RubyGems Package Vulnerabilities

Packages

actionpack63 vulnerabilities
nokogiri59 vulnerabilities
rack50 vulnerabilities
rubygems-update25 vulnerabilities
activerecord23 vulnerabilities
puppet23 vulnerabilities
activesupport17 vulnerabilities
camaleon_cms15 vulnerabilities
publify_core15 vulnerabilities
rails-html-sanitizer15 vulnerabilities
passenger14 vulnerabilities
puma14 vulnerabilities
actionview13 vulnerabilities
decidim13 vulnerabilities
fat_free_crm12 vulnerabilities
activestorage11 vulnerabilities
loofah11 vulnerabilities
oj11 vulnerabilities
rails11 vulnerabilities
net-imap10 vulnerabilities
ruby-saml10 vulnerabilities
decidim-core9 vulnerabilities
jquery-rails9 vulnerabilities
openc39 vulnerabilities
avo8 vulnerabilities

RubyGems vulnerability results
Vulnerability	Title and context	CVSS	EPSS	PoCs	Signals	STIX action
CVE-2025-26803MEDIUM	Phusion Passenger denial of service The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invalid HTTP method. CWE-908Feb 24, 2025	CVSS5.3v3.1	EPSS0.595%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2012-6135HIGH	RubyGems passenger gem allows remote attackers to delete files RubyGems passenger 4.0.0 betas 1 and 2 allows remote attackers to delete arbitrary files during the startup process. CWE-20Nov 19, 2019	CVSS7.5v3.1	EPSS2.31%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2018-12615MEDIUM	Phusion Passenger incorrect permission assignment An issue was discovered in switchGroup() in agent/ExecHelper/ExecHelperMain.cpp in Phusion Passenger before 5.3.2. The set of groups (gidset) is not set correctly, leaving it up to randomness (i.e., uninitialized memory) which supplementary groups are actually being set while lowering privileges. CWE-732Jun 21, 2018	CVSS5.3v3.0	EPSS1.2%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2018-12026CRITICAL	Phusion Passenger SpawningKit Contains Arbitrary Read/Write Vulnerability During the spawning of a malicious Passenger-managed application, SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows such applications to replace key files or directories in the spawning communication directory with symlinks. This then could result in arbitrary reads and writes, which in turn can result in information disclosure and privilege escalation. CWE-59Jun 17, 2018	CVSS9.8v3.0	EPSS1.95%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2018-12027	Insecure Permissions in Phusion Passenger An Insecure Permissions vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 causes information disclosure in the following situation: given a Passenger-spawned application process that reports that it listens on a certain Unix domain socket, if any of the parent directories of said socket are writable by a normal user that is not the application's user, then that non-application user can swap that directory with something else, resulting in traffic being redirected to a non-appl… CWE-200 CWE-732Jun 17, 2018	CVSS-v3.1	EPSS1.09%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2018-12028HIGH	Incorrect Access Control in Phusion Passenger An Incorrect Access Control vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows a Passenger-managed malicious application, upon spawning a child process, to report an arbitrary different PID back to Passenger's process manager. If the malicious application then generates an error, it would cause Passenger's process manager to kill said reported arbitrary PID. CWE-732Jun 17, 2018	CVSS7.8v3.0	EPSS0.9%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2018-12029HIGH	Phusion Passenger Race Condition Allows Privilege Escalation A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but before it was chowned, leads to the target of the link being chowned via the path. Targeting sensitive files such as root's crontab file allows privilege escalation. CWE-362Jun 17, 2018	CVSS7.0v3.0	EPSS0.276%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2017-16355MEDIUM	Phusion Passenger information disclosure In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if Passenger is running as root, it is possible to list the contents of arbitrary files on a system by symlinking a file named REVISION from the application root folder to a file of choice and querying passenger-status --show=xml. CWE-200Dec 14, 2017	CVSS4.7v3.1	EPSS0.358%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2016-10345HIGH	Phusion Passenger uses a known /tmp filename In Phusion Passenger before 5.1.0, a known /tmp filename was used during passenger-install-nginx-module execution, which could allow local attackers to gain the privileges of the passenger user. CWE-264Apr 18, 2017	CVSS7.8v3.0	EPSS0.464%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2015-7519LOW	Phusion Passenger allows remote attackers to spoof headers agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to applications by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X_User header. CWE-20Jan 8, 2016	CVSS3.7v3.0	EPSS2.36%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2014-1831	Insecure use of temporary files in passenger Phusion Passenger before 4.0.37 allows local users to write to certain files and directories via a symlink attack on (1) control_process.pid or a (2) generation-* file. Feb 19, 2015	CVSS2.1v2.0	EPSS0.371%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2014-1832	Insecure use of temporary files in Phusion passenger Phusion Passenger 4.0.37 allows local users to write to certain files and directories via a symlink attack on (1) control_process.pid or a (2) generation-* file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1831. Feb 19, 2015	CVSS2.1v2.0	EPSS0.371%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2013-2119	Phusion Passenger Denial of Service Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary "config" file in a directory with a predictable name in /tmp/ before it is used by the gem. CWE-264 CWE-377Jan 2, 2014	CVSS4.6v2.0	EPSS0.4%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2013-4136	insecure temporary directory usage in passenger ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/. CWE-59Sep 30, 2013	CVSS4.4v2.0	EPSS0.329%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX