# RubyGems Advisories.

Every RubyGems Advisory we hold (Ruby), newest first.

## Records, newest first (an older page)

- [spree_auth_devise allows remote authenticated users to assign themselves arbitrary roles](https://agentprime.io/advisories/GHSA-jp57-9j37-5476.md)
  `GHSA-jp57-9j37-5476`, `CVE-2013-2506` · RubyGems `spree_auth_devise`: affected `>=1.0.0, <3.0.5`, fixed in `3.0.5` · No CVSS score · Not analysed yet · Published 17 May 2022
- [Katello uses hard coded credential](https://agentprime.io/advisories/GHSA-5xv2-q475-rwrh.md)
  `GHSA-5xv2-q475-rwrh`, `CVE-2012-3503` · RubyGems `katello`: affected `<1.0.6 || >=1.1.0, <1.1.7`, fixed in `1.0.6`, `1.1.7` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 May 2022 · Tags: Hard-coded credentials
- [Rack-Cache caches sensitive headers](https://agentprime.io/advisories/GHSA-hrp6-w4v2-8737.md)
  `GHSA-hrp6-w4v2-8737`, `CVE-2012-2671` · RubyGems `rack-cache`: affected `>=0.3.0, <1.2`, fixed in `1.2` · No CVSS score · Not analysed yet · Published 17 May 2022 · Tags: CWE-525
- [Rack Gem Subject to Denial of Service via Hash Collisions](https://agentprime.io/advisories/GHSA-v6j3-7jrw-hq2p.md)
  `GHSA-v6j3-7jrw-hq2p`, `CVE-2011-5036` · Maven `org.jruby:jruby-parent` and 1 more: affected `<1.6.5.1`, fixed in `1.6.5.1` · No CVSS score · Not analysed yet · Published 17 May 2022 · Tags: Weak cryptography or TLS, Denial of service
- [Sup Code Injection vulnerability](https://agentprime.io/advisories/GHSA-5f2p-6vjv-2q2m.md)
  `GHSA-5f2p-6vjv-2q2m`, `CVE-2013-4478` · RubyGems `sup`: affected `<0.13.2.1 || >=0.14.0, <0.14.1.1`, fixed in `0.13.2.1`, `0.14.1.1` · No CVSS score · Not analysed yet · Published 17 May 2022 · Tags: Code injection
- [Fat Free CRM contains Cross-site Request Forgery vulnerablilities](https://agentprime.io/advisories/GHSA-mcvq-7xjq-46x6.md)
  `GHSA-mcvq-7xjq-46x6`, `CVE-2013-7223` · RubyGems `fat_free_crm`: affected `<0.12.1`, fixed in `0.12.1` · No CVSS score · Not analysed yet · Published 17 May 2022 · Tags: Cross-site request forgery (CSRF)
- [Fat Free CRM has fixed token value](https://agentprime.io/advisories/GHSA-g897-cgfc-7q8v.md)
  `GHSA-g897-cgfc-7q8v`, `CVE-2013-7222` · RubyGems `fat_free_crm`: affected `<0.12.1`, fixed in `0.12.1` · No CVSS score · Not analysed yet · Published 17 May 2022 · Tags: Weak cryptography or TLS
- [Fat Free CRM vulnerable to Exposure of Sensitive Information](https://agentprime.io/advisories/GHSA-f25h-3mj6-4jpg.md)
  `GHSA-f25h-3mj6-4jpg`, `CVE-2013-7249` · RubyGems `fat_free_crm`: affected `<0.12.1`, fixed in `0.12.1` · No CVSS score · Not analysed yet · Published 17 May 2022 · Tags: Information disclosure
- [Fat Free CRM vulnerable to SQL Injection](https://agentprime.io/advisories/GHSA-9ggp-5rf4-x7q9.md)
  `GHSA-9ggp-5rf4-x7q9`, `CVE-2013-7225` · RubyGems `fat_free_crm`: affected `<0.12.1`, fixed in `0.12.1` · No CVSS score · Not analysed yet · Published 17 May 2022 · Tags: SQL injection
- [Fat Free CRM allows remote attackers to obtain sensitive information via a direct request](https://agentprime.io/advisories/GHSA-4xq9-vw89-p5cx.md)
  `GHSA-4xq9-vw89-p5cx`, `CVE-2013-7224` · RubyGems `fat_free_crm`: affected `<0.12.1`, fixed in `0.12.1` · No CVSS score · Not analysed yet · Published 17 May 2022 · Tags: Information disclosure
- [RubyGems HTTPS to HTTP redirect](https://agentprime.io/advisories/GHSA-228f-g3h7-3fj3.md)
  `GHSA-228f-g3h7-3fj3`, `CVE-2012-2125` · RubyGems `rubygems-update`: affected `<1.8.23`, fixed in `1.8.23` · No CVSS score · Not analysed yet · Published 17 May 2022
- [RubyGems does not verify SSL certificate](https://agentprime.io/advisories/GHSA-5mgj-mvv8-46mw.md)
  `GHSA-5mgj-mvv8-46mw`, `CVE-2012-2126` · RubyGems `rubygems-update`: affected `<1.8.23`, fixed in `1.8.23` · No CVSS score · Not analysed yet · Published 17 May 2022
- [Kafo allows local users to obtain passwords and other sensitive information by reading default_values.yaml](https://agentprime.io/advisories/GHSA-hxvp-655x-xxqv.md)
  `GHSA-hxvp-655x-xxqv`, `CVE-2014-0135` · RubyGems `kafo`: affected `<0.3.17 || >=0.4.0, <0.5.2`, fixed in `0.3.17`, `0.5.2` · No CVSS score · Not analysed yet · Published 17 May 2022
- [GitLab Grit Gem for Ruby contains a flaw allowing arbitrary commands to be executed](https://agentprime.io/advisories/GHSA-95xq-v4m2-fq3r.md)
  `GHSA-95xq-v4m2-fq3r`, `CVE-2013-4489` · RubyGems `gitlab-grit`: affected `<2.6.1`, fixed in `2.6.1` · No CVSS score · Not analysed yet · Published 17 May 2022 · Tags: CWE-20
- [Fat Free CRM subject to Cross-site Scripting](https://agentprime.io/advisories/GHSA-wcfx-3m6v-4frg.md)
  `GHSA-wcfx-3m6v-4frg`, `CVE-2014-5441` · RubyGems `fat_free_crm`: affected `>=0.11.1, <0.13.3`, fixed in `0.13.3` · No CVSS score · Not analysed yet · Published 17 May 2022 · Tags: Cross-site scripting (XSS)
- [Sup Code Injection vulnerability](https://agentprime.io/advisories/GHSA-hh2x-7mf9-78fr.md)
  `GHSA-hh2x-7mf9-78fr`, `CVE-2013-4479` · RubyGems `sup`: affected `<0.13.2.1 || >=0.14.0, <0.14.1.1`, fixed in `0.13.2.1`, `0.14.1.1` · No CVSS score · Not analysed yet · Published 17 May 2022 · Tags: Code injection
- [Karteek Docsplit vulnerable to OS Command Injection](https://agentprime.io/advisories/GHSA-4fvg-pwv7-v54g.md)
  `GHSA-4fvg-pwv7-v54g`, `CVE-2013-1933` · RubyGems `karteek-docsplit`: affected `<=0.5.4`, no fixed version yet · No CVSS score · Not analysed yet · Published 17 May 2022 · Tags: Command injection
- [ccsv Double Free vulnerability](https://agentprime.io/advisories/GHSA-5gxp-c379-pj42.md)
  `GHSA-5gxp-c379-pj42`, `CVE-2017-15364` · RubyGems `ccsv`: affected `<=1.1.0`, no fixed version yet · CVSS 5.5 Medium · Not analysed yet · Published 17 May 2022 · Tags: Memory corruption
- [RubyGems Improper Input Validation vulnerability](https://agentprime.io/advisories/GHSA-qv62-xfj6-32xm.md)
  `GHSA-qv62-xfj6-32xm`, `CVE-2015-4020` · RubyGems `rubygems-update`: affected `<2.0.17 || >=2.1.0.rc.1, <2.2.5 || >=2.3.0, <2.4.8`, fixed in `2.0.17`, `2.2.5`, `2.4.8` · No CVSS score · Not analysed yet · Published 17 May 2022 · Tags: CWE-20
- [RubyGems Regular Expression Denial of Service](https://agentprime.io/advisories/GHSA-9qvm-2vhf-q649.md)
  `GHSA-9qvm-2vhf-q649`, `CVE-2013-4363` · RubyGems `rubygems-update`: affected `<1.8.23.2 || >=1.8.24, <1.8.27 || >=2.0.0, <2.0.10 || >=2.1.0, <2.1.5`, fixed in `1.8.23.2`, `1.8.27`, `2.0.10`, `2.1.5` · No CVSS score · Not analysed yet · Published 17 May 2022
- [Publify exposes article metadata](https://agentprime.io/advisories/GHSA-5jm7-g527-m694.md)
  `GHSA-5jm7-g527-m694`, `BIT-publify-2022-1553`, `CVE-2022-1553` · RubyGems `publify_core`: affected `<9.2.8`, fixed in `9.2.8` · CVSS 8.8 High · Not analysed yet · Published 17 May 2022 · Tags: Broken access control
- [Publify vulnerable to code injection](https://agentprime.io/advisories/GHSA-w78q-4w34-jrjx.md)
  `GHSA-w78q-4w34-jrjx`, `BIT-publify-2022-0578`, `CVE-2022-0578` · RubyGems `publify_core`: affected `<9.2.8`, fixed in `9.2.8` · CVSS 5.3 Medium · Not analysed yet · Published 17 May 2022 · Tags: Code injection
- [Publify Incorrect Authorization](https://agentprime.io/advisories/GHSA-79m3-q3wh-c3qm.md)
  `GHSA-79m3-q3wh-c3qm`, `BIT-publify-2022-0574`, `CVE-2022-0574` · RubyGems `publify_core`: affected `<9.2.8`, fixed in `9.2.8` · CVSS 5.3 Medium · Not analysed yet · Published 17 May 2022 · Tags: Broken access control
- [VladTheEnterprising allows local users to write to arbitrary files via a symlink attack](https://agentprime.io/advisories/GHSA-x4vj-279x-qwf2.md)
  `GHSA-x4vj-279x-qwf2`, `CVE-2014-4996` · RubyGems `VladTheEnterprising`: affected `<=0.2`, no fixed version yet · CVSS 5.5 Medium · Not analysed yet · Published 14 May 2022 · Tags: Path traversal
- [backup-agoddard and backup_checksum have Information Exposure vulnerability](https://agentprime.io/advisories/GHSA-wr5j-q359-6vr2.md)
  `GHSA-wr5j-q359-6vr2`, `CVE-2014-4993` · RubyGems `backup-agoddard` and 1 more: affected `<=3.0.28`, no fixed version yet · CVSS 7.8 High · Not analysed yet · Published 14 May 2022 · Tags: Information disclosure
- [codders-dataset Process Table Local Plaintext Credential Disclosure](https://agentprime.io/advisories/GHSA-w9vv-fvw8-j6q3.md)
  `GHSA-w9vv-fvw8-j6q3`, `CVE-2014-4991` · RubyGems `codders-dataset`: affected `<=1.3.2.1`, no fixed version yet · CVSS 7.8 High · Not analysed yet · Published 14 May 2022 · Tags: Information disclosure
- [VladTheEnterprising allows local users to obtain sensitive information by reading MySQL root password from temporary file](https://agentprime.io/advisories/GHSA-86cf-g34f-7462.md)
  `GHSA-86cf-g34f-7462`, `CVE-2014-4995` · RubyGems `VladTheEnterprising`: affected `<=0.2`, no fixed version yet · CVSS 7.0 High · Not analysed yet · Published 14 May 2022 · Tags: Information disclosure
- [point-cli allows local users to obtain sensitive information by listing the process](https://agentprime.io/advisories/GHSA-mc8m-x6hf-cw2g.md)
  `GHSA-mc8m-x6hf-cw2g`, `CVE-2014-4997` · RubyGems `point-cli`: affected `<=0.0.1`, no fixed version yet · CVSS 7.8 High · Not analysed yet · Published 14 May 2022 · Tags: Information disclosure
- [kajam allows local users to obtain sensitive information by listing the process](https://agentprime.io/advisories/GHSA-4ph7-5c44-pppv.md)
  `GHSA-4ph7-5c44-pppv`, `CVE-2014-4999` · RubyGems `kajam`: affected `<=1.0.3.rc2`, no fixed version yet · CVSS 7.8 High · Not analysed yet · Published 14 May 2022 · Tags: Information disclosure
- [lean-ruport allows local users to obtain sensitive information by listing the process](https://agentprime.io/advisories/GHSA-5g7f-p7jg-v6mv.md)
  `GHSA-5g7f-p7jg-v6mv`, `CVE-2014-4998` · RubyGems `lean-ruport`: affected `<=0.3.8`, no fixed version yet · CVSS 7.8 High · Not analysed yet · Published 14 May 2022 · Tags: Information disclosure
- [Echor Ruby Gem credentials can be stolen via process table monitoring](https://agentprime.io/advisories/GHSA-j4gx-p3x5-m987.md)
  `GHSA-j4gx-p3x5-m987`, `CVE-2014-1835` · RubyGems `echor`: affected `<=0.1.6`, no fixed version yet · CVSS 7.8 High · Not analysed yet · Published 14 May 2022
- [Echor contains Command Injection](https://agentprime.io/advisories/GHSA-8936-cgj4-phr2.md)
  `GHSA-8936-cgj4-phr2`, `CVE-2014-1834` · RubyGems `echor`: affected `<=0.1.6`, no fixed version yet · CVSS 7.8 High · Not analysed yet · Published 14 May 2022 · Tags: Command injection
- [ldap_fluff authentication bypass](https://agentprime.io/advisories/GHSA-9whh-582r-589h.md)
  `GHSA-9whh-582r-589h`, `CVE-2012-5604` · RubyGems `ldap_fluff`: affected `<0.4.0`, fixed in `0.4.0` · No CVSS score · Not analysed yet · Published 14 May 2022
- [Ember.js Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-8xm3-gm7c-5fjx.md)
  `GHSA-8xm3-gm7c-5fjx`, `CVE-2014-0013` · RubyGems `ember-source`: affected `>=1.0.0.pre4.0, <1.0.1 || >=1.1.0, <1.1.3 || >=1.2.0.beta.1, <1.2.1 || >=1.3.0.beta.1, <1.3.1 || >=1.4.0-beta.1, <1.4.0-beta.2`, fixed in `1.0.1`, `1.1.3`, `1.2.1`, `1.3.1`, `1.4.0-beta.2` · CVSS 5.4 Medium · Not analysed yet · Published 14 May 2022 · Tags: Cross-site scripting (XSS)
- [xapian-core Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-7qw4-w7hf-22q3.md)
  `GHSA-7qw4-w7hf-22q3`, `CVE-2018-0499` · RubyGems `xapian-core`: affected `<1.4.6`, fixed in `1.4.6` · CVSS 6.1 Medium · Not analysed yet · Published 14 May 2022 · Tags: Cross-site scripting (XSS)
- [Fat Free CRM Cross-Site Request Forgery vulnerability](https://agentprime.io/advisories/GHSA-wx7c-8j35-mpg8.md)
  `GHSA-wx7c-8j35-mpg8`, `CVE-2015-1585` · RubyGems `fat_free_crm`: affected `<0.13.6`, fixed in `0.13.6` · No CVSS score · Not analysed yet · Published 14 May 2022 · Tags: Cross-site request forgery (CSRF)
- [Spree allows remote attackers to obtain sensitive information](https://agentprime.io/advisories/GHSA-hwrx-wc75-mgh7.md)
  `GHSA-hwrx-wc75-mgh7`, `CVE-2010-3978` · RubyGems `spree`: affected `>=0.11.0, <0.11.2 || >=0.30.0.beta1, <0.30.0`, fixed in `0.11.2`, `0.30.0` · No CVSS score · Not analysed yet · Published 14 May 2022 · Tags: Information disclosure
- [ember-source Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-rcx6-7jp6-pqf2.md)
  `GHSA-rcx6-7jp6-pqf2`, `CVE-2014-0014` · RubyGems `ember-source`: affected `>=1.0.0.pre4.0, <1.0.1 || >=1.1.0, <1.1.3 || >=1.2.0.beta.1, <1.2.1 || >=1.3.0.beta.1, <1.3.1 || >=1.4.0-beta.1, <1.4.0-beta.2`, fixed in `1.0.1`, `1.1.3`, `1.2.1`, `1.3.1`, `1.4.0-beta.2` · CVSS 5.4 Medium · Not analysed yet · Published 14 May 2022 · Tags: Cross-site scripting (XSS)
- [Nokogiri gem, via libxml, is affected by DoS vulnerabilities](https://agentprime.io/advisories/GHSA-r58r-74gx-6wx3.md)
  `GHSA-r58r-74gx-6wx3`, `CVE-2017-15412` · RubyGems `nokogiri`: affected `<1.8.2`, fixed in `1.8.2` · CVSS 8.8 High · Not analysed yet · Published 14 May 2022 · Tags: Memory corruption
- [WEBrick RCE Vulnerability](https://agentprime.io/advisories/GHSA-369m-2gv6-mw28.md)
  `GHSA-369m-2gv6-mw28`, `CVE-2017-10784` · RubyGems `webrick`: affected `<1.4.0`, fixed in `1.4.0` · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.16 · Not analysed yet · Published 14 May 2022 · Tags: Authentication bypass
- [Ruby OpenSSL DoS Vulnerability](https://agentprime.io/advisories/GHSA-v6rp-3r3v-hf4p.md)
  `GHSA-v6rp-3r3v-hf4p`, `CVE-2017-14033` · RubyGems `openssl`: affected `<2.0.0`, fixed in `2.0.0` · CVSS 7.5 High · Not analysed yet · Published 14 May 2022 · Tags: Memory corruption
- [Withdrawn Advisory: AlchemyCMS is vulnerable to stored XSS via the /admin/pictures image field](https://agentprime.io/advisories/GHSA-7mj4-2984-955f.md)
  `GHSA-7mj4-2984-955f`, `CVE-2018-18307` · RubyGems `alchemy_cms`: affected `=4.1.0`, no fixed version yet · CVSS 5.9 Medium · Withdrawn · Not analysed yet · Published 14 May 2022 · Tags: Cross-site scripting (XSS)
- [RubyGems Path Traversal vulnerability](https://agentprime.io/advisories/GHSA-8qxg-mff5-j3wc.md)
  `GHSA-8qxg-mff5-j3wc`, `CVE-2018-1000079` · Maven `org.jruby:jruby-stdlib` and 1 more: affected `<9.1.16.0`, fixed in `9.1.16.0` · CVSS 5.5 Medium · Not analysed yet · Published 14 May 2022 · Tags: Path traversal
- [karo Metacharacter Handling Remote Command Execution](https://agentprime.io/advisories/GHSA-qfwq-chf4-jvwg.md)
  `GHSA-qfwq-chf4-jvwg`, `CVE-2014-10075` · RubyGems `karo`: affected `<=2.5.2`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 May 2022 · Tags: Command injection
- [i18n Vulnerable to Denial of Service Attack](https://agentprime.io/advisories/GHSA-34hf-g744-jw64.md)
  `GHSA-34hf-g744-jw64`, `CVE-2014-10077` · RubyGems `i18n`: affected `<0.8.0`, fixed in `0.8.0` · CVSS 7.5 High · Not analysed yet · Published 14 May 2022 · Tags: CWE-20
- [Fileutils Command Injection vulnerability](https://agentprime.io/advisories/GHSA-9x97-x2p9-hvpf.md)
  `GHSA-9x97-x2p9-hvpf`, `CVE-2013-2516` · RubyGems `fileutils`: affected `<0.7.1`, fixed in `0.7.1` · CVSS 8.8 High · Not analysed yet · Published 14 May 2022 · Tags: Command injection
- [Phusion Passenger Race Condition Allows Privilege Escalation](https://agentprime.io/advisories/GHSA-jjcj-fgfm-9g9r.md)
  `GHSA-jjcj-fgfm-9g9r`, `CVE-2018-12029` · RubyGems `passenger`: affected `>=3.0.0, <5.3.2`, fixed in `5.3.2` · CVSS 7.0 High · Not analysed yet · Published 14 May 2022 · Tags: Race condition
- [Phusion Passenger SpawningKit Contains Arbitrary Read/Write Vulnerability](https://agentprime.io/advisories/GHSA-7cv3-gvmc-8mq5.md)
  `GHSA-7cv3-gvmc-8mq5`, `CVE-2018-12026` · RubyGems `passenger`: affected `>=5.3.0, <5.3.2`, fixed in `5.3.2` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 May 2022 · Tags: Path traversal
- [jQuery vulnerable to Cross-Site Scripting (XSS)](https://agentprime.io/advisories/GHSA-579v-mp3v-rrw5.md)
  `GHSA-579v-mp3v-rrw5`, `CVE-2011-4969` · Maven `org.webjars.npm:jquery` and 3 more: affected `<1.6.3`, fixed in `1.6.3` · No CVSS score · EPSS 0.19 · Not analysed yet · Published 14 May 2022 · Tags: Cross-site scripting (XSS)
- [Katello SQL Injection vulnerabilities](https://agentprime.io/advisories/GHSA-527r-mfmj-prqf.md)
  `GHSA-527r-mfmj-prqf`, `CVE-2016-3072` · RubyGems `katello`: affected `<2.4.3`, fixed in `2.4.3` · CVSS 8.8 High · Not analysed yet · Published 14 May 2022 · Tags: SQL injection
- [RubyGems vulnerable to DNS hijack attack](https://agentprime.io/advisories/GHSA-wp3j-rvfp-624h.md)
  `GHSA-wp3j-rvfp-624h`, `CVE-2015-3900` · RubyGems `rubygems-update`: affected `>=2.0.0, <2.0.16 || >=2.2.0, <2.2.4 || >=2.4.0, <2.4.7`, fixed in `2.0.16`, `2.2.4`, `2.4.7` · No CVSS score · Not analysed yet · Published 14 May 2022 · Tags: CWE-350
- [RubyGems Regular Expression Denial of Service vulnerability](https://agentprime.io/advisories/GHSA-9j7m-rjqx-48vh.md)
  `GHSA-9j7m-rjqx-48vh`, `CVE-2013-4287` · RubyGems `rubygems-update`: affected `<1.8.23.1 || >=1.8.24, <1.8.26 || >=2.0.0, <2.0.8 || >=2.1.0.rc.1, <2.1.0`, fixed in `1.8.23.1`, `1.8.26`, `2.0.8`, `2.1.0` · No CVSS score · Not analysed yet · Published 14 May 2022 · Tags: Denial of service
- [RubyGems Improper Input Validation vulnerability](https://agentprime.io/advisories/GHSA-p7f2-rr42-m9xm.md)
  `GHSA-p7f2-rr42-m9xm`, `CVE-2017-0900` · RubyGems `rubygems-update`: affected `<2.6.13`, fixed in `2.6.13` · CVSS 7.5 High · Not analysed yet · Published 14 May 2022 · Tags: CWE-20
- [katello Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-mhhc-r88h-2qrm.md)
  `GHSA-mhhc-r88h-2qrm`, `CVE-2018-16887` · RubyGems `katello`: affected `<3.9.0`, fixed in `3.9.0` · CVSS 5.4 Medium · Not analysed yet · Published 14 May 2022 · Tags: Cross-site scripting (XSS)
- [RubyGems Deserialization of Untrusted Data vulnerability](https://agentprime.io/advisories/GHSA-qj2w-mw2r-pv39.md)
  `GHSA-qj2w-mw2r-pv39`, `CVE-2018-1000074` · Maven `org.jruby:jruby-stdlib` and 1 more: affected `<9.1.16.0`, fixed in `9.1.16.0` · CVSS 7.8 High · Not analysed yet · Published 14 May 2022 · Tags: Insecure deserialization
- [RubyGems Improper Verification of Cryptographic Signature vulnerability](https://agentprime.io/advisories/GHSA-mc6j-h948-v2p6.md)
  `GHSA-mc6j-h948-v2p6`, `CVE-2018-1000076` · Maven `org.jruby:jruby-stdlib` and 1 more: affected `<9.1.16.0`, fixed in `9.1.16.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 May 2022 · Tags: Weak cryptography or TLS
- [RubyGems Improper Input Validation vulnerability](https://agentprime.io/advisories/GHSA-gv86-43rv-79m2.md)
  `GHSA-gv86-43rv-79m2`, `CVE-2018-1000077` · Maven `org.jruby:jruby-stdlib` and 1 more: affected `<9.1.16.0`, fixed in `9.1.16.0` · CVSS 5.3 Medium · Not analysed yet · Published 14 May 2022 · Tags: CWE-20
- [RubyGems Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-87qx-g5wg-mwmj.md)
  `GHSA-87qx-g5wg-mwmj`, `CVE-2018-1000078` · Maven `org.jruby:jruby-stdlib` and 1 more: affected `<9.1.16.0`, fixed in `9.1.16.0` · CVSS 6.1 Medium · Not analysed yet · Published 14 May 2022 · Tags: Cross-site scripting (XSS)
- [Elasticsearch Logstash allows remote attackers to execute arbitrary commands](https://agentprime.io/advisories/GHSA-8qhq-rq4j-8prj.md)
  `GHSA-8qhq-rq4j-8prj`, `CVE-2014-4326` · RubyGems `logstash`: affected `>=1.0.14, <1.4.2`, fixed in `1.4.2` · CVSS 4.0, no score published · Not analysed yet · Published 14 May 2022 · Tags: Command injection
- [Logstash Logs Sensitive Information](https://agentprime.io/advisories/GHSA-vcmm-ppqx-95ch.md)
  `GHSA-vcmm-ppqx-95ch`, `CVE-2016-1000221` · RubyGems `logstash-core`: affected `<2.3.4`, fixed in `2.3.4` · CVSS 7.5 High · Not analysed yet · Published 14 May 2022 · Tags: Information disclosure

Newest: <https://agentprime.io/advisories/ecosystem/rubygems.md>
Older: <https://agentprime.io/advisories/ecosystem/rubygems.md?cursor=WyIyMDIyLTA1LTE0VDAwOjU4OjEyLjAwMDAwMFoiLCJHSFNBLXZjbW0tcHBxeC05NWNoIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=RubyGems&cursor=WyIyMDIyLTA1LTE3VDA1OjI2OjIwLjAwMDAwMFoiLCJHSFNBLWY2OG0tcTI2ci02NGY2Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/rubygems/?cursor=WyIyMDIyLTA1LTE3VDA1OjI2OjIwLjAwMDAwMFoiLCJHSFNBLWY2OG0tcTI2ci02NGY2Il0>. Everything for agents: <https://agentprime.io/llms.txt>.