# RubyGems Advisories.

Every RubyGems Advisory we hold (Ruby), newest first.

## Records, newest first (an older page)

- [PDFKit vulnerable to Command Injection](https://agentprime.io/advisories/GHSA-rhwx-hjx2-x4qr.md)
  `GHSA-rhwx-hjx2-x4qr`, `CVE-2022-25765` · RubyGems `pdfkit`: affected `<0.8.7.2`, fixed in `0.8.7.2` · CVSS 7.3 High · Critical (CVSS 7+ and EPSS) · EPSS 0.43 · Not analysed yet · Published 10 Sept 2022 · Tags: Command injection
- [OmniAuth's \`lib/omniauth/failure_endpoint.rb\` does not escape \`message_key\` value](https://agentprime.io/advisories/GHSA-pm55-qfxr-h247.md)
  `GHSA-pm55-qfxr-h247`, `CVE-2020-36599` · RubyGems `omniauth`: affected `<1.9.2 || >=2.0.0.pre.rc1, <2.0.0`, fixed in `1.9.2`, `2.0.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2022 · Tags: CWE-116
- [update_by_case before 0.1.3 can be vulnerable to sql injection](https://agentprime.io/advisories/GHSA-33wh-w4m7-c6r8.md)
  `GHSA-33wh-w4m7-c6r8`, `CVE-2022-35956` · RubyGems `update_by_case`: affected `<0.1.3`, fixed in `0.1.3` · CVSS 5.8 Medium · Not analysed yet · Published 11 Aug 2022 · Tags: SQL injection
- [administrate vulnerable to Cross-Site Request Forgery](https://agentprime.io/advisories/GHSA-cc8c-26rj-v2vx.md)
  `GHSA-cc8c-26rj-v2vx`, `CVE-2016-3098` · RubyGems `administrate`: affected `<0.1.5`, fixed in `0.1.5` · CVSS 5.4 Medium · Not analysed yet · Published 6 Aug 2022 · Tags: Cross-site request forgery (CSRF)
- [TZInfo relative path traversal vulnerability allows loading of arbitrary files](https://agentprime.io/advisories/GHSA-5cm2-9h8c-rvfx.md)
  `GHSA-5cm2-9h8c-rvfx`, `CVE-2022-31163` · RubyGems `tzinfo`: affected `<0.3.61 || >=1.0.0, <1.2.10`, fixed in `0.3.61`, `1.2.10` · CVSS 7.5 High · Not analysed yet · Published 21 Jul 2022 · Tags: Path traversal
- [jQuery UI vulnerable to XSS when refreshing a checkboxradio with an HTML-like initial text label](https://agentprime.io/advisories/GHSA-h6gj-6jjq-h8g9.md)
  `GHSA-h6gj-6jjq-h8g9`, `CVE-2022-31160` · Maven `org.webjars.npm:jquery-ui` and 3 more: affected `<1.13.2`, fixed in `1.13.2` · CVSS 6.1 Medium · Not analysed yet · Published 18 Jul 2022 · Tags: Cross-site scripting (XSS)
- [Gollum Cross-site Scripting vulnerability via filename parameter to New Page dialog](https://agentprime.io/advisories/GHSA-fj2w-qmjp-3rjm.md)
  `GHSA-fj2w-qmjp-3rjm`, `CVE-2020-35305` · RubyGems `gollum`: affected `>=5.0, <5.1.2`, fixed in `5.1.2` · CVSS 6.1 Medium · Not analysed yet · Published 16 Jul 2022 · Tags: Cross-site scripting (XSS)
- [Active Record RCE bug with Serialized Columns](https://agentprime.io/advisories/GHSA-3hhc-qp5v-9p2j.md)
  `GHSA-3hhc-qp5v-9p2j`, `CVE-2022-32224` · RubyGems `activerecord`: affected `<5.2.8.1 || >=6.0.0, <6.0.5.1 || >=6.1.0, <6.1.6.1 || >=7.0.0, <7.0.3.1`, fixed in `5.2.8.1`, `6.0.5.1`, `6.1.6.1`, `7.0.3.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Jul 2022 · Tags: Insecure deserialization
- [opensearch-ruby 2.x before 2.0.2 vulnerable to unsafe YAML deserialization](https://agentprime.io/advisories/GHSA-977c-63xq-cgw3.md)
  `GHSA-977c-63xq-cgw3`, `CVE-2022-31115` · RubyGems `opensearch-ruby`: affected `>=2.0.0, <2.0.2`, fixed in `2.0.2` · CVSS 8.8 High · Not analysed yet · Published 5 Jul 2022 · Tags: Insecure deserialization
- [Ember.js Potential XSS Exploit When Binding \`tagName\` to User-Supplied Data](https://agentprime.io/advisories/GHSA-5m48-c37x-f792.md)
  `GHSA-5m48-c37x-f792`, `CVE-2013-4170` · RubyGems `ember-source`: affected `<1.0.0.rc1.1 || >=1.0.0.rc2.0, <1.0.0.rc2.1 || >=1.0.0.rc3.0, <1.0.0.rc3.1 || >=1.0.0.rc4.0, <1.0.0.rc4.1 || >=1.0.0.rc5.0, <1.0.0.rc5.1 || >=1.0.0.rc6.0, <1.0.0.rc6.1`, fixed in `1.0.0.rc1.1`, `1.0.0.rc2.1`, `1.0.0.rc3.1`, `1.0.0.rc4.1`, `1.0.0.rc5.1`, `1.0.0.rc6.1` · CVSS 6.1 Medium · Not analysed yet · Published 1 Jul 2022 · Tags: Cross-site scripting (XSS)
- [OS Command Injection in awesome spawn](https://agentprime.io/advisories/GHSA-qpqw-mc85-qvm9.md)
  `GHSA-qpqw-mc85-qvm9`, `CVE-2014-0156` · RubyGems `awesome_spawn`: affected `<1.2.0`, fixed in `1.2.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Jul 2022 · Tags: Command injection
- [Externally Controlled Reference to a Resource in Another Sphere in ruby-mysql](https://agentprime.io/advisories/GHSA-73pr-g6jj-5hc9.md)
  `GHSA-73pr-g6jj-5hc9`, `CVE-2021-3779` · RubyGems `ruby-mysql`: affected `<2.10.0`, fixed in `2.10.0` · CVSS 6.5 Medium · Not analysed yet · Published 29 Jun 2022 · Tags: CWE-610
- [Rails::Html::Sanitizer vulnerable to Cross-site Scripting](https://agentprime.io/advisories/GHSA-pg8v-g4xq-hww9.md)
  `GHSA-pg8v-g4xq-hww9`, `CVE-2022-32209` · RubyGems `rails-html-sanitizer`: affected `<1.4.3`, fixed in `1.4.3` · CVSS 6.1 Medium · EPSS 0.27 · Not analysed yet · Published 25 Jun 2022 · Tags: Cross-site scripting (XSS)
- [Improper handling of double quotes in file name in Diffy in Windows environment](https://agentprime.io/advisories/GHSA-5ww9-9qp2-x524.md)
  `GHSA-5ww9-9qp2-x524`, `CVE-2022-33127` · RubyGems `diffy`: affected `<3.4.1`, fixed in `3.4.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jun 2022
- [Octokit gem published with world-writable files](https://agentprime.io/advisories/GHSA-g28x-pgr3-qqx6.md)
  `GHSA-g28x-pgr3-qqx6`, `CVE-2022-31072` · RubyGems `octokit`: affected `>=4.23.0, <4.25.0`, fixed in `4.25.0` · CVSS 2.5 Low · Not analysed yet · Published 15 Jun 2022 · Tags: Broken access control
- [Octopoller gem published with world-writable files](https://agentprime.io/advisories/GHSA-26qj-cr27-r5c4.md)
  `GHSA-26qj-cr27-r5c4`, `CVE-2022-31071` · RubyGems `octopoller`: affected `>=0.2.0, <0.3.0`, fixed in `0.3.0` · CVSS 2.5 Low · Not analysed yet · Published 15 Jun 2022 · Tags: Broken access control
- [Mechanize before v2.8.5 vulnerable to authorization header leak on port redirect](https://agentprime.io/advisories/GHSA-64qm-hrgp-pgr9.md)
  `GHSA-64qm-hrgp-pgr9`, `CVE-2022-31033` · RubyGems `mechanize`: affected `<2.8.5`, fixed in `2.8.5` · CVSS 5.9 Medium · Not analysed yet · Published 9 Jun 2022 · Tags: Information disclosure, Hard-coded credentials
- [JMESPath for Ruby uses unsafe JSON.load when safe JSON.parse is preferable](https://agentprime.io/advisories/GHSA-5c5f-7vfq-3732.md)
  `GHSA-5c5f-7vfq-3732`, `CVE-2022-32511` · RubyGems `jmespath`: affected `<1.6.1`, fixed in `1.6.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Jun 2022 · Tags: Insecure deserialization
- [Use of Uninitialized Variable in trilogy](https://agentprime.io/advisories/GHSA-5g4r-2qhx-vqfm.md)
  `GHSA-5g4r-2qhx-vqfm`, `CVE-2022-31026` · RubyGems `trilogy`: affected `<2.1.1`, fixed in `2.1.1` · CVSS 5.9 Medium · Not analysed yet · Published 6 Jun 2022 · Tags: Memory corruption
- [Arbitrary file write in dragonfly](https://agentprime.io/advisories/GHSA-fj34-jhjx-xmvv.md)
  `GHSA-fj34-jhjx-xmvv`, `CVE-2021-33473` · RubyGems `dragonfly`: affected `<1.4.0`, fixed in `1.4.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Jun 2022 · Tags: Command injection
- [CSRF allows attacker to finalize/unfinalize order adjustments in solidus_backend](https://agentprime.io/advisories/GHSA-8639-qx56-r428.md)
  `GHSA-8639-qx56-r428`, `CVE-2022-31000` · RubyGems `solidus_backend`: affected `<2.11.16 || >=3.0.0, <3.0.6 || >=3.1.0, <3.1.6`, fixed in `2.11.16`, `3.0.6`, `3.1.6` · CVSS 2.3 Low · Not analysed yet · Published 1 Jun 2022 · Tags: Cross-site request forgery (CSRF)
- [Denial of Service Vulnerability in Rack Multipart Parsing](https://agentprime.io/advisories/GHSA-hxqx-xwvh-44m2.md)
  `GHSA-hxqx-xwvh-44m2`, `CVE-2022-30122` · RubyGems `rack`: affected `>=1.2, <2.0.9.1 || >=2.1, <2.1.4.1 || >=2.2, <2.2.3.1`, fixed in `2.0.9.1`, `2.1.4.1`, `2.2.3.1` · CVSS 7.5 High · Not analysed yet · Published 27 May 2022 · Tags: Denial of service
- [Possible shell escape sequence injection vulnerability in Rack](https://agentprime.io/advisories/GHSA-wq4h-7r42-5hrr.md)
  `GHSA-wq4h-7r42-5hrr`, `CVE-2022-30123` · RubyGems `rack`: affected `<2.0.9.1 || >=2.1, <2.1.4.1 || >=2.2, <2.2.3.1`, fixed in `2.0.9.1`, `2.1.4.1`, `2.2.3.1` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 May 2022 · Tags: CWE-150
- [Camaleon CMS Stored Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-x78v-4fvj-rg9j.md)
  `GHSA-x78v-4fvj-rg9j`, `CVE-2021-25969` · RubyGems `camaleon_cms`: affected `>=0.0.1, <2.6.0.1`, fixed in `2.6.0.1` · CVSS 6.1 Medium · Not analysed yet · Published 24 May 2022 · Tags: Cross-site scripting (XSS)
- [Cross site scripting in publify](https://agentprime.io/advisories/GHSA-wmh9-x28j-c6gr.md)
  `GHSA-wmh9-x28j-c6gr`, `BIT-publify-2021-25974`, `CVE-2021-25974` · RubyGems `publify_core`: affected `>=8.0, <9.2.5`, fixed in `9.2.5` · CVSS 5.4 Medium · Not analysed yet · Published 24 May 2022 · Tags: Cross-site scripting (XSS)
- [Camaleon CMS Insufficient Session Expiration vulnerability](https://agentprime.io/advisories/GHSA-438x-2p9v-g8h9.md)
  `GHSA-438x-2p9v-g8h9`, `CVE-2021-25970` · RubyGems `camaleon_cms`: affected `>=0.1.7, <2.6.0.1`, fixed in `2.6.0.1` · CVSS 8.8 High · Not analysed yet · Published 24 May 2022 · Tags: Authentication bypass
- [Cross site scripting in publify](https://agentprime.io/advisories/GHSA-3h7v-wqw7-ff28.md)
  `GHSA-3h7v-wqw7-ff28`, `BIT-publify-2021-25975`, `CVE-2021-25975` · RubyGems `publify_core`: affected `>=8.0, <9.2.5`, fixed in `9.2.5` · CVSS 5.4 Medium · Not analysed yet · Published 24 May 2022 · Tags: Cross-site scripting (XSS)
- [net-ldap has weak salt when generating passwords](https://agentprime.io/advisories/GHSA-qwgm-mxm4-3q2c.md)
  `GHSA-qwgm-mxm4-3q2c`, `CVE-2014-0083` · RubyGems `net-ldap`: affected `<0.16.2`, fixed in `0.16.2` · CVSS 5.5 Medium · Not analysed yet · Published 24 May 2022 · Tags: Weak cryptography or TLS
- [Camaleon CMS vulnerable to Uncaught Exception](https://agentprime.io/advisories/GHSA-r2w2-h6r8-3r53.md)
  `GHSA-r2w2-h6r8-3r53`, `CVE-2021-25971` · RubyGems `camaleon_cms`: affected `>=2.0.1, <2.6.0.1`, fixed in `2.6.0.1` · CVSS 4.3 Medium · Not analysed yet · Published 24 May 2022 · Tags: CWE-248
- [Camaleon CMS vulnerable to Server-Side Request Forgery](https://agentprime.io/advisories/GHSA-vx6p-q4gj-x6xx.md)
  `GHSA-vx6p-q4gj-x6xx`, `CVE-2021-25972` · RubyGems `camaleon_cms`: affected `>=2.1.2.0, <2.6.0.1`, fixed in `2.6.0.1` · CVSS 4.9 Medium · Not analysed yet · Published 24 May 2022 · Tags: Server-side request forgery (SSRF)
- [apollo_upload_server has Denial of Service vulnerability](https://agentprime.io/advisories/GHSA-w6pv-c757-6rgr.md)
  `GHSA-w6pv-c757-6rgr`, `BIT-gitlab-2021-39880`, `CVE-2021-39880` · RubyGems `apollo_upload_server`: affected `<2.1.0`, fixed in `2.1.0` · CVSS 6.5 Medium · Not analysed yet · Published 24 May 2022
- [Nokogiri has vulnerable dependencies on libxml2 and libxslt](https://agentprime.io/advisories/GHSA-59gp-qqm7-cw4j.md)
  `GHSA-59gp-qqm7-cw4j`, `CVE-2021-30560` · RubyGems `nokogiri`: affected `<1.13.2`, fixed in `1.13.2` · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.20 · Not analysed yet · Published 24 May 2022 · Tags: Memory corruption
- [Smashing Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-254j-mmc5-qhpx.md)
  `GHSA-254j-mmc5-qhpx`, `CVE-2021-35440` · RubyGems `smashing`: affected `<1.3.5`, fixed in `1.3.5` · CVSS 6.1 Medium · Not analysed yet · Published 24 May 2022 · Tags: Cross-site scripting (XSS)
- [Nokogiri contains libxml Out-of-bounds Write vulnerability](https://agentprime.io/advisories/GHSA-jw9f-hh49-cvp9.md)
  `GHSA-jw9f-hh49-cvp9`, `CVE-2021-3517` · RubyGems `nokogiri`: affected `<1.11.4`, fixed in `1.11.4` · CVSS 8.6 High · Critical (CVSS 7+ and EPSS) · EPSS 0.17 · Not analysed yet · Published 24 May 2022 · Tags: Memory corruption
- [Nokogiri Implements libxml2 version vulnerable to use-after-free](https://agentprime.io/advisories/GHSA-v4f8-2847-rwm7.md)
  `GHSA-v4f8-2847-rwm7`, `CVE-2021-3518` · RubyGems `nokogiri`: affected `<1.11.4`, fixed in `1.11.4` · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.22 · Not analysed yet · Published 24 May 2022 · Tags: Memory corruption
- [Nokogiri Implements libxml2 version vulnerable to null pointer dereferencing](https://agentprime.io/advisories/GHSA-286v-pcf5-25rc.md)
  `GHSA-286v-pcf5-25rc`, `CVE-2021-3537` · RubyGems `nokogiri`: affected `<1.11.4`, fixed in `1.11.4` · CVSS 5.9 Medium · Not analysed yet · Published 24 May 2022 · Tags: Memory corruption
- [Metasploit Framework user exposes Metasploit to same deserialization issue that is exploited by that module](https://agentprime.io/advisories/GHSA-xgww-h98f-24qf.md)
  `GHSA-xgww-h98f-24qf`, `CVE-2020-7385` · RubyGems `metasploit-framework`: affected `<4.19.0`, fixed in `4.19.0` · CVSS 8.1 High · Not analysed yet · Published 24 May 2022 · Tags: Insecure deserialization
- [Gitaly Insufficient Session Expiration vulnerability](https://agentprime.io/advisories/GHSA-mmmm-chjf-jmvw.md)
  `GHSA-mmmm-chjf-jmvw`, `CVE-2020-13353` · RubyGems `gitaly`: affected `>=1.79.0, <13.3.9 || >=13.4, <13.4.5 || >=13.5, <13.5.2`, fixed in `13.3.9`, `13.4.5`, `13.5.2` · CVSS 2.5 Low · Not analysed yet · Published 24 May 2022 · Tags: Authentication bypass
- [WEBRick vulnerable to HTTP Request/Response Smuggling](https://agentprime.io/advisories/GHSA-gwfg-cqmg-cf8f.md)
  `GHSA-gwfg-cqmg-cf8f`, `BIT-ruby-2020-25613`, `BIT-ruby-min-2020-25613`, `CVE-2020-25613` · RubyGems `webrick`: affected `<1.4.4 || >=1.5.0, <1.5.1 || >=1.6.0, <1.6.1`, fixed in `1.4.4`, `1.5.1`, `1.6.1` · CVSS 7.5 High · Not analysed yet · Published 24 May 2022 · Tags: HTTP request smuggling
- [omniauth-weibo-oauth2 included a code-execution backdoor inserted by a third party](https://agentprime.io/advisories/GHSA-vr22-43gj-rx3f.md)
  `GHSA-vr22-43gj-rx3f`, `CVE-2019-17268` · RubyGems `omniauth-weibo-oauth2`: affected `>=0.4.6, <0.5.1`, fixed in `0.5.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 May 2022 · Tags: Code injection
- [papercrop does not properly handle crop input](https://agentprime.io/advisories/GHSA-m44r-gv6q-9j9r.md)
  `GHSA-m44r-gv6q-9j9r`, `CVE-2015-2784` · RubyGems `papercrop`: affected `<0.3.0`, fixed in `0.3.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 May 2022 · Tags: CWE-20
- [Nokogiri implementation of libxslt vulnerable to heap corruption](https://agentprime.io/advisories/GHSA-vmfx-gcfq-wvm2.md)
  `GHSA-vmfx-gcfq-wvm2`, `CVE-2019-5815` · RubyGems `nokogiri`: affected `<1.10.5`, fixed in `1.10.5` · CVSS 7.5 High · Not analysed yet · Published 24 May 2022 · Tags: Memory corruption
- [Katello cleartext password storage issue](https://agentprime.io/advisories/GHSA-m4wh-848j-9w2r.md)
  `GHSA-m4wh-848j-9w2r`, `CVE-2019-14825` · RubyGems `katello`: affected `>=3.0.0.0, <3.12.2`, fixed in `3.12.2` · CVSS 4.1 Medium · Not analysed yet · Published 24 May 2022 · Tags: Information disclosure
- [Missing Initialization of Resource in Apache Arrow](https://agentprime.io/advisories/GHSA-cjw4-2w9r-r8mv.md)
  `GHSA-cjw4-2w9r-r8mv`, `CVE-2019-12410`, `PYSEC-2019-196` · PyPI `pyarrow` and 1 more: affected `>=0.12.0, <0.15.1`, fixed in `0.15.1` · CVSS 7.5 High · Not analysed yet · Published 24 May 2022 · Tags: CWE-909
- [Nokogiri affected by libxslt Use of Uninitialized Resource/Use After Free vulnerability](https://agentprime.io/advisories/GHSA-242x-7cm6-4w8j.md)
  `GHSA-242x-7cm6-4w8j`, `CVE-2019-18197` · RubyGems `nokogiri`: affected `<1.10.5`, fixed in `1.10.5` · CVSS 7.5 High · Not analysed yet · Published 24 May 2022 · Tags: Memory corruption
- [Devise Token Auth vulnerable to Cross-site Scripting](https://agentprime.io/advisories/GHSA-mvqr-r76c-wm5f.md)
  `GHSA-mvqr-r76c-wm5f`, `CVE-2019-16751` · RubyGems `devise_token_auth`: affected `>=0.1.33, <1.1.3`, fixed in `1.1.3` · CVSS 6.1 Medium · Not analysed yet · Published 24 May 2022 · Tags: Cross-site scripting (XSS)
- [Elastic APM agent for Ruby vulnerable to Improper Certificate Validation](https://agentprime.io/advisories/GHSA-35j2-p8fh-x966.md)
  `GHSA-35j2-p8fh-x966`, `CVE-2019-7615` · RubyGems `elastic-apm`: affected `<2.9.0`, fixed in `2.9.0` · CVSS 7.4 High · Not analysed yet · Published 24 May 2022 · Tags: Weak cryptography or TLS
- [libxslt Type Confusion vulnerability that affects Nokogiri](https://agentprime.io/advisories/GHSA-cf46-6xxh-pc75.md)
  `GHSA-cf46-6xxh-pc75`, `CVE-2019-13118` · RubyGems `nokogiri`: affected `<1.10.5`, fixed in `1.10.5` · CVSS 7.5 High · Not analysed yet · Published 24 May 2022 · Tags: Memory corruption
- [Uninitialized read in Nokogiri gem](https://agentprime.io/advisories/GHSA-4hm9-844j-jmxp.md)
  `GHSA-4hm9-844j-jmxp`, `CVE-2019-13117` · RubyGems `nokogiri`: affected `<1.10.5`, fixed in `1.10.5` · CVSS 5.3 Medium · Not analysed yet · Published 24 May 2022 · Tags: Memory corruption
- [Withdrawn Advisory: Fat Free CRM Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-gmg5-r3c4-3fm9.md)
  `GHSA-gmg5-r3c4-3fm9`, `CVE-2019-10226` · RubyGems `fat_free_crm`: affected `<=0.19.0`, no fixed version yet · CVSS 5.4 Medium · Withdrawn · Not analysed yet · Published 24 May 2022 · Tags: Cross-site scripting (XSS)
- [Publify has Improper Access Controls](https://agentprime.io/advisories/GHSA-c273-c6vg-4pv5.md)
  `GHSA-c273-c6vg-4pv5`, `BIT-publify-2022-1810`, `CVE-2022-1810` · RubyGems `publify_core`: affected `<9.2.9`, fixed in `9.2.9` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 May 2022 · Tags: Broken access control
- [Publify vulnerable to cross site scripting](https://agentprime.io/advisories/GHSA-3hwx-c6cp-q972.md)
  `GHSA-3hwx-c6cp-q972`, `BIT-publify-2022-1811`, `CVE-2022-1811` · RubyGems `publify_core`: affected `<9.2.9`, fixed in `9.2.9` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 May 2022 · Tags: Cross-site scripting (XSS), Unrestricted file upload
- [Nokogiri Improperly Handles Unexpected Data Type](https://agentprime.io/advisories/GHSA-xh29-r2w5-wx8m.md)
  `GHSA-xh29-r2w5-wx8m`, `CVE-2022-29181` · RubyGems `nokogiri`: affected `<1.13.6`, fixed in `1.13.6` · CVSS 8.2 High · Not analysed yet · Published 23 May 2022 · Tags: Memory corruption, CWE-241
- [Insecure PRNG use in random_password_generator](https://agentprime.io/advisories/GHSA-ggfx-h9xj-5v9c.md)
  `GHSA-ggfx-h9xj-5v9c`, `CVE-2019-25061` · RubyGems `random_password_generator`: affected `<=1.0.0`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 19 May 2022 · Tags: Weak cryptography or TLS, CWE-335
- [Integer Overflow or Wraparound in libxml2 affects Nokogiri](https://agentprime.io/advisories/GHSA-cgx6-hpwq-fhv5.md)
  `GHSA-cgx6-hpwq-fhv5`, `CVE-2022-50999` · RubyGems `nokogiri`: affected `<1.13.5`, fixed in `1.13.5` · CVSS 8.6 High · Not analysed yet · Published 18 May 2022 · Tags: Memory corruption
- [Publify vulnerable to DoS attack](https://agentprime.io/advisories/GHSA-vq74-9583-hrm4.md)
  `GHSA-vq74-9583-hrm4`, `CVE-2014-3211` · RubyGems `publify_core`: affected `<8.0.1`, fixed in `8.0.1` · CVSS 7.5 High · Not analysed yet · Published 17 May 2022 · Tags: Denial of service
- [openshift-origin-node Improper Input Validation vulnerability](https://agentprime.io/advisories/GHSA-756m-3qf2-hp58.md)
  `GHSA-756m-3qf2-hp58`, `CVE-2014-0084` · RubyGems `openshift-origin-node`: affected `<=1.3.3`, no fixed version yet · CVSS 5.5 Medium · Not analysed yet · Published 17 May 2022 · Tags: CWE-20
- [Spree does not properly restrict the use of a hash to provide values for a model's attributes](https://agentprime.io/advisories/GHSA-7h48-m3rw-vr27.md)
  `GHSA-7h48-m3rw-vr27`, `CVE-2008-7310` · RubyGems `spree`: affected `<0.4.0`, fixed in `0.4.0` · No CVSS score · Not analysed yet · Published 17 May 2022
- [Spree uses a hardcoded hash value](https://agentprime.io/advisories/GHSA-g466-57gh-cqfw.md)
  `GHSA-g466-57gh-cqfw`, `CVE-2008-7311` · RubyGems `spree`: affected `<0.4.0`, fixed in `0.4.0` · No CVSS score · Not analysed yet · Published 17 May 2022
- [Chef Improper Access Control vulnerability](https://agentprime.io/advisories/GHSA-f68m-q26r-64f6.md)
  `GHSA-f68m-q26r-64f6`, `CVE-2010-5142` · RubyGems `chef`: affected `<0.9.0`, fixed in `0.9.0` · No CVSS score · Not analysed yet · Published 17 May 2022 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/ecosystem/rubygems.md>
Older: <https://agentprime.io/advisories/ecosystem/rubygems.md?cursor=WyIyMDIyLTA1LTE3VDA1OjI2OjIwLjAwMDAwMFoiLCJHSFNBLWY2OG0tcTI2ci02NGY2Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=RubyGems&cursor=WyIyMDIyLTA5LTE1VDAzOjIxOjAwLjAwMDAwMFoiLCJHSFNBLXdycnctY3JwOC05NzlxIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/rubygems/?cursor=WyIyMDIyLTA5LTE1VDAzOjIxOjAwLjAwMDAwMFoiLCJHSFNBLXdycnctY3JwOC05NzlxIl0>. Everything for agents: <https://agentprime.io/llms.txt>.