgw4-4g28.md)
  `GHSA-9wv8-jgw4-4g28` · RubyGems `festivaltts4r`: affected `*`, no fixed version yet · No CVSS score · Withdrawn · Not analysed yet · Published 15 Aug 2018
- [High severity vulnerability that affects colorscore](https://agentprime.io/advisories/GHSA-9wcm-rrvh-qjc8.md)
  `GHSA-9wcm-rrvh-qjc8` · RubyGems `colorscore`: affected `<0.0.5`, fixed in `0.0.5` · No CVSS score · Withdrawn · Not analysed yet · Published 15 Aug 2018
- [git-fastclone permits arbitrary shell command execution from .gitmodules](https://agentprime.io/advisories/GHSA-8gg6-3r63-25m8.md)
  `GHSA-8gg6-3r63-25m8`, `CVE-2015-8968` · RubyGems `git-fastclone`: affected `<1.0.1`, fixed in `1.0.1` · CVSS 8.8 High · Not analysed yet · Published 15 Aug 2018 · Tags: Command injection
- [Moderate severity vulnerability that affects doorkeeper](https://agentprime.io/advisories/GHSA-5p9f-55j8-922m.md)
  `GHSA-5p9f-55j8-922m` · RubyGems `doorkeeper`: affected `>=1.2.0, <4.2.0`, fixed in `4.2.0` · No CVSS score · Withdrawn · Not analysed yet · Published 13 Aug 2018
- [Moderate severity vulnerability that affects activerecord](https://agentprime.io/advisories/GHSA-m8h6-m9p5-p2f8.md)
  `GHSA-m8h6-m9p5-p2f8` · RubyGems `activerecord`: affected `>=4.2.0, <4.2.7.1`, fixed in `4.2.7.1` · No CVSS score · Withdrawn · Not analysed yet · Published 13 Aug 2018
- [Moderate severity vulnerability that affects actionview](https://agentprime.io/advisories/GHSA-2pwf-xwr3-hp55.md)
  `GHSA-2pwf-xwr3-hp55` · RubyGems `actionview`: affected `>=3.2.0, <3.2.22.2 || >=4.0.0, <4.1.14.2`, fixed in `3.2.22.2`, `4.1.14.2` · No CVSS score · Withdrawn · Not analysed yet · Published 13 Aug 2018
- [High severity vulnerability that affects actionpack](https://agentprime.io/advisories/GHSA-hx46-vwmx-wx95.md)
  `GHSA-hx46-vwmx-wx95` · RubyGems `actionpack`: affected `>=3.2.0, <3.2.22.2 || >=4.0.0, <4.1.14.2 || >=4.2.0, <4.2.5.2`, fixed in `3.2.22.2`, `4.1.14.2`, `4.2.5.2` · No CVSS score · Withdrawn · Not analysed yet · Published 13 Aug 2018
- [Moderate severity vulnerability that affects web-console](https://agentprime.io/advisories/GHSA-82x2-g7vr-39wq.md)
  `GHSA-82x2-g7vr-39wq` · RubyGems `web-console`: affected `<2.1.3`, fixed in `2.1.3` · No CVSS score · Withdrawn · Not analysed yet · Published 13 Aug 2018
- [Moderate severity vulnerability that affects paperclip](https://agentprime.io/advisories/GHSA-phmw-pv3f-vvx7.md)
  `GHSA-phmw-pv3f-vvx7` · RubyGems `paperclip`: affected `<4.2.2`, fixed in `4.2.2` · No CVSS score · Withdrawn · Not analysed yet · Published 13 Aug 2018
- [rest-client Gem Vulnerable to Session Fixation](https://agentprime.io/advisories/GHSA-3fhf-6939-qg8p.md)
  `GHSA-3fhf-6939-qg8p`, `CVE-2015-1820` · RubyGems `rest-client`: affected `>=1.6.1.a, <1.8.0`, fixed in `1.8.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2018 · Tags: Authentication bypass
- [Moderate severity vulnerability that affects rack-mini-profiler](https://agentprime.io/advisories/GHSA-995j-587r-259w.md)
  `GHSA-995j-587r-259w` · RubyGems `rack-mini-profiler`: affected `<0.10.1`, fixed in `0.10.1` · No CVSS score · Withdrawn · Not analysed yet · Published 13 Aug 2018
- [Doorkeeper subject to Incorrect Permission Assignment](https://agentprime.io/advisories/GHSA-694m-jhr9-pf77.md)
  `GHSA-694m-jhr9-pf77`, `CVE-2018-1000211` · RubyGems `doorkeeper`: affected `>=4.2.0, <4.4.0`, fixed in `4.4.0` · CVSS 7.5 High · Not analysed yet · Published 13 Aug 2018 · Tags: Broken access control
- [grape subject to Cross-site Scripting](https://agentprime.io/advisories/GHSA-f599-5m7p-hcpf.md)
  `GHSA-f599-5m7p-hcpf`, `CVE-2018-3769` · RubyGems `grape`: affected `<1.1.0`, fixed in `1.1.0` · CVSS 6.1 Medium · Not analysed yet · Published 13 Aug 2018 · Tags: Cross-site scripting (XSS)
- [active-support impersonates 'activesupport' gem](https://agentprime.io/advisories/GHSA-2j55-pcw5-x4h2.md)
  `GHSA-2j55-pcw5-x4h2`, `CVE-2018-3779` · RubyGems `active-support`: affected `*`, no fixed version yet · No CVSS score · Not analysed yet · Published 13 Aug 2018 · Tags: Command injection
- [Nokogiri vulnerable to libxml XML Entity Expansion](https://agentprime.io/advisories/GHSA-q7wx-62r7-j2x7.md)
  `GHSA-q7wx-62r7-j2x7`, `CVE-2015-1819` · RubyGems `nokogiri`: affected `>=1.6.6.0, <1.6.6.4`, fixed in `1.6.6.4` · No CVSS score · Not analysed yet · Published 8 Aug 2018 · Tags: Denial of service
- [Cross-site request forgery in rails_admin](https://agentprime.io/advisories/GHSA-pxqr-8v54-m2hj.md)
  `GHSA-pxqr-8v54-m2hj`, `CVE-2016-10522` · RubyGems `rails_admin`: affected `>=1.0.0, <1.1.1`, fixed in `1.1.1` · CVSS 8.8 High · Not analysed yet · Published 8 Aug 2018 · Tags: Cross-site request forgery (CSRF)
- [Moderate severity vulnerability that affects safemode](https://agentprime.io/advisories/GHSA-44vc-fpcg-5cc5.md)
  `GHSA-44vc-fpcg-5cc5` · RubyGems `safemode`: affected `<1.2.4`, fixed in `1.2.4` · No CVSS score · Withdrawn · Not analysed yet · Published 8 Aug 2018
- [High severity vulnerability that affects safemode](https://agentprime.io/advisories/GHSA-8474-rc7c-wrhp.md)
  `GHSA-8474-rc7c-wrhp` · RubyGems `safemode`: affected `<1.3.3`, fixed in `1.3.3` · No CVSS score · Withdrawn · Not analysed yet · Published 8 Aug 2018
- [restforce vulnerable to Improper Input Validation](https://agentprime.io/advisories/GHSA-534w-937m-v7x3.md)
  `GHSA-534w-937m-v7x3`, `CVE-2018-3777` · RubyGems `restforce`: affected `<3.0.0`, fixed in `3.0.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Aug 2018 · Tags: CWE-20, CWE-172
- [High severity vulnerability that affects rubyzip](https://agentprime.io/advisories/GHSA-3q5q-f79q-7hr2.md)
  `GHSA-3q5q-f79q-7hr2` · RubyGems `rubyzip`: affected `<1.2.1`, fixed in `1.2.1` · No CVSS score · Withdrawn · Not analysed yet · Published 31 Jul 2018
- [Nokogiri implementation of libxslt lacks integer overflow checks](https://agentprime.io/advisories/GHSA-pf6m-fxpq-fg8v.md)
  `GHSA-pf6m-fxpq-fg8v`, `CVE-2017-5029` · RubyGems `nokogiri`: affected `<1.7.2`, fixed in `1.7.2` · CVSS 8.8 High · Not analysed yet · Published 31 Jul 2018 · Tags: Memory corruption
- [Missing Regex anchor in Rack-Cors allows malicious third party site to perform CORS request](https://agentprime.io/advisories/GHSA-2j9c-9vmv-7m39.md)
  `GHSA-2j9c-9vmv-7m39`, `CVE-2017-11173` · RubyGems `rack-cors`: affected `<0.4.1`, fixed in `0.4.1` · CVSS 8.8 High · Not analysed yet · Published 31 Jul 2018
- [Json-jwt did not verify the cryptographic signature for data](https://agentprime.io/advisories/GHSA-mj4x-wcxf-hm8x.md)
  `GHSA-mj4x-wcxf-hm8x`, `CVE-2018-1000539` · RubyGems `json-jwt`: affected `>=0.5.1, <1.9.4`, fixed in `1.9.4` · CVSS 5.3 Medium · Not analysed yet · Published 31 Jul 2018 · Tags: Weak cryptography or TLS
- [private_address_check contains race condition](https://agentprime.io/advisories/GHSA-2xvj-j3qh-x8c3.md)
  `GHSA-2xvj-j3qh-x8c3`, `CVE-2018-3759` · RubyGems `private_address_check`: affected `<0.5.0`, fixed in `0.5.0` · No CVSS score · Not analysed yet · Published 31 Jul 2018 · Tags: Race condition
- [radiant vulnerable to Cross-site Scripting](https://agentprime.io/advisories/GHSA-gp82-xr77-88f4.md)
  `GHSA-gp82-xr77-88f4`, `CVE-2018-7261` · RubyGems `radiant`: affected `=1.1.4`, no fixed version yet · CVSS 5.4 Medium · Not analysed yet · Published 27 Jul 2018 · Tags: Cross-site scripting (XSS)
- [High severity vulnerability that affects jquery-ui](https://agentprime.io/advisories/GHSA-g8q2-24jh-5hpc.md)
  `GHSA-g8q2-24jh-5hpc` · Maven `org.webjars.npm:jquery-ui` and 3 more: affected `<1.12.0`, fixed in `1.12.0` · No CVSS score · Withdrawn · Not analysed yet · Published 27 Jul 2018
- [Prototype Pollution in lodash](https://agentprime.io/advisories/GHSA-fvqr-27wr-82fm.md)
  `GHSA-fvqr-27wr-82fm`, `CVE-2018-3721` · npm `lodash` and 1 more: affected `<4.17.5`, fixed in `4.17.5` · CVSS 6.5 Medium · Not analysed yet · Published 26 Jul 2018 · Tags: Prototype pollution, CWE-471
- [Low severity vulnerability that affects sensu](https://agentprime.io/advisories/GHSA-69mv-3642-wj3w.md)
  `GHSA-69mv-3642-wj3w`, `CVE-2018-1000060` · RubyGems `sensu`: affected `<1.2.1`, fixed in `1.2.1` · No CVSS score · Withdrawn · Not analysed yet · Published 23 Jul 2018
- [Ciborg gem for Ruby allows local users to write files and gain privileges via Symlink](https://agentprime.io/advisories/GHSA-g982-9r8g-6qxw.md)
  `GHSA-g982-9r8g-6qxw`, `CVE-2014-5003` · RubyGems `ciborg`: affected `=3.0.0`, no fixed version yet · CVSS 5.5 Medium · Not analysed yet · Published 23 Jul 2018 · Tags: CWE-20
- [Kcapifony gem for Ruby places database user passwords on the command line](https://agentprime.io/advisories/GHSA-6fcq-3cm2-j3j5.md)
  `GHSA-6fcq-3cm2-j3j5`, `CVE-2014-5001` · RubyGems `kcapifony`: affected `<=2.1.6`, no fixed version yet · CVSS 7.8 High · Not analysed yet · Published 23 Jul 2018 · Tags: Information disclosure

Newest: <https://agentprime.io/advisories/ecosystem/rubygems.md>
Older: <https://agentprime.io/advisories/ecosystem/rubygems.md?cursor=WyIyMDE4LTA3LTIzVDE5OjUwOjExLjAwMDAwMFoiLCJHSFNBLTZmY3EtM2NtMi1qM2o1Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=RubyGems&cursor=WyIyMDE4LTA5LTE3VDIxOjU3OjM4LjAwMDAwMFoiLCJHSFNBLWp4anItNWg2OS1xdzN3Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/rubygems/?cursor=WyIyMDE4LTA5LTE3VDIxOjU3OjM4LjAwMDAwMFoiLCJHSFNBLWp4anItNWg2OS1xdzN3Il0>. Everything for agents: <https://agentprime.io/llms.txt>.