Overview 253 matches · 4 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
253matches
4in Waratek scope1.6%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
0public PoC0.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
4
1.6%
Outside Waratek scope
1
0.4%
Not applicable
248
98.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
253
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
253
100.0%
split by
peak 34 / year
20041
Not applicable1
Low1
not blocked1
No public exploit1
20053
Not applicable3
High2
Medium1
not blocked3
No public exploit3
20064
Not applicable4
High1
Medium3
not blocked4
No public exploit4
20076
Not applicable6
High1
Medium5
not blocked6
No public exploit6
200810
Not applicable10
High7
Medium3
not blocked10
No public exploit10
20094
Not applicable4
Critical1
High1
Medium2
not blocked4
No public exploit4
20101
Not applicable1
High1
not blocked1
No public exploit1
201117
No exploit published1
Not applicable16
High2
Medium14
Low1
not blocked17
No public exploit17
201215
No exploit published2
Not applicable13
High2
Medium13
not blocked15
No public exploit15
201327
No exploit published1
Not applicable26
High2
Medium24
Low1
not blocked27
No public exploit27
201410
Not applicable10
High1
Medium9
not blocked10
No public exploit10
20154
Not applicable4
Medium4
not blocked4
No public exploit4
20166
Not applicable6
High2
Medium3
Low1
not blocked6
No public exploit6
201728
Not applicable28
Critical14
High13
Medium1
not blocked28
No public exploit28
201824
Not applicable24
Critical7
High13
Medium4
not blocked24
No public exploit24
201922
Not applicable22
Critical6
High10
Medium5
Low1
not blocked22
No public exploit22
20209
Not applicable9
Critical5
High3
Medium1
not blocked9
No public exploit9
20218
Not applicable8
Critical1
High6
Medium1
not blocked8
No public exploit8
202234
Not applicable34
Critical13
High14
Medium7
not blocked34
No public exploit34
20237
Not applicable7
Critical1
High5
Medium1
not blocked7
No public exploit7
20241
Not applicable1
Critical1
not blocked1
No public exploit1
20256
Not applicable6
Critical2
High2
Medium1
Low1
not blocked6
No public exploit6
20266
Outside Waratek scope1
Not applicable5
High4
Medium2
not blocked6
No public exploit6
200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-88030 | Medium | 2026-09-10 | Not applicable | No public exploit | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Ruby Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. |
| CVE-2026-46727 | High | 2026-05-22 | Not applicable | No public exploit | An issue was discovered in Ruby 4 before 4.0.5. A race condition leading to a use-after-free in the pthread-based getaddrinfo timeout handler (rb_getaddrinfo in ext/socket/raddrinfo.c) allows a remote attacker who can delay DNS responses near the user-specified timeout to crash a Ruby process that calls Addrinfo.getaddrinfo(..., timeout:) or Socket.tcp(..., resolv_timeout:). Memory-corruption-based exploitation is theoretically possible. The attack could, for example, be carried out through a crafted authoritative DNS server or recursive resolver. |
| CVE-2026-40069 | High | 2026-04-09 | Not applicable | No public exploit | BSV Ruby SDK is the Ruby SDK for the BSV blockchain. From 0.1.0 to before 0.8.2, BSV::Network::ARC's failure detection only recognises REJECTED and DOUBLE_SPEND_ATTEMPTED. ARC responses with txStatus values of INVALID, MALFORMED, MINED_IN_STALE_BLOCK, or any ORPHAN-containing extraInfo / txStatus are silently treated as successful broadcasts. Applications that gate actions on broadcaster success are tricked into trusting transactions that were never accepted by the network. This vulnerability is fixed in 0.8.2. |
| CVE-2026-34060 | High | 2026-03-31 | Not applicable | No public exploit | Ruby LSP is an implementation of the language server protocol for Ruby. Prior to Shopify.ruby-lsp version 0.10.2 and ruby-lsp version 0.26.9, the rubyLsp.branch VS Code workspace setting was interpolated without sanitization into a generated Gemfile, allowing arbitrary Ruby code execution when a user opens a project containing a malicious .vscode/settings.json. This issue has been patched in Shopify.ruby-lsp version 0.10.2 and ruby-lsp version 0.26.9. |
| CVE-2026-33306 | Medium | 2026-03-24 | Not applicable | No public exploit | bcrypt-ruby is a Ruby binding for the OpenBSD bcrypt() password hashing algorithm. Prior to version 3.1.22, an integer overflow in the Java BCrypt implementation for JRuby can cause zero iterations in the strengthening loop. Impacted applications must be setting the cost to 31 to see this happen. The JRuby implementation of bcrypt-ruby (`BCrypt.java`) computes the key-strengthening round count as a signed 32-bit integer. When `cost=31` (the maximum allowed by the gem), signed integer overflow causes the round count to become negative, and the strengthening loop executes **zero iterations**. This collapses bcrypt from 2^31 rounds of exponential key-strengthening to effectively constant-time computation — only the initial EksBlowfish key setup and final 64x encryption phase remain. The resulting hash looks valid (`$2a$31$...`) and verifies correctly via `checkpw`, making the weakness invisible to the application. This issue is triggered only when cost=31 is used or when verifying a `$2a$31$` hash. This problem has been fixed in version 3.1.22. As a workaround, set the cost to something less than 31. |
| CVE-2026-0980 | High | 2026-02-27 | Outside Waratek scope | No public exploit | A flaw was found in rubyipmi, a gem used in the Baseboard Management Controller (BMC) component of Red Hat Satellite. An authenticated attacker with host creation or update permissions could exploit this vulnerability by crafting a malicious username for the BMC interface. This could lead to remote code execution (RCE) on the system. |
| CVE-2025-66568 | Critical | 2025-12-09 | Not applicable | No public exploit | The ruby-saml library implements the client side of an SAML authorization. Versions up to and including 1.12.4, are vulnerable to authentication bypass through the libxml2 canonicalization process used by Nokogiri for document transformation, which allows an attacker to execute a Signature Wrapping attack. When libxml2’s canonicalization is invoked on an invalid XML input, it may return an empty string rather than a canonicalized node. ruby-saml then proceeds to compute the DigestValue over this empty string, treating it as if canonicalization succeeded. This issue is fixed in version 1.18.0. |
| CVE-2025-66567 | Critical | 2025-12-09 | Not applicable | No public exploit | The ruby-saml library is for implementing the client side of a SAML authorization. ruby-saml versions up to and including 1.12.4 contain an authentication bypass vulnerability due to an incomplete fix for CVE-2025-25292. ReXML and Nokogiri parse XML differently, generating entirely different document structures from the same input. This allows an attacker to execute a Signature Wrapping attack. This issue is fixed in version 1.18.0. |
| CVE-2025-13397 | Medium | 2025-11-19 | Not applicable | No public exploit | A security vulnerability has been detected in mrubyc up to 3.4. This impacts the function mrbc_raw_realloc of the file src/alloc.c. Such manipulation of the argument ptr leads to null pointer dereference. An attack has to be approached locally. The name of the patch is 009111904807b8567262036bf45297c3da8f1c87. It is advisable to implement a patch to correct this issue. |
| CVE-2025-13120 | Low | 2025-11-13 | Not applicable | No public exploit | A vulnerability has been found in mruby up to 3.4.0. This vulnerability affects the function sort_cmp of the file src/array.c. Such manipulation leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The name of the patch is eb398971bfb43c38db3e04528b68ac9a7ce509bc. It is advisable to implement a patch to correct this issue. |
| CVE-2025-43015 | High | 2025-04-17 | Not applicable | No public exploit | In JetBrains RubyMine before 2025.1 remote Interpreter overwrote ports to listen on all interfaces |
| CVE-2025-25293 | High | 2025-03-12 | Not applicable | No public exploit | ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Prior to versions 1.12.4 and 1.18.0, ruby-saml is susceptible to remote Denial of Service (DoS) with compressed SAML responses. ruby-saml uses zlib to decompress SAML responses in case they're compressed. It is possible to bypass the message size check with a compressed assertion since the message size is checked before inflation and not after. This issue may lead to remote Denial of Service (DoS). Versions 1.12.4 and 1.18.0 fix the issue. |
| CVE-2024-21654 | Critical | 2024-01-12 | Not applicable | No public exploit | Rubygems.org is the Ruby community's gem hosting service. Rubygems.org users with MFA enabled would normally be protected from account takeover in the case of email account takeover. However, a workaround on the forgotten password form allows an attacker to bypass the MFA requirement and takeover the account. This vulnerability has been patched in commit 0b3272a. |
| CVE-2009-4123 | High | 2023-12-12 | Not applicable | No public exploit | The jruby-openssl gem before 0.6 for JRuby mishandles SSL certificate validation. |
| CVE-2023-40165 | High | 2023-08-17 | Not applicable | No public exploit | rubygems.org is the Ruby community's primary gem (library) hosting service. Insufficient input validation allowed malicious actors to replace any uploaded gem version that had a platform, version number, or gem name matching `/-\d/`, permanently replacing the legitimate upload in the canonical gem storage bucket, and triggering an immediate CDN purge so that the malicious gem would be served immediately. The maintainers have checked all gems matching the `/-\d/` pattern and can confirm that no unexpected `.gem`s were found. As a result, we believe this vulnerability was _not_ exploited. The easiest way to ensure that a user's applications were not exploited by this vulnerability is to check that all of your downloaded .gems have a checksum that matches the checksum recorded in the RubyGems.org database. RubyGems contributor Maciej Mensfeld wrote a tool to automatically check that all downloaded .gem files match the checksums recorded in the RubyGems.org database. You can use it by running: `bundle add bundler-integrity` followed by `bundle exec bundler-integrity`. Neither this tool nor anything else can prove you were not exploited, but the can assist your investigation by quickly comparing RubyGems API-provided checksums with the checksums of files on your disk. The issue has been patched with improved input validation and the changes are live. No action is required on the part of the user. Users are advised to validate their local gems. |
| CVE-2015-20108 | Critical | 2023-05-27 | Not applicable | No public exploit | xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not used. |
| CVE-2023-28756 | Medium | 2023-03-31 | Not applicable | No public exploit | A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2. |
| CVE-2021-46023 | High | 2023-02-14 | Not applicable | No public exploit | An Untrusted Pointer Dereference was discovered in function mrb_vm_exec in mruby before 3.1.0-rc. The vulnerability causes a segmentation fault and application crash. |
| CVE-2022-47318 | High | 2023-01-17 | Not applicable | No public exploit | ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-46648. |
| CVE-2022-46648 | High | 2023-01-17 | Not applicable | No public exploit | ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-47318. |
| CVE-2022-45301 | Medium | 2022-11-29 | Not applicable | No public exploit | Insecure permissions in Chocolatey Ruby package v3.1.2.1 and below grants all users in the Authenticated Users group write privileges for the path C:\tools\ruby31 and all files located in that folder. |
| CVE-2021-33621 | High | 2022-11-18 | Not applicable | No public exploit | The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object. |
| CVE-2016-2338 | Critical | 2022-09-29 | Not applicable | No public exploit | An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function of Ruby. In Psych::Emitter start_document function heap buffer "head" allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase this array size after mentioned allocation and cause heap overflow. |
| CVE-2022-36073 | High | 2022-09-07 | Not applicable | No public exploit | RubyGems.org is the Ruby community gem host. A bug in password & email change confirmation code allowed an attacker to change their RubyGems.org account's email to an unowned email address. Having access to an account whose email has been changed could enable an attacker to save API keys for that account, and when a legitimate user attempts to create an account with their email (and has to reset password to gain access) and is granted access to other gems, the attacker would then be able to publish and yank versions of those gems. Commit number 90c9e6aac2d91518b479c51d48275c57de492d4d contains a patch for this issue. |
| CVE-2022-36563 | High | 2022-08-30 | Not applicable | No public exploit | Incorrect access control in the install directory (C:\RailsInstaller) of Rubyinstaller2 v3.1.2 and below allows authenticated attackers to execute arbitrary code via overwriting binaries located in the directory. |
| CVE-2022-36562 | High | 2022-08-30 | Not applicable | No public exploit | Incorrect access control in the install directory (C:\Ruby31-x64) of Rubyinstaller2 v3.1.2 and below allows authenticated attackers to execute arbitrary code via overwriting binaries located in the directory. |
| CVE-2021-3779 | Medium | 2022-06-28 | Not applicable | No public exploit | A malicious MySQL server can request local file content from a client using ruby-mysql prior to version 2.10.0 without explicit authorization from the user. This issue was resolved in version 2.10.0 and later. |
| CVE-2022-1934 | High | 2022-05-31 | Not applicable | No public exploit | Use After Free in GitHub repository mruby/mruby prior to 3.2. |
| CVE-2022-28739 | High | 2022-05-09 | Not applicable | No public exploit | There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion, including Kernel#Float and String#to_f. |
| CVE-2022-28738 | Critical | 2022-05-09 | Not applicable | No public exploit | A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2. If a victim attempts to create a Regexp from untrusted user input, an attacker may be able to write to unexpected memory locations. |
| CVE-2022-29176 | Critical | 2022-05-05 | Not applicable | No public exploit | Rubygems is a package registry used to supply software for the Ruby language ecosystem. Due to a bug in the yank action, it was possible for any RubyGems.org user to remove and replace certain gems even if that user was not authorized to do so. To be vulnerable, a gem needed: one or more dashes in its name creation within 30 days OR no updates for over 100 days At present, we believe this vulnerability has not been exploited. RubyGems.org sends an email to all gem owners when a gem version is published or yanked. We have not received any support emails from gem owners indicating that their gem has been yanked without authorization. An audit of gem changes for the last 18 months did not find any examples of this vulnerability being used in a malicious way. A deeper audit for any possible use of this exploit is ongoing, and we will update this advisory once it is complete. Using Bundler in --frozen or --deployment mode in CI and during deploys, as the Bundler team has always recommended, will guarantee that your application does not silently switch to versions created using this exploit. To audit your application history for possible past exploits, review your Gemfile.lock and look for gems whose platform changed when the version number did not change. For example, gemname-3.1.2 updating to gemname-3.1.2-java could indicate a possible abuse of this vulnerability. RubyGems.org has been patched and is no longer vulnerable to this issue as of the 5th of May 2022. |
| CVE-2022-1427 | High | 2022-04-23 | Not applicable | No public exploit | Out-of-bounds Read in mrb_obj_is_kind_of in in GitHub repository mruby/mruby prior to 3.2. # Impact: Possible arbitrary code execution if being exploited. |
| CVE-2022-1286 | Critical | 2022-04-10 | Not applicable | No public exploit | heap-buffer-overflow in mrb_vm_exec in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited. |
| CVE-2022-1276 | Critical | 2022-04-10 | Not applicable | No public exploit | Out-of-bounds Read in mrb_get_args in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited. |
| CVE-2022-1212 | Critical | 2022-04-05 | Not applicable | No public exploit | Use-After-Free in str_escape in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited. |
| CVE-2022-1201 | Medium | 2022-04-02 | Not applicable | No public exploit | NULL Pointer Dereference in mrb_vm_exec with super in GitHub repository mruby/mruby prior to 3.2. This vulnerability is capable of making the mruby interpreter crash, thus affecting the availability of the system. |
| CVE-2022-1106 | Critical | 2022-03-27 | Not applicable | No public exploit | use after free in mrb_vm_exec in GitHub repository mruby/mruby prior to 3.2. |
| CVE-2022-1071 | High | 2022-03-26 | Not applicable | No public exploit | User after free in mrb_vm_exec in GitHub repository mruby/mruby prior to 3.2. |
| CVE-2022-0890 | Medium | 2022-03-10 | Not applicable | No public exploit | NULL Pointer Dereference in GitHub repository mruby/mruby prior to 3.2. |
| CVE-2021-45977 | Critical | 2022-02-25 | Not applicable | No public exploit | JetBrains IntelliJ IDEA 2021.3.1 Preview, IntelliJ IDEA 2021.3.1 RC, PyCharm Professional 2021.3.1 RC, GoLand 2021.3.1, PhpStorm 2021.3.1 Preview, PhpStorm 2021.3.1 RC, RubyMine 2021.3.1 Preview, RubyMine 2021.3.1 RC, CLion 2021.3.1, WebStorm 2021.3.1 Preview, and WebStorm 2021.3.1 RC (used as Remote Development backend IDEs) bind to the 0.0.0.0 IP address. The fixed versions are: IntelliJ IDEA 2021.3.1, PyCharm Professional 2021.3.1, GoLand 2021.3.2, PhpStorm 2021.3.1 (213.6461.83), RubyMine 2021.3.1, CLion 2021.3.2, and WebStorm 2021.3.1. |
| CVE-2022-0717 | Critical | 2022-02-23 | Not applicable | No public exploit | Out-of-bounds Read in GitHub repository mruby/mruby prior to 3.2. |
| CVE-2022-0632 | Medium | 2022-02-19 | Not applicable | No public exploit | NULL Pointer Dereference in Homebrew mruby prior to 3.2. |
| CVE-2022-0630 | High | 2022-02-19 | Not applicable | No public exploit | Out-of-bounds Read in Homebrew mruby prior to 3.2. |
| CVE-2022-0631 | Critical | 2022-02-18 | Not applicable | No public exploit | Heap-based Buffer Overflow in Homebrew mruby prior to 3.2. |
| CVE-2022-0623 | Critical | 2022-02-17 | Not applicable | No public exploit | Out-of-bounds Read in Homebrew mruby prior to 3.2. |
| CVE-2022-0614 | Medium | 2022-02-16 | Not applicable | No public exploit | Use of Out-of-range Pointer Offset in Homebrew mruby prior to 3.2. |
| CVE-2022-0570 | Critical | 2022-02-14 | Not applicable | No public exploit | Heap-based Buffer Overflow in Homebrew mruby prior to 3.2. |
| CVE-2022-0525 | Critical | 2022-02-09 | Not applicable | No public exploit | Out-of-bounds Read in Homebrew mruby prior to 3.2. |
| CVE-2022-0481 | High | 2022-02-04 | Not applicable | No public exploit | NULL Pointer Dereference in Homebrew mruby prior to 3.2. |
| CVE-2022-0326 | Medium | 2022-01-21 | Not applicable | No public exploit | NULL Pointer Dereference in Homebrew mruby prior to 3.2. |
| CVE-2022-0240 | High | 2022-01-17 | Not applicable | No public exploit | mruby is vulnerable to NULL Pointer Dereference |
| CVE-2021-46020 | High | 2022-01-14 | Not applicable | No public exploit | An untrusted pointer dereference in mrb_vm_exec() of mruby v3.0.0 can lead to a segmentation fault or application crash. |
| CVE-2021-41819 | High | 2022-01-01 | Not applicable | No public exploit | CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby. |
| CVE-2021-41817 | High | 2022-01-01 | Not applicable | No public exploit | Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1. |
| CVE-2021-4188 | High | 2021-12-30 | Not applicable | No public exploit | mruby is vulnerable to NULL Pointer Dereference |
| CVE-2021-4110 | High | 2021-12-15 | Not applicable | No public exploit | mruby is vulnerable to NULL Pointer Dereference |
| CVE-2021-37543 | High | 2021-08-06 | Not applicable | No public exploit | In JetBrains RubyMine before 2021.1.1, code execution without user confirmation was possible for untrusted projects. |
| CVE-2021-32066 | High | 2021-08-01 | Not applicable | No public exploit | An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack." |
| CVE-2021-31810 | Medium | 2021-07-13 | Not applicable | No public exploit | An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions). |
| CVE-2020-36401 | High | 2021-07-01 | Not applicable | No public exploit | mruby 2.1.2 has a double free in mrb_default_allocf (called from mrb_free and obj_free). |
| CVE-2021-33575 | Critical | 2021-05-25 | Not applicable | No public exploit | The Pixar ruby-jss gem before 1.6.0 allows remote attackers to execute arbitrary code because of the Plist gem's documented behavior of using Marshal.load during XML document processing. |
| CVE-2021-28965 | High | 2021-04-21 | Not applicable | No public exploit | The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing. |
| CVE-2020-25613 | High | 2020-10-06 | Not applicable | No public exploit | An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack. |
| CVE-2016-11086 | High | 2020-09-24 | Not applicable | No public exploit | lib/oauth/consumer.rb in the oauth-ruby gem through 0.5.4 for Ruby does not verify server X.509 certificates if a certificate bundle cannot be found, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information. |
| CVE-2020-15866 | Critical | 2020-07-21 | Not applicable | No public exploit | mruby through 2.1.2-rc has a heap-based buffer overflow in the mrb_yield_with_class function in vm.c because of incorrect VM stack handling. It can be triggered via the stack_copy function. |
| CVE-2020-10933 | Medium | 2020-05-04 | Not applicable | No public exploit | An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter. |
| CVE-2020-5247 | High | 2020-02-28 | Not applicable | No public exploit | In Puma (RubyGem) before 4.3.2 and before 3.12.3, if an application using Puma allows untrusted input in a response header, an attacker can use newline characters (i.e. `CR`, `LF` or`/r`, `/n`) to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is known as HTTP Response Splitting. While not an attack in itself, response splitting is a vector for several other attacks, such as cross-site scripting (XSS). This is related to CVE-2019-16254, which fixed this vulnerability for the WEBrick Ruby web server. This has been fixed in versions 4.3.2 and 3.12.3 by checking all headers for line endings and rejecting headers with those characters. |
| CVE-2019-10780 | Critical | 2020-01-22 | Not applicable | No public exploit | BibTeX-ruby before 5.1.0 allows shell command injection due to unsanitized user input being passed directly to the built-in Ruby Kernel.open method through BibTeX.open. |
| CVE-2020-6840 | Critical | 2020-01-11 | Not applicable | No public exploit | In mruby 2.1.0, there is a use-after-free in hash_slice in mrbgems/mruby-hash-ext/src/hash-ext.c. |
| CVE-2020-6839 | Critical | 2020-01-11 | Not applicable | No public exploit | In mruby 2.1.0, there is a stack-based buffer overflow in mrb_str_len_to_dbl in string.c. |
| CVE-2020-6838 | Critical | 2020-01-11 | Not applicable | No public exploit | In mruby 2.1.0, there is a use-after-free in hash_values_at in mrbgems/mruby-hash-ext/src/hash-ext.c. |
| CVE-2015-1855 | Medium | 2019-11-29 | Not applicable | No public exploit | verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to (1) multiple wildcards, (1) wildcards in IDNA names, (3) case sensitivity, and (4) non-ASCII characters. |
| CVE-2019-16255 | High | 2019-11-26 | Not applicable | No public exploit | Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument (aka the "command" argument) to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method. |
| CVE-2019-16254 | Medium | 2019-11-26 | Not applicable | No public exploit | Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. NOTE: this issue exists because of an incomplete fix for CVE-2017-17742, which addressed the CRLF vector, but did not address an isolated CR or an isolated LF. |
| CVE-2019-16201 | High | 2019-11-26 | Not applicable | No public exploit | WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expression Denial of Service cause by looping/backtracking. A victim must expose a WEBrick server that uses DigestAuth to the Internet or a untrusted network. |
| CVE-2019-15845 | Medium | 2019-11-26 | Not applicable | No public exploit | Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within File.fnmatch functions. |
| CVE-2011-4121 | Critical | 2019-11-26 | Not applicable | No public exploit | The OpenSSL extension of Ruby (Git trunk) versions after 2011-09-01 up to 2011-11-03 always generated an exponent value of '1' to be used for private RSA key generation. A remote attacker could use this flaw to bypass or corrupt integrity of services, depending on strong private RSA keys generation mechanism. |
| CVE-2011-3624 | Medium | 2019-11-26 | Not applicable | No public exploit | Various methods in WEBrick::HTTPRequest in Ruby 1.9.2 and 1.8.7 and earlier do not validate the X-Forwarded-For, X-Forwarded-Host and X-Forwarded-Server headers in requests, which might allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header. |
| CVE-2011-5331 | Critical | 2019-11-18 | Not applicable | No public exploit | Distributed Ruby (aka DRuby) 1.8 mishandles instance_eval. |
| CVE-2011-5330 | Critical | 2019-11-18 | Not applicable | No public exploit | Distributed Ruby (aka DRuby) 1.8 mishandles the sending of syscalls. |
| CVE-2013-1945 | Low | 2019-10-31 | Not applicable | No public exploit | ruby193 uses an insecure LD_LIBRARY_PATH setting. |
| CVE-2019-18409 | High | 2019-10-24 | Not applicable | No public exploit | The ruby_parser-legacy (aka legacy) gem 1.0.0 for Ruby allows local privilege escalation because of world-writable files. For example, if the brakeman gem (which has a legacy dependency) 4.5.0 through 4.7.0 is used, a local user can insert malicious code into the ruby_parser-legacy-1.0.0/lib/ruby_parser/legacy/ruby_parser.rb file. |
| CVE-2019-16892 | Medium | 2019-09-25 | Not applicable | No public exploit | In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption). |
| CVE-2019-16060 | Critical | 2019-09-06 | Not applicable | No public exploit | The Airbrake Ruby notifier 4.2.3 for Airbrake mishandles the blacklist_keys configuration option and consequently may disclose passwords to unauthorized actors. This is fixed in 4.2.4 (also, 4.2.2 and earlier are unaffected). |
| CVE-2019-7615 | High | 2019-07-30 | Not applicable | No public exploit | A TLS certificate validation flaw was found in Elastic APM agent for Ruby versions before 2.9.0. When specifying a trusted server CA certificate via the 'server_ca_cert' setting, the Ruby agent would not properly verify the certificate returned by the APM server. This could result in a man in the middle style attack against the Ruby agent. |
| CVE-2019-8325 | High | 2019-06-17 | Not applicable | No public exploit | An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::CommandManager#run calls alert_error without escaping, escape sequence injection is possible. (There are many ways to cause an error.) |
| CVE-2019-8324 | High | 2019-06-17 | Not applicable | No public exploit | An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could inject arbitrary code to the stub line of gemspec, which is eval-ed by code in ensure_loadable_spec during the preinstall check. |
| CVE-2019-8323 | High | 2019-06-17 | Not applicable | No public exploit | An issue was discovered in RubyGems 2.6 and later through 3.0.2. Gem::GemcutterUtilities#with_response may output the API response to stdout as it is. Therefore, if the API side modifies the response, escape sequence injection may occur. |
| CVE-2019-8322 | High | 2019-06-17 | Not applicable | No public exploit | An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur. |
| CVE-2019-8321 | High | 2019-06-17 | Not applicable | No public exploit | An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteraction#verbose calls say without escaping, escape sequence injection is possible. |
| CVE-2019-11027 | Critical | 2019-06-10 | Not applicable | No public exploit | Ruby OpenID (aka ruby-openid) through 2.8.0 has a remotely exploitable flaw. This library is used by Rails web applications to integrate with OpenID Providers. Severity can range from medium to critical, depending on how a web application developer chose to employ the ruby-openid library. Developers who based their OpenID integration heavily on the "example app" provided by the project are at highest risk. |
| CVE-2019-8320 | High | 2019-06-06 | Not applicable | No public exploit | A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. Before making new directories or touching files (which now include path-checking code for symlinks), it would delete the target destination. If that destination was hidden behind a symlink, a malicious gem could delete arbitrary files on the user's machine, presuming the attacker could guess at paths. Given how frequently gem is run as sudo, and how predictable paths are on modern systems (/tmp, /usr, etc.), this could likely lead to data loss or an unusable system. |
| CVE-2017-11428 | Critical | 2019-04-17 | Not applicable | No public exploit | OneLogin Ruby-SAML 1.6.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers. |
| CVE-2018-16396 | High | 2018-11-16 | Not applicable | No public exploit | An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats. |
| CVE-2018-16395 | Critical | 2018-11-16 | Not applicable | No public exploit | An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return true. When the first argument is one character longer than the second, or the second argument contains a character that is one less than a character in the same position of the first argument, the result of == will be true. This could be leveraged to create an illegitimate certificate that may be accepted as legitimate and then used in signing or encryption operations. |
| CVE-2018-14337 | High | 2018-07-17 | Not applicable | No public exploit | The CHECK macro in mrbgems/mruby-sprintf/src/sprintf.c in mruby 1.4.1 contains a signed integer overflow, possibly leading to out-of-bounds memory access because the mrb_str_resize function in string.c does not check for a negative length. |
| CVE-2018-1000544 | Critical | 2018-06-26 | Not applicable | No public exploit | rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , an attacker can upload a malicious file that contains symlinks or files with absolute pathnames "../" to write arbitrary files to the filesystem.. |
| CVE-2018-1000201 | High | 2018-06-22 | Not applicable | No public exploit | ruby-ffi version 1.9.23 and earlier has a DLL loading issue which can be hijacked on Windows OS, when a Symbol is used as DLL name instead of a String This vulnerability appears to have been fixed in v1.9.24 and later. |
| CVE-2018-12249 | High | 2018-06-12 | Not applicable | No public exploit | An issue was discovered in mruby 1.4.1. There is a NULL pointer dereference in mrb_class_real because "class BasicObject" is not properly supported in class.c. |
| CVE-2018-12248 | High | 2018-06-12 | Not applicable | No public exploit | An issue was discovered in mruby 1.4.1. There is a heap-based buffer over-read associated with OP_ENTER because mrbgems/mruby-fiber/src/fiber.c does not extend the stack in cases of many arguments to fiber. |