Browse / RubyGems

RubyGems

See its reports on the map

What gets reported to RubyGems

• Code Execution7
• Path Traversal5
• Denial of Service4
• Other weaknesses3
• Misconfiguration3
• Access Control2

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Host Header Attacmedium
   74 votes
2. Remote code execution on rubygems.orgDeserialization of Untrusted Data · critical
   $1,50051 votes
3. `/names.nsf` and all `/names*` files route to public API on rubygems.orgSpamImproper Access Control - Generic
   46 votes
4. Server-side ReDoS via user-controlled regex in OIDC Access PolicyUncontrolled Resource Consumption
   41 votes
5. Delete directory using symlink when decompressing tarPath Traversal · medium
   $50035 votes
6. Unpacker improperly validates symlinks, allowing gems writes to arbitrary locationsPath Traversal · medium
   35 votes
7. Memory leak in gem decode logic can allow attacker to take down Rubygems.org applicationUncontrolled Resource Consumption · medium
   33 votes
8. Bundler's RCE with response using MarshalDeserialization of Untrusted Data
   28 votes
9. An organization admin can create an attacker-controlled organization owner via the gem transfer flow Improper Access Control - Generic · high
   27 votes
10. DNS SRV lookup of file:// sources enables local hijacking of gemsPath Traversal · high
    $50022 votes
11. Gem signature forgeryCryptographic Issues - Generic · medium
    $1,00016 votes
12. Dependency repository hijacking aka Repo Jacking from GitHub repo rubygems/bundler-site & rubygems/bundler.github.io + bundler.io docsInformativeOpen Redirect · medium
    12 votes
13. Installing a crafted gem package may create or overwrite filesPath Traversal · high
    $1,00011 votes
14. Request Hijacking Vulnerability in RubyGems 2.6.11 and earlierCode Injection · high
    10 votes
15. Password Reset emails missing TLS leads account takeoverImproper Authentication - Generic
    10 votes
16. Invalid username updating
    10 votes
17. Malware in `active-support` gemCommand Injection - Generic · critical
    8 votes
18. Installer can modify other gems if gem name is specially craftedPath Traversal · medium
    8 votes
19. 65534 times efficient, Brute-force attack for api_keyImproper Restriction of Authentication Attempts · low
    7 votes
20. Negative size in tar header causes infinite loopUncontrolled Resource Consumption · low
    7 votes
21. Escape sequence injection in "summary" fieldCommand Injection - Generic · low
    $5006 votes
22. Request Hijacking Vulnerability in RubyGems 2.6.13 and earlierInformativeCommand Injection - Generic · low
    5 votes
23. No limit of summary length allows Denail of ServiceUncontrolled Resource Consumption · high
    5 votes
24. Possible Subdomain Takeover at http://production.s3.rubygems.org/ pointing to Fastly Misconfiguration
    5 votes
25. [gem server] Stored XSS via crafted JavaScript URL inclusion in GemspecCross-site Scripting (XSS) - Stored · medium
    4 votes
26. Cross-Domain JavaScript Source File Inclusion InformativeCross-site Scripting (XSS) - Generic · low
    3 votes
27. Host header Injection rubygems.orgN/AOpen Redirect · low
    3 votes
28. Login credentials transmitted in cleartext on index.rubygems.orgViolation of Secure Design Principles
    3 votes
29. Host Header Injection/RedirectionDuplicateViolation of Secure Design Principles
    2 votes
30. RCE,SQL,Vulnerability + Exploit Method.N/ACommand Injection - Generic
    1 votes
31. Request Hijacking Vulnerability In RubyGems 2.4.6 And Earlier