bundler records
5 published records for vendor bundler.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 1
- With a fix record
- 100%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-20 Improper Input Validation1
- CWE-427 Uncontrolled Search Path Element1
- CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')1
- CWE-94 Improper Control of Generation of Code ('Code Injection')1
The weakness classes this vendor ships most often: where to look.
CWEAttack profile
All records
5 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
42Plan | CVE-2016-7954No exploit | Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondarybundler · bundler · CWE-94 | Critical9.8 | — | 8.8% | Dec 22, 2016 |
37Monitor | CVE-2020-36327No exploit | Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which bundler · bundler | High8.8 | — | 6.3% | Apr 29, 2021 |
31Monitor | CVE-2019-3881No exploit | Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations undebundler · bundler · CWE-427 | High7.8 | — | 0.5% | Sep 4, 2020 |
30Monitor | CVE-2021-43809No exploit | Local Code Execution through Argument Injection via dash leading git url parameter in Gemfilebundler · bundler · CWE-88 | High7.3 | — | 2.9% | Dec 8, 2021 |
21Monitor | CVE-2013-0334No exploit | Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with bundler · bundler · CWE-20 | Medium5.0 | — | 4.3% | Oct 31, 2014 |
- CVE-2016-795442Plan
Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary
CriticalCVSS 9.8No exploitEPSS 8%bundler · bundlerDec 22, 2016
- CVE-2020-3632737Monitor
Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which
HighCVSS 8.8No exploitEPSS 6%bundler · bundlerApr 29, 2021
- CVE-2019-388131Monitor
Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations unde
HighCVSS 7.8No exploitEPSS 0%bundler · bundlerSep 4, 2020
- CVE-2021-4380930Monitor
Local Code Execution through Argument Injection via dash leading git url parameter in Gemfile
HighCVSS 7.3No exploitEPSS 2%bundler · bundlerDec 8, 2021
- CVE-2013-033421Monitor
Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with
MediumCVSS 5.0No exploitEPSS 4%bundler · bundlerOct 31, 2014