Skip to content
Noroxi

ruby-lang records

138 published records for vendor ruby-lang.

Researcher profile

Entered KEV
0 · 0%
Weaponized
3 · 2.2%
Pre-auth RCE
20
With a fix record
89.1%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 25
  10. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

Bug bounty scope

The product’s vendor appears in a public program. Matched by name; verify the scope text in the program.

All records

138 records
  • CVE-2017-17405
    57Plan

    Ruby before 2.4.3 allows Net::FTP command injection.

    HighCVSS 8.8Proof of conceptEPSS 74%

    ruby-lang · rubyDec 15, 2017

  • CVE-2008-3656
    52Plan

    Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.split_header_value function in WEBrick::HTTP::DefaultFileHandler in WEBrick i

    HighCVSS 7.8WeaponizedEPSS 70%

    ruby-lang · rubyAug 12, 2008

  • CVE-2021-28966
    47Plan

    In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.

    HighCVSS 7.5No exploitEPSS 57%

    ruby-lang · rubyJul 30, 2021

  • CVE-2018-16395
    42Plan

    An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3

    CriticalCVSS 9.8No exploitEPSS 11%

    ruby-lang · opensslNov 16, 2018

  • CVE-2017-14064
    42Plan

    Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate call.

    CriticalCVSS 9.8No exploitEPSS 9%

    ruby-lang · rubyAug 31, 2017

  • CVE-2016-2337
    41Plan

    Type confusion exists in _cancel_eval Ruby's TclTkIp class method.

    CriticalCVSS 9.8No exploitEPSS 6%

    ruby-lang · rubyJan 6, 2017

  • CVE-2017-17790
    41Plan

    The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demons

    CriticalCVSS 9.8No exploitEPSS 6%

    ruby-lang · rubyDec 20, 2017

  • CVE-2016-2339
    41Plan

    An exploitable heap overflow vulnerability exists in the Fiddle::Function.new "initialize" function functionality of Ruby.

    CriticalCVSS 9.8No exploitEPSS 5%

    ruby-lang · rubyJan 6, 2017

  • CVE-2008-2663
    41Plan

    Multiple integer overflows in the rb_ary_store function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, and 1.8

    CriticalCVSS 10.0No exploitEPSS 4%

    ruby-lang · rubyJun 24, 2008

  • CVE-2008-2662
    41Plan

    Multiple integer overflows in the rb_str_buf_append function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.

    CriticalCVSS 10.0No exploitEPSS 4%

    ruby-lang · rubyJun 24, 2008

  • CVE-2009-4124
    41Plan

    Heap-based buffer overflow in the rb_str_justify function in string.c in Ruby 1.9.1 before 1.9.1-p376 allows context-dependent attackers to

    CriticalCVSS 10.0No exploitEPSS 4%

    ruby-lang · rubyDec 11, 2009

  • CVE-2013-1948
    41Plan

    converter.rb in the md2pdf gem 0.0.1 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a

    CriticalCVSS 10.0No exploitEPSS 2%

    rob westgeest · md2pdfApr 25, 2013

  • CVE-2017-10784
    40Plan

    The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers t

    HighCVSS 8.8No exploitEPSS 16%

    ruby-lang · rubySep 19, 2017

  • CVE-2021-41816
    40Plan

    CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platfor

    CriticalCVSS 9.8No exploitEPSS 5%

    ruby-lang · cgiFeb 6, 2022

  • CVE-2016-2338
    40Plan

    An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function of Ruby.

    CriticalCVSS 9.8Proof of conceptEPSS 5%

    ruby-lang · rubySep 28, 2022

  • CVE-2016-2336
    40Plan

    Type confusion exists in two methods of Ruby's WIN32OLE class, ole_invoke and ole_query_interface.

    CriticalCVSS 9.8No exploitEPSS 3%

    ruby-lang · rubyJan 6, 2017

  • CVE-2017-9225
    40Plan

    An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5.

    CriticalCVSS 9.8No exploitEPSS 3%

    php · phpMay 24, 2017

  • CVE-2022-28738
    40Plan

    A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2.

    CriticalCVSS 9.8No exploitEPSS 3%

    ruby-lang · rubyMay 9, 2022

  • CVE-2011-4121
    40Plan

    The OpenSSL extension of Ruby (Git trunk) versions after 2011-09-01 up to 2011-11-03 always generated an exponent value of '1' to be used fo

    CriticalCVSS 9.8No exploitEPSS 3%

    ruby-lang · rubyNov 26, 2019

  • CVE-2024-27280
    40Plan

    A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4.

    CriticalCVSS 9.8No exploitEPSS 2%

    May 14, 2024

  • CVE-2017-11465
    40Plan

    The parser_yyerror function in the UTF-8 parser in Ruby 2.4.1 allows attackers to cause a denial of service (invalid write or read) or possi

    CriticalCVSS 9.8No exploitEPSS 2%

    ruby-lang · rubyJul 19, 2017

  • CVE-2018-8780
    39Monitor

    In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the Dir.open, Dir.new, Dir.entries an

    CriticalCVSS 9.1No exploitEPSS 10%

    ruby-lang · rubyApr 3, 2018

  • CVE-2017-0898
    39Monitor

    Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) with a huge minus val

    CriticalCVSS 9.1No exploitEPSS 10%

    ruby-lang · rubySep 15, 2017

  • CVE-2013-1933
    38Monitor

    The extract_from_ocr function in lib/docsplit/text_extractor.rb in the Karteek Docsplit (karteek-docsplit) gem 0.5.4 for Ruby allows context

    CriticalCVSS 9.3No exploitEPSS 2%

    documentcloud · karteek-docsplitApr 25, 2013

  • CVE-2013-4164
    37Monitor

    Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and trunk before revision 4

    MediumCVSS 6.8WeaponizedEPSS 35%

    ruby-lang · rubyNov 23, 2013