[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fCs4PFuYwvful2uCAr6jQlzDH4YBCBTKNBnPEEOHtK74":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":80,"kevVulnerabilities":140,"topProductsByCves":141,"seoMetadata":152,"meta":161},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":79},27541,"ruby-lang",13,127,0,1237,"2025-09-17","r",[16,22,27,33,37,42,48,53,59,63,67,71,75],{"id":17,"product_name":18,"version_count":19,"cve_count":20,"kev_count":11,"last_cve_update":21},139752,"ruby",958,111,"2025-03-04",{"id":23,"product_name":24,"version_count":25,"cve_count":26,"kev_count":11,"last_cve_update":13},139751,"rexml",29,8,{"id":28,"product_name":29,"version_count":30,"cve_count":31,"kev_count":11,"last_cve_update":32},139757,"webrick",16,5,"2025-06-25",{"id":34,"product_name":35,"version_count":36,"cve_count":31,"kev_count":11,"last_cve_update":21},139745,"cgi",12,{"id":38,"product_name":39,"version_count":40,"cve_count":41,"kev_count":11,"last_cve_update":21},139756,"uri",28,3,{"id":43,"product_name":44,"version_count":45,"cve_count":46,"kev_count":11,"last_cve_update":47},139750,"rdoc",72,2,"2021-07-30",{"id":49,"product_name":50,"version_count":51,"cve_count":46,"kev_count":11,"last_cve_update":52},139748,"openssl",18,"2018-11-16",{"id":54,"product_name":55,"version_count":56,"cve_count":57,"kev_count":11,"last_cve_update":58},139749,"rake",82,1,"2020-02-24",{"id":60,"product_name":61,"version_count":31,"cve_count":57,"kev_count":11,"last_cve_update":62},139754,"time","2023-03-31",{"id":64,"product_name":65,"version_count":57,"cve_count":57,"kev_count":11,"last_cve_update":66},139755,"trunk","2019-11-29",{"id":68,"product_name":69,"version_count":11,"cve_count":57,"kev_count":11,"last_cve_update":70},139753,"ruby193","2019-10-31",{"id":72,"product_name":73,"version_count":11,"cve_count":57,"kev_count":11,"last_cve_update":74},139747,"javascript_object_notation","2025-03-12",{"id":76,"product_name":77,"version_count":30,"cve_count":57,"kev_count":11,"last_cve_update":78},139746,"date","2022-01-01","Ruby-lang is a technology vendor with 13 tracked products and 127 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[81,90,97,103,110,115,120,125,130,135],{"cveId":82,"description":83,"publishedDate":84,"cvssScore":85,"cvssVersion":86,"severity":87,"isKev":88,"epssScore":89},"CVE-2017-17405","Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a local file. If the localfile argument starts with the \"|\" pipe character, the command following the pipe character is executed. The default value of localfile is File.basename(remotefile), so malicious FTP servers could cause arbitrary command execution.","2017-12-15",8.8,"v3.0","High",false,0.73829,{"cveId":91,"description":92,"publishedDate":93,"cvssScore":94,"cvssVersion":95,"severity":87,"isKev":88,"epssScore":96},"CVE-2008-3656","Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.split_header_value function in WEBrick::HTTP::DefaultFileHandler in WEBrick in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted HTTP request that is processed by a backtracking regular expression.","2008-08-13",7.8,"v2",0.70202,{"cveId":98,"description":99,"publishedDate":47,"cvssScore":100,"cvssVersion":101,"severity":87,"isKev":88,"epssScore":102},"CVE-2021-28966","In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.",7.5,"v3.1",0.58039,{"cveId":104,"description":105,"publishedDate":106,"cvssScore":107,"cvssVersion":95,"severity":108,"isKev":88,"epssScore":109},"CVE-2013-4164","Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and trunk before revision 43780 allows context-dependent attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a string that is converted to a floating point value, as demonstrated using (1) the to_f method or (2) JSON.parse.","2013-11-23",6.8,"Medium",0.34968,{"cveId":111,"description":112,"publishedDate":113,"cvssScore":31,"cvssVersion":95,"severity":108,"isKev":88,"epssScore":114},"CVE-2008-1145","Directory traversal vulnerability in WEBrick in Ruby 1.8 before 1.8.5-p115 and 1.8.6-p114, and 1.9 through 1.9.0-1, when running on systems that support backslash (\\) path separators or case-insensitive file names, allows remote attackers to access arbitrary files via (1) \"..%5c\" (encoded backslash) sequences or (2) filenames that match patterns in the :NondisclosureName option.","2008-03-04",0.27778,{"cveId":116,"description":117,"publishedDate":118,"cvssScore":85,"cvssVersion":86,"severity":87,"isKev":88,"epssScore":119},"CVE-2017-10784","The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequences into its log and possibly execute arbitrary commands via a crafted user name.","2017-09-19",0.16412,{"cveId":121,"description":122,"publishedDate":123,"cvssScore":100,"cvssVersion":95,"severity":87,"isKev":88,"epssScore":124},"CVE-2009-4492","WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel 248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.","2010-01-13",0.1623,{"cveId":126,"description":127,"publishedDate":128,"cvssScore":31,"cvssVersion":95,"severity":108,"isKev":88,"epssScore":129},"CVE-2008-3443","The regular expression engine (regex.c) in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows remote attackers to cause a denial of service (infinite loop and crash) via multiple long requests to a Ruby socket, related to memory allocation failure, and as demonstrated against Webrick.","2008-08-14",0.15678,{"cveId":131,"description":132,"publishedDate":133,"cvssScore":31,"cvssVersion":95,"severity":108,"isKev":88,"epssScore":134},"CVE-2008-3790","The REXML module in Ruby 1.8.6 through 1.8.6-p287, 1.8.7 through 1.8.7-p72, and 1.9 allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML document with recursively nested entities, aka an \"XML entity explosion.\"","2008-08-27",0.15197,{"cveId":136,"description":137,"publishedDate":138,"cvssScore":107,"cvssVersion":95,"severity":108,"isKev":88,"epssScore":139},"CVE-2013-0233","Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass security checks via unknown vectors, as demonstrated by resetting passwords of arbitrary accounts.","2013-04-25",0.14126,[],[142,143,144,145,146,147,148,149,150,151],{"id":17,"product_name":18,"version_count":19,"cve_count":20,"kev_count":11,"last_cve_update":21},{"id":23,"product_name":24,"version_count":25,"cve_count":26,"kev_count":11,"last_cve_update":13},{"id":28,"product_name":29,"version_count":30,"cve_count":31,"kev_count":11,"last_cve_update":32},{"id":34,"product_name":35,"version_count":36,"cve_count":31,"kev_count":11,"last_cve_update":21},{"id":38,"product_name":39,"version_count":40,"cve_count":41,"kev_count":11,"last_cve_update":21},{"id":43,"product_name":44,"version_count":45,"cve_count":46,"kev_count":11,"last_cve_update":47},{"id":49,"product_name":50,"version_count":51,"cve_count":46,"kev_count":11,"last_cve_update":52},{"id":54,"product_name":55,"version_count":56,"cve_count":57,"kev_count":11,"last_cve_update":58},{"id":60,"product_name":61,"version_count":31,"cve_count":57,"kev_count":11,"last_cve_update":62},{"id":64,"product_name":65,"version_count":57,"cve_count":57,"kev_count":11,"last_cve_update":66},{"title":153,"metaDescription":154,"keywords":155,"structuredData":156},"Ruby-lang - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Ruby-lang covering 13 products with 127 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Ruby-lang vulnerabilities, Ruby-lang security, Ruby-lang CVE, Ruby-lang threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":157,"@type":158,"name":159,"description":154,"url":160},"https:\u002F\u002Fschema.org","Organization","Ruby-lang","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fruby-lang",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":162,"apiVersion":163},"2026-10-17T17:21:34.618Z","3.0"]