Browse / RubyGems

RubyGems

See its reports on the map

What gets reported to RubyGems

• Code Execution7
• Path Traversal5
• Denial of Service4
• Other weaknesses3
• Misconfiguration3
• Access Control2

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Host Header Attacmedium
   74 votes
2. Remote code execution on rubygems.orgDeserialization of Untrusted Data · critical
   $1,50051 votes
3. Server-side ReDoS via user-controlled regex in OIDC Access PolicyUncontrolled Resource Consumption
   41 votes
4. Delete directory using symlink when decompressing tarPath Traversal · medium
   $50035 votes
5. Unpacker improperly validates symlinks, allowing gems writes to arbitrary locationsPath Traversal · medium
   35 votes
6. Memory leak in gem decode logic can allow attacker to take down Rubygems.org applicationUncontrolled Resource Consumption · medium
   33 votes
7. Bundler's RCE with response using MarshalDeserialization of Untrusted Data
   28 votes
8. An organization admin can create an attacker-controlled organization owner via the gem transfer flow Improper Access Control - Generic · high
   27 votes
9. DNS SRV lookup of file:// sources enables local hijacking of gemsPath Traversal · high
   $50022 votes
10. Gem signature forgeryCryptographic Issues - Generic · medium
    $1,00016 votes
11. Installing a crafted gem package may create or overwrite filesPath Traversal · high
    $1,00011 votes
12. Request Hijacking Vulnerability in RubyGems 2.6.11 and earlierCode Injection · high
    10 votes
13. Password Reset emails missing TLS leads account takeoverImproper Authentication - Generic
    10 votes
14. Invalid username updating
    10 votes
15. Malware in `active-support` gemCommand Injection - Generic · critical
    8 votes
16. Installer can modify other gems if gem name is specially craftedPath Traversal · medium
    8 votes
17. 65534 times efficient, Brute-force attack for api_keyImproper Restriction of Authentication Attempts · low
    7 votes
18. Negative size in tar header causes infinite loopUncontrolled Resource Consumption · low
    7 votes
19. Escape sequence injection in "summary" fieldCommand Injection - Generic · low
    $5006 votes
20. No limit of summary length allows Denail of ServiceUncontrolled Resource Consumption · high
    5 votes
21. Possible Subdomain Takeover at http://production.s3.rubygems.org/ pointing to Fastly Misconfiguration
    5 votes
22. [gem server] Stored XSS via crafted JavaScript URL inclusion in GemspecCross-site Scripting (XSS) - Stored · medium
    4 votes
23. Login credentials transmitted in cleartext on index.rubygems.orgViolation of Secure Design Principles
    3 votes
24. Request Hijacking Vulnerability In RubyGems 2.4.6 And Earlier