{"items":[{"id":"CVE-2015-1855","published":"2019-11-29T20:46:48.000Z","updated":"2024-08-06T04:54:16.307Z","title":"verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate…","severity":"MEDIUM","score":5.9,"vendor":"Ruby","product":"Ruby","kev":false,"epss":0.02815,"kevAdded":null,"exploit":false},{"id":"CVE-2011-3624","published":"2019-11-26T02:50:40.000Z","updated":"2024-08-06T23:37:48.555Z","title":"Various methods in WEBrick::HTTPRequest in Ruby 1.9.2 and 1.8.7 and earlier do not validate the X-Forwarded-For, X-Forwarded-Host and X-Forwarded-Server…","severity":"MEDIUM","score":5.3,"vendor":"Ruby","product":"Ruby","kev":false,"epss":0.01521,"kevAdded":null,"exploit":false},{"id":"CVE-2016-2339","published":"2017-01-06T21:00:00.000Z","updated":"2024-08-05T23:24:48.934Z","title":"An exploitable heap overflow vulnerability exists in the Fiddle::Function.new \"initialize\" function functionality of Ruby. In Fiddle::Function.new \"initialize\"…","severity":"CRITICAL","score":9.8,"vendor":"Ruby","product":"Ruby","kev":false,"epss":0.05144,"kevAdded":null,"exploit":false},{"id":"CVE-2016-2337","published":"2017-01-06T21:00:00.000Z","updated":"2024-08-05T23:24:49.158Z","title":"Type confusion exists in _cancel_eval Ruby's TclTkIp class method. Attacker passing different type of object than String as \"retval\" argument can cause…","severity":"CRITICAL","score":9.8,"vendor":"Ruby","product":"Ruby","kev":false,"epss":0.06153,"kevAdded":null,"exploit":false},{"id":"CVE-2016-2336","published":"2017-01-06T21:00:00.000Z","updated":"2024-08-05T23:24:48.901Z","title":"Type confusion exists in two methods of Ruby's WIN32OLE class, ole_invoke and ole_query_interface. Attacker passing different type of object than this assumed…","severity":"CRITICAL","score":9.8,"vendor":"Ruby","product":"Ruby","kev":false,"epss":0.03355,"kevAdded":null,"exploit":false}]}