Rubygems (Hackerone) - vulnerabilities (CVEs)

4 CVEs, 0 in the last 30 days, 1 known versions, newest CVE from 2017-10-11. Vendor: Hackerone.

CVEs of Rubygems

• CVE-2017-0903 - CVSS 9.8 (critical), 2017-10-11: RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can…
• CVE-2017-0901 - CVSS 7.5 (high), 2017-08-31: RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the…
• CVE-2017-0899 - CVSS 9.8 (critical), 2017-08-31: RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem…
• CVE-2017-0902 - CVSS 8.1 (high), 2017-08-31: RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and…