rubygems http vulnerabilities

Latest rubygems http CVEs

Newest publication first

1. CVE-2015-1828 http vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

   Published 2017-10-06

   Medium·CVSS 5.9 EPSS 1.5% PoC

   The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.