https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 24 Oct 2026 03:09:46 +0000 https://cve.radiocsirt.org/vuln/cnvd-2015-04405 cnvd-2015-04405 https://cve.radiocsirt.org/vuln/cnvd-2015-04405 https://cve.radiocsirt.org/vuln/euvd-2026-92284 EUVD-2026-92284 https://cve.radiocsirt.org/vuln/euvd-2026-92284 https://cve.radiocsirt.org/vuln/fkie_cve-2015-4020 <p>RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.4.x before 2.4.8 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record with a domain that is suffixed with the original domain name, aka a &#34;DNS hijack attack.&#34; NOTE: this vulnerability exists because to an incomplete fix for CVE-2015-3900.</p> <p>RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.4.x before 2.4.8 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record with a domain that is suffixed with the original domain name, aka a &#34;DNS hijack attack.&#34; NOTE: this vulnerability exists because to an incomplete fix for CVE-2015-3900.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2015-4020 https://cve.radiocsirt.org/vuln/ghsa-qv62-xfj6-32xm <p><strong>Affected:</strong> RubyGems: rubygems-update</p> <p>RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.3.x before 2.4.8 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record with a domain that is suffixed with the original domain name, aka a &#34;DNS hijack attack.&#34;</p> <p>NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3900.</p> <p><strong>Affected:</strong> RubyGems: rubygems-update</p> <p>RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.3.x before 2.4.8 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record with a domain that is suffixed with the original domain name, aka a &#34;DNS hijack attack.&#34;</p> <p>NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3900.</p> https://cve.radiocsirt.org/vuln/ghsa-qv62-xfj6-32xm https://cve.radiocsirt.org/vuln/gsd-2015-4020 gsd-2015-4020 https://cve.radiocsirt.org/vuln/gsd-2015-4020