Browse / Ruby

Ruby

See its reports on the map

What gets reported to Ruby

• Code Execution13
• Other weaknesses13
• Memory Corruption12
• Denial of Service6
• Injection and Smuggling5
• Cryptography4

Most upvoted reports

AllValidInformativeN/ADuplicate

1. OS Command Injection via egrep in Rake::FileListOS Command Injection
   62 votes
2. Path traversal in Tempfile on windows OS due to unsanitized backslashesPath Traversal · medium
   54 votes
3. Potential HTTP Request Smuggling in ruby webrickHTTP Request Smuggling · low
   53 votes
4. RCE by parsing `.rdoc_options` in RDocCode Injection
   41 votes
5. The taint flag is not propagated at JSON.parseInformative
   40 votes
6. Command injection in PathnameCommand Injection - Generic
   36 votes
7. ReDoS in IPAddr
   32 votes
8. NET::Ftp allows command injection in filenamesCommand Injection - Generic · low
   28 votes
9. ReDoS in Psych
   26 votes
10. Ruby: Heap Overflow in Floating Point ParsingMemory Corruption - Generic
    26 votes
11. URI parser's RFC3986 regular expression has poor performance when there are two # characters, leading to ReDoSmedium
    22 votes
12. Uncontrolled Resource Consumption when parsing maliciously crafted XML with REXMLUncontrolled Resource Consumption · medium
    21 votes
13. Round-trip instability in REXMLmedium
    20 votes
14. Variant of CVE-2013-0269 (Denial of Service and Unsafe Object Creation Vulnerability in JSON)Business Logic Errors · medium
    20 votes
15. sprintf combined format string attackMemory Corruption - Generic · medium
    18 votes
16. WEBrick::HTTPAuth::DigestAuth authentication is vulnerable to regular expression denial of service (ReDoS)Uncontrolled Resource Consumption · low
    17 votes
17. Unix domain socket and a path containing a null characterImproper Access Control - Generic
    17 votes
18. Ruby OpenSSL Library - IV Reuse in GCM ModeCryptographic Issues - Generic
    17 votes
19. Arbitrary heap overread in strscan on 32 bit Ruby, patch includedInformation Disclosure · low
    17 votes
20. XSS exploit of RDoc documentation generated by rdoc (CVE-2013-0256)InformativeCross-site Scripting (XSS) - Stored · medium
    16 votes
21. Unintentional file creation caused at Tempfile with directory traversalImproper Access Control - Generic
    15 votes
22. DoS in bigdecimal's sqrt function due to miscalculation of loop iterationsInformativeUncontrolled Resource Consumption · medium
    14 votes
23. Open S3 Bucket WriteAble To Any Aws UserImproper Authentication - Generic · high
    14 votes
24. Writable RubyCi Amazon s3 bucketImproper Authentication - Generic · high
    14 votes
25. The possibility that unintended file operation may be performed because some methods of `Dir` do not check NULL characters.Improper Access Control - Generic
    13 votes
26. BugsSpamhigh
    13 votes
27. StringIO strio_getline() can divulge arbitrary memoryMemory Corruption - Generic
    13 votes
28. controlled buffer under-read in pack_unpack_internal()Buffer Under-read · medium
    12 votes
29. Take back my all data from [email protected]Spamhigh
    12 votes
30. OpenSSL::X509::Name Equality Check Does Not Work, Patch includedImproper Certificate Validation · medium
    11 votes
31. imap: StartTLS stripping attack (CVE-2016-0772).Cryptographic Issues - Generic · medium
    10 votes
32. SMTP command injectionCommand Injection - Generic
    10 votes
33. 'net/http': HTTP Header Injection in the set_content_type methodInformativeCRLF Injection · high
    9 votes
34. lib/net/ftp.rb: trusting PASV responses allow client abuseInformation Disclosure · low
    9 votes
35. RCE (Remote Code Execution) Vulnerability on RubyN/ARemote File Inclusion · medium
    9 votes
36. Arbitrary heap exposure in JSON.generateMemory Corruption - Generic
    9 votes
37. RubyのCGIライブラリにHTTPレスポンス分割（HTTPヘッダインジェクション）があり、秘密情報が漏洩するHTTP Response Splitting · high
    8 votes
38. 'net/ftp': Uncontrolled Resource Consumption (Memory/CPU)InformativeUncontrolled Resource Consumption · medium
    8 votes
39. Code Injection Bug ReportCode Injection
    8 votes
40. Ruby is shipping a vulnerable jQuerylow
    8 votes
41. Attacker can smuggle a malicious domain in a URI object.InformativeOpen Redirect
    8 votes
42. OS Command Injection in 'rdoc' documentation generatorOS Command Injection · medium
    7 votes
43. public report - Reproducible - Writable RubyCi Amazon s3 bucket[207053]Improper Authentication - Generic
    7 votes
44. Buffer underflow in sprintfMemory Corruption - Generic
    7 votes
45. CGI::Cookieクラスにおけるセキュリティ上好ましくない仕様および実装HTTP Response Splitting · low
    6 votes
46. Header CRLF Injection in Ruby Net::HTTPInformativeCRLF Injection
    5 votes
47. ReDoS in Time.rfc2822
    5 votes
48. XSS exploit of RDoc documentation generated by rdocInformativeCross-site Scripting (XSS) - Stored · medium
    5 votes
49. Resolv::getaddresses bug that can be abused to bypass security measures. InformativeViolation of Secure Design Principles
    5 votes
50. Escape sequence injection vulnerability in WEBrick BasicAuthCommand Injection - Generic · medium
    5 votes
51. Ruby:HTTP Header injection in 'net/http'InformativeOpen Redirect
    5 votes
52. Stored XSS in RDoc hyperlinks through javascript schemeInformativeCross-site Scripting (XSS) - Stored · medium
    4 votes
53. OS Command Injection in '/lib/un.rb -- Utilities to replace common UNIX commands in Makefiles etc'InformativeOS Command Injection · medium
    4 votes
54. Source code disclosed via S3 BucketN/AInformation Exposure Through Directory Listing · high
    4 votes
55. Ruby 2.4.1 has "Stack consistency error" and aborts when processing return statement within a case statementInformativeMemory Corruption - Generic
    4 votes
56. Parsing invalid unicode codepoints using json c extension (2.0.1+) triggers a segfaultMemory Corruption - Generic
    4 votes
57. Response splitting vulnerability in WEBrickCross-site Scripting (XSS) - Generic · low
    4 votes
58. Bug Report : [ No Valid SPF Records ]InformativeMisconfiguration · high
    3 votes
59. XMLRPC does not limit deserializable classes.InformativeDeserialization of Untrusted Data · high
    3 votes
60. Net::SMTP with tls allows forged certificates as long as the hostname matchesInformativeImproper Certificate Validation · medium
    3 votes
61. Null character at fnmatch
    3 votes
62. Ruby 2.3.x and 2.2.x still bundle DoS vulnerable verision of libYAMLMemory Corruption - Generic · medium
    3 votes
63. Heap corruption in string.c tr_trans() due to undersized bufferInformativeMemory Corruption - Generic
    2 votes
64. Command injection in OptionParser.loadN/ACommand Injection - Generic · low
    1 votes
65. DRb denial of service vulnerabilityInformativeUncontrolled Resource Consumption
    1 votes
66. HTTP header can split /[\r\n]/ instead of /\r\n/
    1 votes
67. Potential command injection in `Shell#[]` and `Shell#test`Command Injection - Generic
    1 votes
68. Provide a security sistem most fit to our teamN/Ahigh
    1 votes
69. Open aws s3 bucket s3://rubyciN/AInformation Disclosure · critical
    1 votes
70. Heap corruption in DateTime.strftime() on 32 bit for certain format stringsInformativeMemory Corruption - Generic
    1 votes
71. SEGV in parse_rat()InformativeUncontrolled Resource Consumption
72. Invalid URL parsing '#'Informative
73. Integer Underflow @ ossl_cipher_pkcs5_keyivgen InformativeInteger Underflow