Browse / Ruby

Ruby

See its reports on the map

What gets reported to Ruby

• Code Execution13
• Other weaknesses13
• Memory Corruption12
• Denial of Service6
• Injection and Smuggling5
• Cryptography4

Most upvoted reports

AllValidInformativeN/ADuplicate

1. OS Command Injection via egrep in Rake::FileListOS Command Injection
   62 votes
2. Path traversal in Tempfile on windows OS due to unsanitized backslashesPath Traversal · medium
   54 votes
3. Potential HTTP Request Smuggling in ruby webrickHTTP Request Smuggling · low
   53 votes
4. RCE by parsing `.rdoc_options` in RDocCode Injection
   41 votes
5. Command injection in PathnameCommand Injection - Generic
   36 votes
6. ReDoS in IPAddr
   32 votes
7. NET::Ftp allows command injection in filenamesCommand Injection - Generic · low
   28 votes
8. ReDoS in Psych
   26 votes
9. Ruby: Heap Overflow in Floating Point ParsingMemory Corruption - Generic
   26 votes
10. URI parser's RFC3986 regular expression has poor performance when there are two # characters, leading to ReDoSmedium
    22 votes
11. Uncontrolled Resource Consumption when parsing maliciously crafted XML with REXMLUncontrolled Resource Consumption · medium
    21 votes
12. Round-trip instability in REXMLmedium
    20 votes
13. Variant of CVE-2013-0269 (Denial of Service and Unsafe Object Creation Vulnerability in JSON)Business Logic Errors · medium
    20 votes
14. sprintf combined format string attackMemory Corruption - Generic · medium
    18 votes
15. WEBrick::HTTPAuth::DigestAuth authentication is vulnerable to regular expression denial of service (ReDoS)Uncontrolled Resource Consumption · low
    17 votes
16. Unix domain socket and a path containing a null characterImproper Access Control - Generic
    17 votes
17. Ruby OpenSSL Library - IV Reuse in GCM ModeCryptographic Issues - Generic
    17 votes
18. Arbitrary heap overread in strscan on 32 bit Ruby, patch includedInformation Disclosure · low
    17 votes
19. Unintentional file creation caused at Tempfile with directory traversalImproper Access Control - Generic
    15 votes
20. Open S3 Bucket WriteAble To Any Aws UserImproper Authentication - Generic · high
    14 votes
21. Writable RubyCi Amazon s3 bucketImproper Authentication - Generic · high
    14 votes
22. The possibility that unintended file operation may be performed because some methods of `Dir` do not check NULL characters.Improper Access Control - Generic
    13 votes
23. StringIO strio_getline() can divulge arbitrary memoryMemory Corruption - Generic
    13 votes
24. controlled buffer under-read in pack_unpack_internal()Buffer Under-read · medium
    12 votes
25. OpenSSL::X509::Name Equality Check Does Not Work, Patch includedImproper Certificate Validation · medium
    11 votes
26. imap: StartTLS stripping attack (CVE-2016-0772).Cryptographic Issues - Generic · medium
    10 votes
27. SMTP command injectionCommand Injection - Generic
    10 votes
28. lib/net/ftp.rb: trusting PASV responses allow client abuseInformation Disclosure · low
    9 votes
29. Arbitrary heap exposure in JSON.generateMemory Corruption - Generic
    9 votes
30. RubyのCGIライブラリにHTTPレスポンス分割（HTTPヘッダインジェクション）があり、秘密情報が漏洩するHTTP Response Splitting · high
    8 votes
31. Code Injection Bug ReportCode Injection
    8 votes
32. Ruby is shipping a vulnerable jQuerylow
    8 votes
33. OS Command Injection in 'rdoc' documentation generatorOS Command Injection · medium
    7 votes
34. public report - Reproducible - Writable RubyCi Amazon s3 bucket[207053]Improper Authentication - Generic
    7 votes
35. Buffer underflow in sprintfMemory Corruption - Generic
    7 votes
36. CGI::Cookieクラスにおけるセキュリティ上好ましくない仕様および実装HTTP Response Splitting · low
    6 votes
37. ReDoS in Time.rfc2822
    5 votes
38. Escape sequence injection vulnerability in WEBrick BasicAuthCommand Injection - Generic · medium
    5 votes
39. Parsing invalid unicode codepoints using json c extension (2.0.1+) triggers a segfaultMemory Corruption - Generic
    4 votes
40. Response splitting vulnerability in WEBrickCross-site Scripting (XSS) - Generic · low
    4 votes
41. Null character at fnmatch
    3 votes
42. Ruby 2.3.x and 2.2.x still bundle DoS vulnerable verision of libYAMLMemory Corruption - Generic · medium
    3 votes
43. HTTP header can split /[\r\n]/ instead of /\r\n/
    1 votes
44. Potential command injection in `Shell#[]` and `Shell#test`Command Injection - Generic
    1 votes