Open S3 Bucket WriteAble To Any Aws User #209223 Valid Authentication – 2017-03-29 – 14 DoS in bigdecimal's sqrt function due to miscalculation of loop iterations #2271054 Informative Denial of Service – 2023-12-20 – 14 Unintentional file creation caused at Tempfile with directory traversal #302298 Valid Access Control – 2018-04-01 – 15 XSS exploit of RDoc documentation generated by rdoc (CVE-2013-0256) #1977168 Informative Cross-site Scripting – 2023-07-18 – 16 Arbitrary heap overread in strscan on 32 bit Ruby, patch included #166661 Valid Information Disclosure – 2016-11-17 – 17 Ruby OpenSSL Library - IV Reuse in GCM Mode #170548 Valid No weakness recorded – 2021-03-07 – 17 Unix domain socket and a path containing a null character #302997 Valid Access Control – 2018-03-31 – 17 WEBrick::HTTPAuth::DigestAuth authentication is vulnerable to regular expression denial of service (ReDoS) #661722 Valid Denial of Service – 2019-11-15 – 17 sprintf combined format string attack #212241 Valid Memory Corruption – 2017-09-22 – 18 Variant of CVE-2013-0269 (Denial of Service and Unsafe Object Creation Vulnerability in JSON) #706934 Valid Input Validation and Logic – 2020-04-23 – 20 Round-trip instability in REXML #1104077 Valid No weakness recorded – 2021-04-15 – 20 Uncontrolled Resource Consumption when parsing maliciously crafted XML with REXML #2666849 Valid Denial of Service Medium 2025-02-20 – 21 URI parser's RFC3986 regular expression has poor performance when there are two # characters, leading to ReDoS #1444501 Valid No weakness recorded – 2023-12-13 – 22 Ruby: Heap Overflow in Floating Point Parsing #499 Valid No weakness recorded – 2013-11-22 – 26 ReDoS in Psych #1487889 Valid No weakness recorded – 2025-07-08 – 26 NET::Ftp allows command injection in filenames #294462 Valid Command and Code Injection – 2017-12-19 – 28 ReDoS in IPAddr #1485717 Valid No weakness recorded – 2025-07-08 – 32 Command injection in Pathname #449482 Valid Command and Code Injection – 2019-04-01 – 36 The taint flag is not propagated at JSON.parse #459084 Informative No weakness recorded – 2024-01-05 – 40 RCE by parsing `.rdoc_options` in RDoc #1187477 Valid Command and Code Injection – 2024-07-03 – 41 Potential HTTP Request Smuggling in ruby webrick #965267 Valid Injection and Smuggling – 2020-10-29 – 53 Path traversal in Tempfile on windows OS due to unsanitized backslashes #1131465 Valid File and Path Handling – 2021-04-07 – 54 OS Command Injection via egrep in Rake::FileList #651518 Valid Command and Code Injection – 2019-08-29 – 62