# RubyGems Advisories.

Every RubyGems Advisory we hold (Ruby), newest first.

## Records, newest first (an older page)

- [Missing TLS certificate verification](https://agentprime.io/advisories/GHSA-3q49-h8f9-9fr9.md)
  `GHSA-3q49-h8f9-9fr9`, `CVE-2020-15134` · RubyGems `faye`: affected `<1.4.0`, fixed in `1.4.0` · CVSS 8.0 High · Not analysed yet · Published 31 Jul 2020 · Tags: Weak cryptography or TLS
- [Unsafe object creation in json RubyGem](https://agentprime.io/advisories/GHSA-jphg-qwrw-7w9g.md)
  `GHSA-jphg-qwrw-7w9g`, `CVE-2020-10663` · RubyGems `json`: affected `<2.3.0`, fixed in `2.3.0` · CVSS 7.5 High · Not analysed yet · Published 27 Jul 2020 · Tags: CWE-20
- [Prototype Pollution in lodash](https://agentprime.io/advisories/GHSA-p6mc-m468-83gw.md)
  `GHSA-p6mc-m468-83gw`, `CVE-2020-8203` · npm `lodash` and 7 more: affected `>=3.7.0, <4.17.19`, fixed in `4.17.19` · CVSS 7.4 High · Not analysed yet · Published 15 Jul 2020 · Tags: Denial of service, Prototype pollution
- [Remote code execution via user-provided local names in ActionView](https://agentprime.io/advisories/GHSA-cr3x-7m39-c6jq.md)
  `GHSA-cr3x-7m39-c6jq`, `BIT-rails-2020-8163`, `CVE-2020-8163` · RubyGems `actionview`: affected `<4.2.11.3`, fixed in `4.2.11.3` · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.82 · Not analysed yet · Published 7 Jul 2020 · Tags: Code injection
- [CSRF Vulnerability in rails-ujs](https://agentprime.io/advisories/GHSA-xq5j-gw7f-jgj8.md)
  `GHSA-xq5j-gw7f-jgj8`, `CVE-2020-8167` · RubyGems `actionview`: affected `>=5.0.0, <5.2.4.3 || >=6.0.0, <6.0.3.1`, fixed in `5.2.4.3`, `6.0.3.1` · CVSS 6.5 Medium · Not analysed yet · Published 7 Jul 2020 · Tags: Cross-site request forgery (CSRF)
- [Directory traversal in Rack::Directory app bundled with Rack](https://agentprime.io/advisories/GHSA-5f9h-9pjv-v6j7.md)
  `GHSA-5f9h-9pjv-v6j7`, `CVE-2020-8161` · RubyGems `rack`: affected `<2.1.3`, fixed in `2.1.3` · CVSS 8.6 High · Not analysed yet · Published 6 Jul 2020 · Tags: Path traversal, CWE-548
- [Untrusted users can run pending migrations in production in Rails](https://agentprime.io/advisories/GHSA-c6qr-h5vq-59jc.md)
  `GHSA-c6qr-h5vq-59jc`, `CVE-2020-8185` · RubyGems `actionpack`: affected `>=6.0.0, <6.0.3.2`, fixed in `6.0.3.2` · CVSS 6.5 Medium · Not analysed yet · Published 24 Jun 2020 · Tags: Denial of service
- [Rack allows Percent-encoded cookies to overwrite existing prefixed cookie names](https://agentprime.io/advisories/GHSA-j6w9-fv6q-3q52.md)
  `GHSA-j6w9-fv6q-3q52`, `CVE-2020-8184` · RubyGems `rack`: affected `<2.1.4 || >=2.2.0, <2.2.3`, fixed in `2.1.4`, `2.2.3` · CVSS 7.5 High · Not analysed yet · Published 24 Jun 2020 · Tags: CWE-20, CWE-784
- [Cross-site Scripting in Sanitize](https://agentprime.io/advisories/GHSA-p4x4-rw2p-8j8m.md)
  `GHSA-p4x4-rw2p-8j8m`, `CVE-2020-4054` · RubyGems `sanitize`: affected `>=3.0.0, <5.2.1`, fixed in `5.2.1` · CVSS 7.3 High · Not analysed yet · Published 16 Jun 2020 · Tags: Cross-site scripting (XSS)
- [SQL Injection in Geocoder](https://agentprime.io/advisories/GHSA-864j-6qpp-cmrr.md)
  `GHSA-864j-6qpp-cmrr`, `CVE-2020-7981` · RubyGems `geocoder`: affected `<1.6.1`, fixed in `1.6.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Jun 2020 · Tags: SQL injection
- [Regular Expression Denial of Service in websocket-extensions (RubyGem)](https://agentprime.io/advisories/GHSA-g6wq-qcwm-j5g2.md)
  `GHSA-g6wq-qcwm-j5g2`, `CVE-2020-7663`, `SNYK-RUBY-WEBSOCKETEXTENSIONS-570830` · RubyGems `websocket-extensions`: affected `<0.1.5`, fixed in `0.1.5` · CVSS 8.2 High · Not analysed yet · Published 5 Jun 2020 · Tags: Denial of service
- [Cross-Site Scripting in Kaminari](https://agentprime.io/advisories/GHSA-r5jw-62xg-j433.md)
  `GHSA-r5jw-62xg-j433`, `CVE-2020-11082` · RubyGems `kaminari`: affected `<1.2.1`, fixed in `1.2.1` · CVSS 6.4 Medium · Not analysed yet · Published 28 May 2020 · Tags: Cross-site scripting (XSS)
- [Ability to forge per-form CSRF tokens in Rails](https://agentprime.io/advisories/GHSA-jp5v-5gx4-jmj9.md)
  `GHSA-jp5v-5gx4-jmj9`, `CVE-2020-8166` · RubyGems `actionpack`: affected `>=5.0.0, <5.2.4.3 || >=6.0.0, <6.0.3.1`, fixed in `5.2.4.3`, `6.0.3.1` · CVSS 4.3 Medium · Not analysed yet · Published 26 May 2020 · Tags: Cross-site request forgery (CSRF)
- [Circumvention of file size limits in ActiveStorage](https://agentprime.io/advisories/GHSA-m42x-37p3-fv5w.md)
  `GHSA-m42x-37p3-fv5w`, `CVE-2020-8162` · RubyGems `activestorage`: affected `>=5.0.0, <5.2.4.3 || >=6.0.0, <6.0.3.1`, fixed in `5.2.4.3`, `6.0.3.1` · CVSS 7.5 High · Not analysed yet · Published 26 May 2020 · Tags: Unrestricted file upload, CWE-602
- [Possible Strong Parameters Bypass in ActionPack](https://agentprime.io/advisories/GHSA-8727-m6gj-mc37.md)
  `GHSA-8727-m6gj-mc37`, `CVE-2020-8164` · RubyGems `actionpack`: affected `>=5.0.0, <5.2.4.3 || >=6.0.0, <6.0.3.1`, fixed in `5.2.4.3`, `6.0.3.1` · CVSS 7.5 High · Not analysed yet · Published 26 May 2020 · Tags: Insecure deserialization
- [ActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore](https://agentprime.io/advisories/GHSA-2p68-f74v-9wc6.md)
  `GHSA-2p68-f74v-9wc6`, `CVE-2020-8165` · RubyGems `activesupport`: affected `>=5.0.0, <5.2.4.3 || >=6.0.0, <6.0.3.1`, fixed in `5.2.4.3`, `6.0.3.1` · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.46 · Not analysed yet · Published 26 May 2020 · Tags: Insecure deserialization
- [HTTP Smuggling via Transfer-Encoding Header in Puma](https://agentprime.io/advisories/GHSA-w64w-qqph-5gxm.md)
  `GHSA-w64w-qqph-5gxm`, `CVE-2020-11077` · RubyGems `puma`: affected `<3.12.6 || >=4.0.0, <4.3.5`, fixed in `3.12.6`, `4.3.5` · CVSS 6.8 Medium · Not analysed yet · Published 22 May 2020 · Tags: HTTP request smuggling
- [HTTP Smuggling via Transfer-Encoding Header in Puma](https://agentprime.io/advisories/GHSA-x7jg-6pwg-fx5h.md)
  `GHSA-x7jg-6pwg-fx5h`, `CVE-2020-11076` · RubyGems `puma`: affected `<3.12.5 || >=4.0.0, <4.3.4`, fixed in `3.12.5`, `4.3.4` · CVSS 7.5 High · Not analysed yet · Published 22 May 2020 · Tags: HTTP request smuggling
- [Information disclosure issue in Active Resource](https://agentprime.io/advisories/GHSA-46j2-xjgp-jrfm.md)
  `GHSA-46j2-xjgp-jrfm`, `CVE-2020-8151` · RubyGems `activeresource`: affected `>=3.0.0.rc, <5.1.1`, fixed in `5.1.1` · CVSS 7.5 High · Not analysed yet · Published 21 May 2020 · Tags: Information disclosure, Broken access control
- [Cross-Site Scripting in jquery](https://agentprime.io/advisories/GHSA-q4m3-2j7h-f7xw.md)
  `GHSA-q4m3-2j7h-f7xw`, `CVE-2020-7656`, `SNYK-JS-JQUERY-569619` · Maven `org.webjars.npm:jquery` and 3 more: affected `>=1.2.1, <1.9.0`, fixed in `1.9.0` · CVSS 6.1 Medium · Not analysed yet · Published 20 May 2020 · Tags: Cross-site scripting (XSS)
- [Arbitrary file write in actionpack-page_caching gem](https://agentprime.io/advisories/GHSA-mg5p-95m9-rmfp.md)
  `GHSA-mg5p-95m9-rmfp`, `CVE-2020-8159` · RubyGems `actionpack-page_caching`: affected `<1.2.1`, fixed in `1.2.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 May 2020 · Tags: Path traversal
- [Improper Restriction of Excessive Authentication Attempts in Sorcery](https://agentprime.io/advisories/GHSA-jc8m-cxhj-668x.md)
  `GHSA-jc8m-cxhj-668x`, `CVE-2020-11052` · RubyGems `sorcery`: affected `<0.15.0`, fixed in `0.15.0` · CVSS 8.3 High · Not analysed yet · Published 7 May 2020 · Tags: Authentication bypass
- [Exposure of Sensitive Information to an Unauthorized Actor in Doorkeeper](https://agentprime.io/advisories/GHSA-j7vx-8mqj-cqp9.md)
  `GHSA-j7vx-8mqj-cqp9`, `CVE-2020-10187` · RubyGems `doorkeeper`: affected `>=5.0.0, <5.0.3 || >=5.1.0, <5.1.1 || >=5.2.0, <5.2.5 || >=5.3.0, <5.3.2`, fixed in `5.0.3`, `5.1.1`, `5.2.5`, `5.3.2` · CVSS 7.5 High · Not analysed yet · Published 7 May 2020 · Tags: Broken access control
- [Potential XSS vulnerability in jQuery](https://agentprime.io/advisories/GHSA-jpcq-cgw6-v4j6.md)
  `GHSA-jpcq-cgw6-v4j6`, `BIT-drupal-2020-11023`, `CVE-2020-11023`, `PKSA-jqsz-ykjr-qncb` · Maven `org.webjars.npm:jquery` and 4 more: affected `>=1.0.3, <3.5.0`, fixed in `3.5.0` · CVSS 6.9 Medium · Critical (KEV) · In CISA KEV · EPSS 0.85 · Not analysed yet · Published 29 Apr 2020 · Tags: Cross-site scripting (XSS)
- [Potential XSS vulnerability in jQuery](https://agentprime.io/advisories/GHSA-gxr4-xjj5-5px2.md)
  `GHSA-gxr4-xjj5-5px2`, `BIT-drupal-2020-11022`, `CVE-2020-11022`, `PKSA-dyrx-jq7h-gtxg`, `PKSA-jvpv-pcrn-dfzc`, `PKSA-t65n-1nj2-4tnr` · Maven `org.webjars.npm:jquery` and 6 more: affected `>=1.12.0, <3.5.0`, fixed in `3.5.0` · CVSS 6.9 Medium · EPSS 0.99 · Not analysed yet · Published 29 Apr 2020 · Tags: Cross-site scripting (XSS)
- [Authentication and extension bypass in Faye](https://agentprime.io/advisories/GHSA-qpg4-4w7w-2mq5.md)
  `GHSA-qpg4-4w7w-2mq5`, `CVE-2020-11020` · RubyGems `faye`: affected `>=0.5.0, <1.0.4 || >=1.1.0, <1.1.3 || >=1.2.0, <1.2.5`, fixed in `1.0.4`, `1.1.3`, `1.2.5` · CVSS 8.5 High · Not analysed yet · Published 29 Apr 2020 · Tags: Authentication bypass
- [BSON rubygem contains potential denial of service](https://agentprime.io/advisories/GHSA-qh4w-7pw3-p4rp.md)
  `GHSA-qh4w-7pw3-p4rp`, `CVE-2015-4411` · RubyGems `bson`: affected `<3.0.4`, fixed in `3.0.4` · CVSS 7.5 High · Not analysed yet · Published 29 Apr 2020 · Tags: Denial of service
- [Cross site scripting vulnerability in ActionView](https://agentprime.io/advisories/GHSA-65cv-r6x7-79hv.md)
  `GHSA-65cv-r6x7-79hv`, `CVE-2020-5267` · RubyGems `actionview`: affected `<5.2.4.2 || >=6.0.0, <6.0.2.2`, fixed in `5.2.4.2`, `6.0.2.2` · CVSS 4.0 Medium · Not analysed yet · Published 19 Mar 2020 · Tags: Cross-site scripting (XSS)
- [Sort order SQL injection in Administrate](https://agentprime.io/advisories/GHSA-2p5p-m353-833w.md)
  `GHSA-2p5p-m353-833w`, `CVE-2020-5257` · RubyGems `administrate`: affected `<0.13.0`, fixed in `0.13.0` · CVSS 7.7 High · Not analysed yet · Published 13 Mar 2020 · Tags: Other injection
- [Denial of Service in uap-core when processing crafted User-Agent strings](https://agentprime.io/advisories/GHSA-pcqq-5962-hvcw.md)
  `GHSA-pcqq-5962-hvcw` · RubyGems `user_agent_parser`: affected `<2.6.0`, fixed in `2.6.0` · No CVSS score · Not analysed yet · Published 10 Mar 2020
- [HTTP Response Splitting (Early Hints) in Puma](https://agentprime.io/advisories/GHSA-33vf-4xgg-9r58.md)
  `GHSA-33vf-4xgg-9r58`, `CVE-2020-5249` · RubyGems `puma`: affected `<3.12.4 || >=4.0.0, <4.3.3`, fixed in `3.12.4`, `4.3.3` · CVSS 6.5 Medium · Not analysed yet · Published 3 Mar 2020 · Tags: Other injection
- [OS Command Injection in Rake](https://agentprime.io/advisories/GHSA-jppv-gw3r-w3q8.md)
  `GHSA-jppv-gw3r-w3q8`, `CVE-2020-8130` · RubyGems `rake`: affected `<12.3.3`, fixed in `12.3.3` · CVSS 6.4 Medium · Not analysed yet · Published 28 Feb 2020 · Tags: Command injection
- [HTTP Response Splitting in Puma](https://agentprime.io/advisories/GHSA-84j7-475p-hp8v.md)
  `GHSA-84j7-475p-hp8v`, `BIT-ruby-2020-5247`, `BIT-ruby-min-2020-5247`, `CVE-2020-5247` · RubyGems `puma`: affected `<3.12.4 || >=4.0.0, <4.3.3`, fixed in `3.12.4`, `4.3.3` · CVSS 6.5 Medium · Not analysed yet · Published 28 Feb 2020 · Tags: Other injection
- [libxml as used in Nokogiri has an infinite loop in a certain end-of-file situation](https://agentprime.io/advisories/GHSA-7553-jr98-vx47.md)
  `GHSA-7553-jr98-vx47`, `CVE-2020-7595` · RubyGems `nokogiri`: affected `<1.10.8`, fixed in `1.10.8` · CVSS 7.5 High · Not analysed yet · Published 24 Feb 2020 · Tags: Denial of service
- [Denial of Service in uap-core when processing crafted User-Agent strings](https://agentprime.io/advisories/GHSA-cmcx-xhr8-3w9p.md)
  `GHSA-cmcx-xhr8-3w9p`, `CVE-2020-5243` · npm `uap-core` and 1 more: affected `<0.7.3`, fixed in `0.7.3` · CVSS 5.7 Medium · Not analysed yet · Published 20 Feb 2020 · Tags: Denial of service, CWE-20
- [BibTeX-Ruby vulnerable to OS command injection](https://agentprime.io/advisories/GHSA-c5r5-7pfh-6qg6.md)
  `GHSA-c5r5-7pfh-6qg6`, `CVE-2019-10780`, `SNYK-RUBY-BIBTEXRUBY-542602` · RubyGems `bibtex-ruby`: affected `<5.1.0`, fixed in `5.1.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Feb 2020 · Tags: Command injection
- [XSS/Script injection vulnerability in matestack](https://agentprime.io/advisories/GHSA-3jqw-vv45-mjhh.md)
  `GHSA-3jqw-vv45-mjhh`, `CVE-2020-5241` · RubyGems `matestack-ui-core`: affected `<0.7.4`, fixed in `0.7.4` · CVSS 7.7 High · Not analysed yet · Published 12 Feb 2020 · Tags: Cross-site scripting (XSS)
- [Directive injection when using dynamic overrides with user input](https://agentprime.io/advisories/GHSA-xq52-rv6w-397c.md)
  `GHSA-xq52-rv6w-397c`, `CVE-2020-5217` · RubyGems `secure_headers`: affected `<3.8.0 || >=5.0.0, <5.1.0 || >=6.0.0, <6.2.0`, fixed in `3.8.0`, `5.1.0`, `6.2.0` · CVSS 4.4 Medium · Not analysed yet · Published 23 Jan 2020 · Tags: Code injection
- [Limited header injection when using dynamic overrides with user input in RubyGems secure_headers](https://agentprime.io/advisories/GHSA-w978-rmpf-qmwg.md)
  `GHSA-w978-rmpf-qmwg`, `CVE-2020-5216` · RubyGems `secure_headers`: affected `<3.9.0 || >=5.0.0, <5.2.0 || >=6.0.0, <6.3.0`, fixed in `3.9.0`, `5.2.0`, `6.3.0` · CVSS 4.4 Medium · Not analysed yet · Published 23 Jan 2020 · Tags: Other injection
- [Prototype Pollution in handlebars](https://agentprime.io/advisories/GHSA-w457-6q6x-cgp9.md)
  `GHSA-w457-6q6x-cgp9`, `CVE-2019-19919` · npm `handlebars` and 1 more: affected `<3.0.8 || >=4.0.0, <4.3.0`, fixed in `3.0.8`, `4.3.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Dec 2019 · Tags: Other injection, Prototype pollution
- [Possible Information Leak / Session Hijack Vulnerability in Rack](https://agentprime.io/advisories/GHSA-hrqr-hxpp-chr3.md)
  `GHSA-hrqr-hxpp-chr3`, `CVE-2019-16782` · RubyGems `rack`: affected `<1.6.12 || >=2.0.0, <2.0.8`, fixed in `1.6.12`, `2.0.8` · CVSS 6.3 Medium · Not analysed yet · Published 18 Dec 2019 · Tags: Information disclosure, CWE-208
- [In RubyGem excon, interrupted Persistent Connections May Leak Response Data](https://agentprime.io/advisories/GHSA-q58g-455p-8vw9.md)
  `GHSA-q58g-455p-8vw9`, `CVE-2019-16779` · RubyGems `excon`: affected `<0.71.0`, fixed in `0.71.0` · CVSS 5.8 Medium · Not analysed yet · Published 16 Dec 2019 · Tags: Race condition, CWE-664
- [A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack](https://agentprime.io/advisories/GHSA-7xx3-m584-x994.md)
  `GHSA-7xx3-m584-x994`, `CVE-2019-16770` · RubyGems `puma`: affected `<3.12.2 || >=4.0.0, <4.3.1`, fixed in `3.12.2`, `4.3.1` · CVSS 5.3 Medium · Not analysed yet · Published 5 Dec 2019 · Tags: Denial of service
- [Prototype Pollution in chartkick](https://agentprime.io/advisories/GHSA-5pm8-492c-92p5.md)
  `GHSA-5pm8-492c-92p5`, `CVE-2019-18841` · npm `chartkick` and 1 more: affected `>=3.1.0, <3.2.0`, fixed in `3.2.0` · CVSS 7.3 High · Not analysed yet · Published 2 Dec 2019
- [The rack-cors rubygem may allow directory traveral](https://agentprime.io/advisories/GHSA-pf8f-w267-mq2h.md)
  `GHSA-pf8f-w267-mq2h`, `CVE-2019-18978` · RubyGems `rack-cors`: affected `<1.0.4`, fixed in `1.0.4` · CVSS 5.3 Medium · Not analysed yet · Published 15 Nov 2019 · Tags: Path traversal
- [JSON-jwt Gem lacked element count during splitting of JWE string](https://agentprime.io/advisories/GHSA-cff7-6h4q-q5pj.md)
  `GHSA-cff7-6h4q-q5pj`, `CVE-2019-18848` · RubyGems `json-jwt`: affected `<1.11.0`, fixed in `1.11.0` · CVSS 7.5 High · Not analysed yet · Published 14 Nov 2019 · Tags: Authentication bypass
- [Loofah Allows Cross-site Scripting](https://agentprime.io/advisories/GHSA-c3gv-9cxf-6f57.md)
  `GHSA-c3gv-9cxf-6f57`, `CVE-2019-15587` · RubyGems `loofah`: affected `<2.3.1`, fixed in `2.3.1` · CVSS 5.4 Medium · Not analysed yet · Published 5 Nov 2019 · Tags: Cross-site scripting (XSS)
- [Ruby_parser-legacy Incorrect Permission Assignment for Critical Resource](https://agentprime.io/advisories/GHSA-hhwc-8g49-j8jx.md)
  `GHSA-hhwc-8g49-j8jx`, `CVE-2019-18409` · RubyGems `ruby_parser-legacy`: affected `<=1.0.0`, no fixed version yet · CVSS 7.8 High · Not analysed yet · Published 25 Oct 2019 · Tags: Broken access control
- [Haml vulnerable to cross-site scripting](https://agentprime.io/advisories/GHSA-r53w-g4xm-3gc6.md)
  `GHSA-r53w-g4xm-3gc6`, `CVE-2017-1002201`, `SNYK-RUBY-HAML-20362` · RubyGems `haml`: affected `<5.0.0`, fixed in `5.0.0` · CVSS 6.1 Medium · Not analysed yet · Published 21 Oct 2019 · Tags: Cross-site scripting (XSS)
- [netaddr before 1.5.3 and 2.0.4 has Incorrect Default Permissions](https://agentprime.io/advisories/GHSA-49pj-69vf-c689.md)
  `GHSA-49pj-69vf-c689`, `CVE-2019-17383` · RubyGems `netaddr`: affected `<1.5.3 || >=2.0.0, <2.0.4`, fixed in `1.5.3`, `2.0.4` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2019 · Tags: Broken access control
- [Malicious URL drafting attack against iodines static file server may allow path traversal](https://agentprime.io/advisories/GHSA-85rf-xh54-whp3.md)
  `GHSA-85rf-xh54-whp3`, `CVE-2024-22050` · RubyGems `iodine`: affected `<0.7.34`, fixed in `0.7.34` · CVSS 7.5 High · Not analysed yet · Published 7 Oct 2019 · Tags: Path traversal
- [Improper Input Validation in simple_form](https://agentprime.io/advisories/GHSA-r74q-gxcg-73hx.md)
  `GHSA-r74q-gxcg-73hx`, `CVE-2019-16676` · RubyGems `simple_form`: affected `<5.0.0`, fixed in `5.0.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2019 · Tags: CWE-20
- [Rubyzip denial of service](https://agentprime.io/advisories/GHSA-5m2v-hc64-56h6.md)
  `GHSA-5m2v-hc64-56h6`, `CVE-2019-16892` · RubyGems `rubyzip`: affected `<1.3.0`, fixed in `1.3.0` · CVSS 5.5 Medium · Not analysed yet · Published 30 Sept 2019 · Tags: Denial of service
- [Consul gem insufficient authentication check - Multiple powers in one controller are not always checked correctly](https://agentprime.io/advisories/GHSA-8jhx-9gf4-hhf5.md)
  `GHSA-8jhx-9gf4-hhf5`, `CVE-2019-16377` · RubyGems `consul`: affected `<1.0.3`, fixed in `1.0.3` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Sept 2019 · Tags: Broken access control
- [Cross-site scripting in padrino-contrib](https://agentprime.io/advisories/GHSA-rwpr-83g3-96g7.md)
  `GHSA-rwpr-83g3-96g7`, `CVE-2019-16145` · RubyGems `padrino-contrib`: affected `<=0.2.0`, no fixed version yet · CVSS 6.1 Medium · Not analysed yet · Published 23 Sept 2019 · Tags: Cross-site scripting (XSS)
- [Authentication Bypass in Devise](https://agentprime.io/advisories/GHSA-fcjw-8rhj-gwwc.md)
  `GHSA-fcjw-8rhj-gwwc`, `CVE-2019-16109` · RubyGems `devise`: affected `<4.7.1`, fixed in `4.7.1` · CVSS 5.3 Medium · Not analysed yet · Published 11 Sept 2019 · Tags: Broken access control
- [Airbrake keys not being filtered](https://agentprime.io/advisories/GHSA-2p82-v77v-mppr.md)
  `GHSA-2p82-v77v-mppr`, `CVE-2019-16060` · RubyGems `airbrake-ruby`: affected `>=4.2.3, <4.2.4`, fixed in `4.2.4` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2019 · Tags: Information disclosure
- [Cross-site scripting in fat_free_crm](https://agentprime.io/advisories/GHSA-4p8f-mmfj-r45g.md)
  `GHSA-4p8f-mmfj-r45g`, `CVE-2018-20975` · RubyGems `fat_free_crm`: affected `<0.18.1`, fixed in `0.18.1` · CVSS 6.1 Medium · Not analysed yet · Published 21 Aug 2019 · Tags: Cross-site scripting (XSS)
- [rest-client Gem Contains Malicious Code](https://agentprime.io/advisories/GHSA-333g-rpr4-7hxq.md)
  `GHSA-333g-rpr4-7hxq`, `CVE-2019-15224` · RubyGems `awesome-bot` and 9 more: affected `*`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Aug 2019 · Tags: Code injection
- [Nokogiri Command Injection Vulnerability](https://agentprime.io/advisories/GHSA-cr5j-953j-xw5p.md)
  `GHSA-cr5j-953j-xw5p`, `CVE-2019-5477` · RubyGems `nokogiri` and 1 more: affected `<1.10.4`, fixed in `1.10.4` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2019 · Tags: Command injection

Newest: <https://agentprime.io/advisories/ecosystem/rubygems.md>
Older: <https://agentprime.io/advisories/ecosystem/rubygems.md?cursor=WyIyMDE5LTA4LTE5VDE5OjI3OjIzLjAwMDAwMFoiLCJHSFNBLWNyNWotOTUzai14dzVwIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=RubyGems&cursor=WyIyMDIwLTA3LTMxVDE3OjQwOjA0LjAwMDAwMFoiLCJHSFNBLTJ2NWMtNzU1cC1wNGd2Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/rubygems/?cursor=WyIyMDIwLTA3LTMxVDE3OjQwOjA0LjAwMDAwMFoiLCJHSFNBLTJ2NWMtNzU1cC1wNGd2Il0>. Everything for agents: <https://agentprime.io/llms.txt>.