# RubyGems Advisories.

Every RubyGems Advisory we hold (Ruby), newest first.

## Records, newest first (an older page)

- [Bundler allows attacker to inject arbitrary code via secondary Gem source](https://agentprime.io/advisories/GHSA-jvgm-pfqv-887x.md)
  `GHSA-jvgm-pfqv-887x`, `CVE-2016-7954` · RubyGems `bundler`: affected `>=1.0.0, <2.0.0`, fixed in `2.0.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 May 2022 · Tags: Code injection
- [Puppet uses predictable filenames, allowing arbitrary file overwrite](https://agentprime.io/advisories/GHSA-mpmx-gm5v-q789.md)
  `GHSA-mpmx-gm5v-q789`, `CVE-2011-3871` · RubyGems `puppet`: affected `<2.6.11 || >=2.7.0, <2.7.5`, fixed in `2.6.11`, `2.7.5` · No CVSS score · Not analysed yet · Published 14 May 2022 · Tags: CWE-340
- [Puppet does not properly restrict access to node resources](https://agentprime.io/advisories/GHSA-9pvx-fwwh-w289.md)
  `GHSA-9pvx-fwwh-w289`, `CVE-2011-0528` · RubyGems `puppet`: affected `>=2.6.0, <2.6.4`, fixed in `2.6.4` · No CVSS score · Not analysed yet · Published 14 May 2022 · Tags: Broken access control
- [Puppet allows local users to modify the permissions of arbitrary files](https://agentprime.io/advisories/GHSA-qh3g-27jf-3j54.md)
  `GHSA-qh3g-27jf-3j54`, `CVE-2011-3870` · RubyGems `puppet`: affected `<2.6.11 || >=2.7.0, <2.7.5`, fixed in `2.6.11`, `2.7.5` · No CVSS score · Not analysed yet · Published 14 May 2022 · Tags: Path traversal
- [Puppet arbitrary file overwrite](https://agentprime.io/advisories/GHSA-8c56-v25w-f89c.md)
  `GHSA-8c56-v25w-f89c`, `CVE-2011-3869` · RubyGems `puppet`: affected `<2.6.11 || >=2.7.0, <2.7.5`, fixed in `2.6.11`, `2.7.5` · No CVSS score · Not analysed yet · Published 14 May 2022 · Tags: Path traversal
- [Puppet Labs Facter allows local users to obtain sensitive Amazon EC2 IAM instance metadata](https://agentprime.io/advisories/GHSA-j436-h7hm-rx46.md)
  `GHSA-j436-h7hm-rx46`, `CVE-2015-1426` · RubyGems `facter`: affected `>=1.6.0, <2.4.1`, fixed in `2.4.1` · No CVSS score · Not analysed yet · Published 14 May 2022 · Tags: Information disclosure
- [Puppet Denial of Service and Arbitrary File Write](https://agentprime.io/advisories/GHSA-v58w-6xc2-w799.md)
  `GHSA-v58w-6xc2-w799`, `CVE-2012-1987` · RubyGems `puppet`: affected `>=2.6.0, <2.6.15 || >=2.7.0, <2.7.13`, fixed in `2.6.15`, `2.7.13` · No CVSS score · Not analysed yet · Published 14 May 2022 · Tags: Denial of service
- [Puppet uses predictable filenames, allowing arbitrary file overwrite](https://agentprime.io/advisories/GHSA-c4mc-49hq-q275.md)
  `GHSA-c4mc-49hq-q275`, `CVE-2012-1906` · RubyGems `puppet`: affected `>=2.6, <2.6.15 || >=2.7, <2.7.13`, fixed in `2.6.15`, `2.7.13` · No CVSS score · Not analysed yet · Published 14 May 2022 · Tags: CWE-377
- [Puppet Arbitrary Command Execution](https://agentprime.io/advisories/GHSA-6xxq-j39w-g3f6.md)
  `GHSA-6xxq-j39w-g3f6`, `CVE-2012-1988` · RubyGems `puppet`: affected `>=2.6.0, <2.6.15 || >=2.7.0, <2.7.13`, fixed in `2.6.15`, `2.7.13` · No CVSS score · Not analysed yet · Published 14 May 2022 · Tags: Command injection
- [Puppet Privilege Escallation](https://agentprime.io/advisories/GHSA-77hg-g8cc-5r37.md)
  `GHSA-77hg-g8cc-5r37`, `CVE-2012-1053` · RubyGems `puppet`: affected `>=2.6, <2.6.14 || >=2.7, <2.7.11`, fixed in `2.6.14`, `2.7.11` · No CVSS score · Not analysed yet · Published 14 May 2022 · Tags: Privilege escalation
- [Authlogic Information Exposure vulnerability](https://agentprime.io/advisories/GHSA-rx7j-mw4c-76g9.md)
  `GHSA-rx7j-mw4c-76g9`, `CVE-2012-6497` · RubyGems `authlogic`: affected `<3.3.0`, fixed in `3.3.0` · No CVSS score · Not analysed yet · Published 14 May 2022 · Tags: Information disclosure
- [Active Record component in Ruby on Rails has a data-type injection vulnerability](https://agentprime.io/advisories/GHSA-f57c-hx33-hvh8.md)
  `GHSA-f57c-hx33-hvh8`, `CVE-2013-3221` · RubyGems `activerecord`: affected `<4.2.0`, fixed in `4.2.0` · CVSS 4.0, no score published · Not analysed yet · Published 14 May 2022 · Tags: SQL injection, CWE-20
- [Asciidoctor Infinite Loop vulnerability](https://agentprime.io/advisories/GHSA-qc9p-mjxm-j2wj.md)
  `GHSA-qc9p-mjxm-j2wj`, `CVE-2018-18385` · RubyGems `asciidoctor`: affected `<1.5.8`, fixed in `1.5.8` · CVSS 7.5 High · Not analysed yet · Published 13 May 2022 · Tags: Denial of service
- [Ruby Openssl Allows Incorrect Value Comparison](https://agentprime.io/advisories/GHSA-mmrq-6999-72v8.md)
  `GHSA-mmrq-6999-72v8`, `CVE-2018-16395` · RubyGems `openssl`: affected `<2.0.9 || >=2.1.0, <2.1.2`, fixed in `2.0.9`, `2.1.2` · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.11 · Not analysed yet · Published 13 May 2022
- [Phusion Passenger incorrect permission assignment](https://agentprime.io/advisories/GHSA-4284-jfhc-f854.md)
  `GHSA-4284-jfhc-f854`, `CVE-2018-12615` · RubyGems `passenger`: affected `<5.3.2`, fixed in `5.3.2` · CVSS 5.3 Medium · Not analysed yet · Published 13 May 2022 · Tags: Broken access control
- [Insecure Permissions in Phusion Passenger](https://agentprime.io/advisories/GHSA-whfx-877c-5p28.md)
  `GHSA-whfx-877c-5p28`, `CVE-2018-12027` · RubyGems `passenger`: affected `>=5.3.0, <5.3.2`, fixed in `5.3.2` · CVSS 8.8 High · Not analysed yet · Published 13 May 2022 · Tags: Information disclosure
- [Incorrect Access Control in Phusion Passenger](https://agentprime.io/advisories/GHSA-jjhj-8gx7-x836.md)
  `GHSA-jjhj-8gx7-x836`, `CVE-2018-12028` · RubyGems `passenger`: affected `>=5.3.0, <5.3.2`, fixed in `5.3.2` · CVSS 7.8 High · Not analysed yet · Published 13 May 2022 · Tags: Broken access control
- [RubyGems Infinite Loop vulnerability](https://agentprime.io/advisories/GHSA-74pv-v9gh-h25p.md)
  `GHSA-74pv-v9gh-h25p`, `CVE-2018-1000075` · Maven `org.jruby:jruby-stdlib` and 1 more: affected `<9.1.16.0`, fixed in `9.1.16.0` · CVSS 7.5 High · Not analysed yet · Published 13 May 2022 · Tags: Denial of service
- [Tarball permission preservation in puppet](https://agentprime.io/advisories/GHSA-vw22-465p-8j5w.md)
  `GHSA-vw22-465p-8j5w`, `CVE-2017-10689` · RubyGems `puppet`: affected `<4.10.10 || >=5.0.0, <5.3.4`, fixed in `4.10.10`, `5.3.4` · CVSS 5.5 Medium · Not analysed yet · Published 13 May 2022 · Tags: Privilege escalation
- [Logstash Logs Sensitive Information](https://agentprime.io/advisories/GHSA-3gg4-6hqg-2vjx.md)
  `GHSA-3gg4-6hqg-2vjx`, `CVE-2016-10362` · RubyGems `logstash-core`: affected `<5.0.1`, fixed in `5.0.1` · CVSS 6.5 Medium · Not analysed yet · Published 13 May 2022 · Tags: Information disclosure
- [RubyGems may allow a maliciously crafted gem to overwrite files](https://agentprime.io/advisories/GHSA-pm9x-4392-2c2p.md)
  `GHSA-pm9x-4392-2c2p`, `CVE-2017-0901` · RubyGems `rubygems-update`: affected `<2.6.13`, fixed in `2.6.13` · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.29 · Not analysed yet · Published 13 May 2022 · Tags: Path traversal, CWE-20
- [RubyGems vulnerable to Deserialization of Untrusted Data](https://agentprime.io/advisories/GHSA-mqwr-4qf2-2hcv.md)
  `GHSA-mqwr-4qf2-2hcv`, `CVE-2017-0903` · RubyGems `rubygems-update`: affected `>=2.0.0, <2.6.14`, fixed in `2.6.14` · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.16 · Not analysed yet · Published 13 May 2022 · Tags: Insecure deserialization
- [RubyGems Code Injection vulnerability](https://agentprime.io/advisories/GHSA-7gcp-2gmq-w3xh.md)
  `GHSA-7gcp-2gmq-w3xh`, `CVE-2017-0899` · RubyGems `rubygems-update`: affected `<2.6.13`, fixed in `2.6.13` · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.11 · Not analysed yet · Published 13 May 2022 · Tags: Code injection, CWE-150
- [RubyGems has Origin Validation Error vulnerability](https://agentprime.io/advisories/GHSA-73w7-6w9g-gc8w.md)
  `GHSA-73w7-6w9g-gc8w`, `CVE-2017-0902` · RubyGems `rubygems-update`: affected `<2.6.13`, fixed in `2.6.13` · CVSS 8.1 High · Not analysed yet · Published 13 May 2022 · Tags: CWE-346, CWE-350
- [katello Improper Privilege Management vulnerability](https://agentprime.io/advisories/GHSA-cpv6-pfq6-j2v7.md)
  `GHSA-cpv6-pfq6-j2v7`, `CVE-2017-2662` · RubyGems `katello`: affected `<3.17.0.rc1`, fixed in `3.17.0.rc1` · CVSS 4.3 Medium · Not analysed yet · Published 13 May 2022 · Tags: Privilege escalation, Broken access control
- [hammer_cli_foreman Improper Certificate Validation vulnerability](https://agentprime.io/advisories/GHSA-77h8-xr85-3x5q.md)
  `GHSA-77h8-xr85-3x5q`, `CVE-2017-2667` · RubyGems `hammer_cli_foreman`: affected `<0.10.0`, fixed in `0.10.0` · CVSS 8.1 High · Not analysed yet · Published 13 May 2022 · Tags: Weak cryptography or TLS, CWE-345
- [katello SQL Injection vulnerability](https://agentprime.io/advisories/GHSA-jx5v-788g-qw58.md)
  `GHSA-jx5v-788g-qw58`, `CVE-2018-14623` · RubyGems `katello`: affected `<=3.10`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 13 May 2022 · Tags: SQL injection, Information disclosure
- [Gem in a Box vulnerable to Cross-site Request Forgery](https://agentprime.io/advisories/GHSA-qwv2-2x8g-g43g.md)
  `GHSA-qwv2-2x8g-g43g`, `CVE-2017-14683` · RubyGems `geminabox`: affected `<0.13.7`, fixed in `0.13.7` · CVSS 8.8 High · Not analysed yet · Published 13 May 2022 · Tags: Cross-site request forgery (CSRF)
- [Gem in a Box vulnerable to Cross-site Scripting](https://agentprime.io/advisories/GHSA-98hq-3qvg-pg78.md)
  `GHSA-98hq-3qvg-pg78`, `CVE-2017-14506` · RubyGems `geminabox`: affected `<0.13.6`, fixed in `0.13.6` · CVSS 5.4 Medium · Not analysed yet · Published 13 May 2022 · Tags: Cross-site scripting (XSS)
- [Phusion Passenger information disclosure](https://agentprime.io/advisories/GHSA-cv3f-px9r-54hm.md)
  `GHSA-cv3f-px9r-54hm`, `CVE-2017-16355` · RubyGems `passenger`: affected `<5.1.11`, fixed in `5.1.11` · CVSS 4.7 Medium · Not analysed yet · Published 13 May 2022 · Tags: Information disclosure
- [Nokogiri vulnerable to libxslt protection mechanism bypass](https://agentprime.io/advisories/GHSA-qxcg-xjjg-66mj.md)
  `GHSA-qxcg-xjjg-66mj`, `CVE-2019-11068` · RubyGems `nokogiri`: affected `<1.10.3`, fixed in `1.10.3` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 May 2022
- [RubyGems Link Following vulnerability](https://agentprime.io/advisories/GHSA-gx69-6cp4-hxrj.md)
  `GHSA-gx69-6cp4-hxrj`, `CVE-2018-1000073` · Maven `org.jruby:jruby-stdlib` and 1 more: affected `<9.1.16.0`, fixed in `9.1.16.0` · CVSS 7.5 High · Not analysed yet · Published 13 May 2022 · Tags: Path traversal
- [smalruby and smalruby-editor vulnerable to OS Command Injection](https://agentprime.io/advisories/GHSA-f489-655r-x6gr.md)
  `GHSA-f489-655r-x6gr`, `CVE-2017-2096` · RubyGems `smalruby` and 1 more: affected `<0.1.11`, fixed in `0.1.11` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 May 2022 · Tags: Command injection
- [open-uri-cached Gem for Ruby Unsafe Temporary File Creation Enables Code Execution](https://agentprime.io/advisories/GHSA-7m2w-9gw7-c3xp.md)
  `GHSA-7m2w-9gw7-c3xp`, `CVE-2015-3649` · RubyGems `open-uri-cached`: affected `<=1.0.0`, no fixed version yet · CVSS 7.8 High · Not analysed yet · Published 13 May 2022 · Tags: CWE-20
- [mixlib-archive Path Traversal vulnerability](https://agentprime.io/advisories/GHSA-98wx-cw86-c97x.md)
  `GHSA-98wx-cw86-c97x`, `CVE-2017-1000026` · RubyGems `mixlib-archive`: affected `<0.4.0`, fixed in `0.4.0` · CVSS 7.5 High · Not analysed yet · Published 13 May 2022 · Tags: Path traversal
- [Bootstrap vulnerable to Cross-Site Scripting (XSS)](https://agentprime.io/advisories/GHSA-3wqf-4x89-9g79.md)
  `GHSA-3wqf-4x89-9g79`, `CVE-2018-14040`, `PKSA-br4g-j817-6t7w` · Maven `org.webjars:bootstrap` and 6 more: affected `>=4.0.0, <4.1.2 || >=2.3.0, <3.4.0`, fixed in `4.1.2`, `3.4.0` · CVSS 6.1 Medium · Not analysed yet · Published 13 May 2022 · Tags: Cross-site scripting (XSS)
- [Fluentd Escape Sequence Injection Vulnerability](https://agentprime.io/advisories/GHSA-5jrp-w8fr-mrww.md)
  `GHSA-5jrp-w8fr-mrww`, `CVE-2017-10906` · RubyGems `fluentd`: affected `>=0.12.29, <0.12.41`, fixed in `0.12.41` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 May 2022
- [Puppet Improper Access Control](https://agentprime.io/advisories/GHSA-pqj5-7r86-64fv.md)
  `GHSA-pqj5-7r86-64fv`, `CVE-2016-2785` · RubyGems `puppet`: affected `>=4.0.0, <4.4.2`, fixed in `4.4.2` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 May 2022 · Tags: Broken access control
- [Camaleon CMS vulnerable to Stored Cross-site Scripting](https://agentprime.io/advisories/GHSA-7f84-9cqf-g4j9.md)
  `GHSA-7f84-9cqf-g4j9`, `CVE-2018-18260` · RubyGems `camaleon_cms`: affected `=2.4`, no fixed version yet · CVSS 6.1 Medium · Not analysed yet · Published 13 May 2022 · Tags: Cross-site scripting (XSS)
- [Nokogiri gem, via libxml, is affected by DoS vulnerabilities](https://agentprime.io/advisories/GHSA-x2fm-93ww-ggvx.md)
  `GHSA-x2fm-93ww-ggvx`, `CVE-2017-16932` · RubyGems `nokogiri`: affected `<1.8.1`, fixed in `1.8.1` · CVSS 7.5 High · Not analysed yet · Published 13 May 2022 · Tags: Denial of service
- [Bundler may install gems from a different source than expected](https://agentprime.io/advisories/GHSA-49jx-9cmc-xjxm.md)
  `GHSA-49jx-9cmc-xjxm`, `CVE-2013-0334` · RubyGems `bundler`: affected `<1.7.0`, fixed in `1.7.0` · No CVSS score · Not analysed yet · Published 5 May 2022 · Tags: CWE-20
- [Rack arbitrary code execution via timing attack](https://agentprime.io/advisories/GHSA-xc85-32mf-xpv8.md)
  `GHSA-xc85-32mf-xpv8`, `CVE-2013-0263` · RubyGems `rack`: affected `>=1.1.0, <1.1.6 || >=1.2.0, <1.2.8 || >=1.3.0, <1.3.10 || >=1.4.0, <1.4.5 || >=1.5.0, <1.5.2`, fixed in `1.1.6`, `1.2.8`, `1.3.10`, `1.4.5`, `1.5.2` · No CVSS score · Not analysed yet · Published 5 May 2022
- [Rack vulnerable to Denial of Service](https://agentprime.io/advisories/GHSA-v882-ccj6-jc48.md)
  `GHSA-v882-ccj6-jc48`, `CVE-2013-0184` · RubyGems `rack`: affected `>=1.1.0, <1.1.5 || >=1.2.0, <1.2.7 || >=1.3.0, <1.3.9 || >=1.4.0, <1.4.4`, fixed in `1.1.5`, `1.2.7`, `1.3.9`, `1.4.4` · No CVSS score · Not analysed yet · Published 5 May 2022
- [ruby_parser allows local users to overwrite arbitrary files via symlink attack on temporary file with predictable name](https://agentprime.io/advisories/GHSA-8mvw-22r7-w6fq.md)
  `GHSA-8mvw-22r7-w6fq`, `CVE-2013-0162` · RubyGems `ruby_parser`: affected `>=2.0.2, <3.1.2`, fixed in `3.1.2` · No CVSS score · Not analysed yet · Published 5 May 2022 · Tags: CWE-377
- [PDFKit Improper Input Validation vulnerability](https://agentprime.io/advisories/GHSA-39v7-xpq4-8884.md)
  `GHSA-39v7-xpq4-8884`, `CVE-2013-1607` · RubyGems `pdfkit`: affected `<0.5.3`, fixed in `0.5.3` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 May 2022 · Tags: CWE-20
- [Features file injection vulnerability](https://agentprime.io/advisories/GHSA-42gq-h7xj-33r4.md)
  `GHSA-42gq-h7xj-33r4`, `CVE-2013-4318` · RubyGems `features`: affected `<=0.3.0`, no fixed version yet · CVSS 5.4 Medium · Not analysed yet · Published 5 May 2022 · Tags: Other injection
- [omniauth-facebook Improper Authentication vulnerability](https://agentprime.io/advisories/GHSA-33vg-hpx5-pfxg.md)
  `GHSA-33vg-hpx5-pfxg`, `CVE-2013-4593` · RubyGems `omniauth-facebook`: affected `<1.5.1`, fixed in `1.5.1` · CVSS 7.5 High · Not analysed yet · Published 5 May 2022 · Tags: Authentication bypass
- [RubyGem openshift-origin-controller is vulnerable to command injection](https://agentprime.io/advisories/GHSA-77xq-7c6p-6xp6.md)
  `GHSA-77xq-7c6p-6xp6`, `CVE-2013-2095` · RubyGems `openshift-origin-controller`: affected `<=1.3.4`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 May 2022 · Tags: Other injection
- [Nokogiri vulnerable to DoS while parsing XML entities](https://agentprime.io/advisories/GHSA-jmhh-w7xp-wg39.md)
  `GHSA-jmhh-w7xp-wg39`, `CVE-2013-6461` · RubyGems `nokogiri`: affected `>=1.5.0, <1.5.11 || >=1.6.0, <1.6.1`, fixed in `1.5.11`, `1.6.1` · CVSS 6.5 Medium · Not analysed yet · Published 5 May 2022 · Tags: Denial of service
- [Nokogiri vulnerable to DoS while parsing XML documents](https://agentprime.io/advisories/GHSA-62qp-3fxm-9wxf.md)
  `GHSA-62qp-3fxm-9wxf`, `CVE-2013-6460` · RubyGems `nokogiri`: affected `>=1.5.0, <1.5.11 || >=1.6.0, <1.6.1`, fixed in `1.5.11`, `1.6.1` · CVSS 6.5 Medium · Not analysed yet · Published 5 May 2022 · Tags: Denial of service
- [CSV-Safe improperly filters special characters potentially leading to CSV injection](https://agentprime.io/advisories/GHSA-f55g-x8qq-2569.md)
  `GHSA-f55g-x8qq-2569`, `CVE-2022-28481` · RubyGems `csv-safe`: affected `<3.0.0`, fixed in `3.0.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 May 2022 · Tags: Other injection
- [sinatra does not validate expanded path matches](https://agentprime.io/advisories/GHSA-qp49-3pvw-x4m5.md)
  `GHSA-qp49-3pvw-x4m5`, `CVE-2022-29970` · RubyGems `sinatra`: affected `<2.2.0`, fixed in `2.2.0` · CVSS 7.5 High · Not analysed yet · Published 3 May 2022 · Tags: Path traversal, CWE-426
- [Puppet arbitrary files overwrite via a symlink attack](https://agentprime.io/advisories/GHSA-vrh7-99jh-3fmm.md)
  `GHSA-vrh7-99jh-3fmm`, `CVE-2010-0156` · RubyGems `puppet`: affected `>=0.24.0, <0.24.9 || >=0.25.0, <0.25.2`, fixed in `0.24.9`, `0.25.2` · No CVSS score · Not analysed yet · Published 2 May 2022 · Tags: Path traversal
- [WEBrick Denial of Service Vulnerability](https://agentprime.io/advisories/GHSA-wfrc-r6c6-7j9r.md)
  `GHSA-wfrc-r6c6-7j9r`, `CVE-2008-4310` · RubyGems `webrick`: affected `<1.3.1`, fixed in `1.3.1` · No CVSS score · EPSS 0.14 · Not analysed yet · Published 2 May 2022 · Tags: Denial of service
- [Mongrel vulnerable to directory traversal via double-encoded sequences](https://agentprime.io/advisories/GHSA-m7r6-43v2-49vf.md)
  `GHSA-m7r6-43v2-49vf`, `CVE-2007-6612` · RubyGems `mongrel`: affected `>=1.0.4, <1.0.5 || >=1.1.0, <1.1.3`, fixed in `1.0.5`, `1.1.3` · No CVSS score · Not analysed yet · Published 1 May 2022 · Tags: Path traversal
- [RubyGems file overwrite vulnerability](https://agentprime.io/advisories/GHSA-95vx-q4c2-64gr.md)
  `GHSA-95vx-q4c2-64gr`, `CVE-2007-0469` · RubyGems `rubygems-update`: affected `<0.9.1`, fixed in `0.9.1` · No CVSS score · Not analysed yet · Published 1 May 2022
- [XSS Vulnerability in Action View tag helpers](https://agentprime.io/advisories/GHSA-ch3h-j2vf-95pv.md)
  `GHSA-ch3h-j2vf-95pv`, `CVE-2022-27777` · RubyGems `actionview`: affected `<5.2.7.1 || >=6.0.0, <6.0.4.8 || >=6.1.0, <6.1.5.1 || >=7.0.0, <7.0.2.4`, fixed in `5.2.7.1`, `6.0.4.8`, `6.1.5.1`, `7.0.2.4` · CVSS 6.1 Medium · Not analysed yet · Published 27 Apr 2022 · Tags: Cross-site scripting (XSS)
- [Cross-site Scripting Vulnerability in Action Pack](https://agentprime.io/advisories/GHSA-mm33-5vfq-3mm3.md)
  `GHSA-mm33-5vfq-3mm3`, `CVE-2022-22577` · RubyGems `actionpack`: affected `>=5.2.0, <5.2.7.1 || >=6.0.0, <6.0.4.8 || >=6.1.0, <6.1.5.1 || >=7.0.0, <7.0.2.4`, fixed in `5.2.7.1`, `6.0.4.8`, `6.1.5.1`, `7.0.2.4` · CVSS 6.1 Medium · Not analysed yet · Published 27 Apr 2022 · Tags: Cross-site scripting (XSS)
- [Server side request forgery in gibbon](https://agentprime.io/advisories/GHSA-vx9g-377x-xwxq.md)
  `GHSA-vx9g-377x-xwxq`, `CVE-2022-27311` · RubyGems `gibbon`: affected `<3.4.4`, fixed in `3.4.4` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Apr 2022 · Tags: Server-side request forgery (SSRF)
- [Nokogiri is vulnerable to XML External Entity (XXE) attack](https://agentprime.io/advisories/GHSA-6wj9-77wq-jq7p.md)
  `GHSA-6wj9-77wq-jq7p`, `CVE-2012-6685` · RubyGems `nokogiri`: affected `<1.5.4`, fixed in `1.5.4` · CVSS 7.5 High · Not analysed yet · Published 23 Apr 2022 · Tags: Denial of service

Newest: <https://agentprime.io/advisories/ecosystem/rubygems.md>
Older: <https://agentprime.io/advisories/ecosystem/rubygems.md?cursor=WyIyMDIyLTA0LTIzVDAwOjQwOjQ1LjAwMDAwMFoiLCJHSFNBLTZ3ajktNzd3cS1qcTdwIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=RubyGems&cursor=WyIyMDIyLTA1LTE0VDAwOjU4OjEyLjAwMDAwMFoiLCJHSFNBLXZjbW0tcHBxeC05NWNoIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/rubygems/?cursor=WyIyMDIyLTA1LTE0VDAwOjU4OjEyLjAwMDAwMFoiLCJHSFNBLXZjbW0tcHBxeC05NWNoIl0>. Everything for agents: <https://agentprime.io/llms.txt>.