Ruby-Lang / Ruby
93 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2018-8780 | ruby: Unintentional directory traversal by poisoned NULL byte in Dir | CRITICAL | 9.1 | Apr 3, 2018 |
| CVE-2018-8779 | ruby: Unintentional socket creation by poisoned NULL byte in UNIXServer and UNIXSocket | HIGH | 7.5 | Apr 3, 2018 |
| CVE-2018-8778 | ruby: Buffer under-read in String#unpack | HIGH | 7.5 | Apr 3, 2018 |
| CVE-2018-8777 | ruby: DoS by large request in WEBrick | HIGH | 7.5 | Apr 3, 2018 |
| CVE-2018-6914 | ruby: Unintentional file and directory creation with directory traversal in tempfile and tmpdir | HIGH | 7.5 | Apr 3, 2018 |
| CVE-2017-17742 | ruby: HTTP response splitting in WEBrick | MEDIUM | 5.3 | Apr 3, 2018 |
| CVE-2017-17790 | ruby: Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code execution | CRITICAL | 9.8 | Dec 20, 2017 |
| CVE-2017-17405 | ruby: Command injection vulnerability in Net::FTP | HIGH | 8.8 | Dec 15, 2017 |
| CVE-2017-14033 | ruby: Buffer underrun in OpenSSL ASN1 decode | HIGH | 7.5 | Sep 19, 2017 |
| CVE-2017-10784 | ruby: Escape sequence injection vulnerability in the Basic authentication of WEBrick | HIGH | 8.8 | Sep 19, 2017 |
| CVE-2017-0898 | ruby: Buffer underrun vulnerability in Kernel.sprintf | CRITICAL | 9.1 | Sep 15, 2017 |
| CVE-2014-6438 | ruby: Unsafe parsing of long strings via decode_www_form_component method | HIGH | 7.5 | Sep 6, 2017 |
| CVE-2017-14064 | ruby: Arbitrary heap exposure during a JSON.generate call | CRITICAL | 9.8 | Aug 31, 2017 |
| CVE-2017-11465 | ruby: Invalid read/write in parser_yyerror function in UTF-8 parser | CRITICAL | 9.8 | Jul 19, 2017 |
| CVE-2015-9096 | ruby: SMTP command injection via CRLF sequences in RCPT TO or MAIL FROM commands in Net::SMTP | MEDIUM | 6.1 | Jun 12, 2017 |
| CVE-2017-9229 | oniguruma: Invalid pointer dereference in left_adjust_char_head() | HIGH | 7.5 | May 24, 2017 |
| CVE-2017-9225 | oniguruma: Out-of-bounds stack write in onigenc_unicode_get_case_fold_codes_by_str() during regular expression compilation | CRITICAL | 9.8 | May 24, 2017 |
| CVE-2017-6181 | ruby: Stack overflow in parse_char_class() in Onigmo | HIGH | 7.5 | Apr 3, 2017 |
| CVE-2009-5147 | ruby: dlopen could open a library with tainted library name | HIGH | 7.3 | Mar 29, 2017 |
| CVE-2016-2339 | ruby: Fiddle:: Function.new heap buffer overflow | CRITICAL | 9.8 | Jan 6, 2017 |
| CVE-2016-2337 | ruby: TclTkIp ip_cancel_eval type confusion vulnerability | CRITICAL | 9.8 | Jan 6, 2017 |
| CVE-2016-2336 | ruby: WIN32OLE ole_invoke and ole_query_interface type confusion vulnerabilities | CRITICAL | 9.8 | Jan 6, 2017 |
| CVE-2015-7551 | The Fiddle::Handle implementation in ext/fiddle/handle.c in Ruby before 2.0.0-p648, 2.1 before 2.1.8, and 2.2 before 2.2.4, as distributed in Apple OS X before… | HIGH | 8.4 | Mar 24, 2016 |
| CVE-2015-3900 | rubygems: DNS hijacking vulnerability in api_endpoint() | MEDIUM | 5.0 | Jun 24, 2015 |
| CVE-2014-8090 | ruby: REXML incomplete fix for CVE-2014-8080 | MEDIUM | 5.0 | Nov 21, 2014 |
Showing 26 to 50 of 93 CVEs