Integer Underflow @ ossl_cipher_pkcs5_keyivgen #304115 Informative Memory Corruption – 2018-02-23 – – Invalid URL parsing '#' #341634 Informative No weakness recorded – 2018-05-01 – – SEGV in parse_rat() #363934 Informative Denial of Service – 2018-06-13 – – Heap corruption in DateTime.strftime() on 32 bit for certain format strings #144484 Informative Memory Corruption – 2016-06-21 – 1 Open aws s3 bucket s3://rubyci #257276 N/A Information Disclosure – 2017-08-06 – 1 Provide a security sistem most fit to our team #281850 N/A No weakness recorded – 2017-12-15 – 1 Potential command injection in `Shell#[]` and `Shell#test` #327512 Valid Command and Code Injection – 2019-10-16 – 1 HTTP header can split /[\r\n]/ instead of /\r\n/ #331984 Valid No weakness recorded – 2019-10-25 – 1 DRb denial of service vulnerability #898614 Informative Denial of Service – 2021-03-07 – 1 Command injection in OptionParser.load #1090678 N/A Command and Code Injection – 2021-03-07 – 1 Heap corruption in string.c tr_trans() due to undersized buffer #144485 Informative Memory Corruption – 2016-06-21 – 2 Ruby 2.3.x and 2.2.x still bundle DoS vulnerable verision of libYAML #235842 Valid Memory Corruption – 2017-10-25 – 3 Null character at fnmatch #449617 Valid No weakness recorded – 2019-10-16 – 3 Net::SMTP with tls allows forged certificates as long as the hostname matches #980249 Informative Cryptography – 2021-01-25 – 3 XMLRPC does not limit deserializable classes. #1189419 Informative Deserialization and Object Injection – 2023-08-01 – 3 Bug Report : [ No Valid SPF Records ] #1301696 Informative No weakness recorded – 2022-01-13 – 3 Response splitting vulnerability in WEBrick #153794 Valid Cross-site Scripting – 2018-04-29 – 4 Parsing invalid unicode codepoints using json c extension (2.0.1+) triggers a segfault #198927 Valid Memory Corruption – 2017-10-25 – 4 Ruby 2.4.1 has "Stack consistency error" and aborts when processing return statement within a case statement #247640 Informative Memory Corruption – 2017-09-24 – 4 Source code disclosed via S3 Bucket #778931 N/A Information Disclosure – 2020-02-13 – 4 OS Command Injection in '/lib/un.rb -- Utilities to replace common UNIX commands in Makefiles etc' #1158824 Informative Command and Code Injection – 2021-07-19 – 4 Stored XSS in RDoc hyperlinks through javascript scheme #1977258 Informative Cross-site Scripting – 2023-07-18 – 4 Ruby:HTTP Header injection in 'net/http' #146416 Informative Open Redirect – 2017-02-27 – 5 Escape sequence injection vulnerability in WEBrick BasicAuth #223363 Valid Command and Code Injection – 2017-09-15 – 5 Resolv::getaddresses bug that can be abused to bypass security measures. #287835 Informative Misconfiguration and Insecure Design – 2018-02-23 – 5 XSS exploit of RDoc documentation generated by rdoc #1321358 Informative Cross-site Scripting – 2023-07-18 – 5 ReDoS in Time.rfc2822 #1485501 Valid No weakness recorded – 2023-05-16 – 5 Header CRLF Injection in Ruby Net::HTTP #1718757 Informative Injection and Smuggling – 2023-05-04 – 5 CGI::Cookieクラスにおけるセキュリティ上好ましくない仕様および実装 #1204977 Valid Injection and Smuggling – 2022-11-24 – 6 Buffer underflow in sprintf #192127 Valid Memory Corruption – 2017-03-05 – 7 public report - Reproducible - Writable RubyCi Amazon s3 bucket[207053] #209251 Valid Authentication – 2017-03-29 – 7 OS Command Injection in 'rdoc' documentation generator #1161691 Valid Command and Code Injection – 2021-07-13 – 7 Attacker can smuggle a malicious domain in a URI object. #156615 Informative Open Redirect – 2022-12-13 – 8 Ruby is shipping a vulnerable jQuery #519061 Valid No weakness recorded – 2019-10-03 – 8 Code Injection Bug Report #745921 Valid Command and Code Injection – 2021-05-07 – 8 'net/ftp': Uncontrolled Resource Consumption (Memory/CPU) #1165748 Informative Denial of Service – 2021-04-21 – 8 RubyのCGIライブラリにHTTPレスポンス分割（HTTPヘッダインジェクション）があり、秘密情報が漏洩する #1204695 Valid Injection and Smuggling – 2022-11-24 – 8 Arbitrary heap exposure in JSON.generate #209949 Valid Memory Corruption – 2017-09-25 – 9 RCE (Remote Code Execution) Vulnerability on Ruby #218342 N/A File and Path Handling – 2017-04-05 – 9 lib/net/ftp.rb: trusting PASV responses allow client abuse #1145454 Valid Information Disclosure – 2021-07-08 – 9 'net/http': HTTP Header Injection in the set_content_type method #1168205 Informative Injection and Smuggling – 2022-02-04 – 9 SMTP command injection #137631 Valid Command and Code Injection – 2016-06-30 – 10 imap: StartTLS stripping attack (CVE-2016-0772). #1178562 Valid Cryptography – 2021-07-08 – 10 OpenSSL::X509::Name Equality Check Does Not Work, Patch included #387250 Valid Cryptography – 2018-10-19 – 11 Take back my all data from limfuimay@gmail.com #282588 Spam No weakness recorded – 2017-12-15 – 12 controlled buffer under-read in pack_unpack_internal() #298246 Valid Memory Corruption – 2018-03-30 – 12 StringIO strio_getline() can divulge arbitrary memory #144482 Valid Memory Corruption – 2016-06-21 – 13 Bugs #281942 Spam No weakness recorded – 2017-12-15 – 13 The possibility that unintended file operation may be performed because some methods of `Dir` do not check NULL characters. #302338 Valid Access Control – 2018-04-01 – 13 Writable RubyCi Amazon s3 bucket #207053 Valid Authentication – 2017-02-27 – 14