Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

rubygems Security Advisories

Loading...
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTM1bW0tY2M2ci04Zmpw
Cross-site scripting in actionpack
Ecosystems: rubygems
Packages: actionpack
Source: GitHub Advisory Database
Blast Radius: 36.2
Published: about 3 years ago
Moderate
GSA_kwCzR0hTQS02aHZnLTYycTgtOTV2N84AA2mT
svg_optimizer rubygem external XML entity (XXE) vulnerability
Ecosystems: rubygems
Packages: svg_optimizer
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: 7 months ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWZ3Y20tNjM2cC02OHI1
Server-side request forgery in CarrierWave
Ecosystems: rubygems
Packages: carrierwave
Source: GitHub Advisory Database
Blast Radius: 20.7
Published: over 3 years ago
Moderate
GSA_kwCzR0hTQS05cXZtLTJ2aGYtcTY0Oc4AAYC6
RubyGems Regular Expression Denial of Service
Ecosystems: rubygems
Packages: rubygems-update
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: about 2 years ago
Moderate
GSA_kwCzR0hTQS05ajdtLXJqcXgtNDh2aM4AATk3
RubyGems Regular Expression Denial of Service vulnerability
Ecosystems: rubygems
Packages: rubygems-update
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: about 2 years ago
Moderate
GSA_kwCzR0hTQS1qbWhoLXc3eHAtd2czOc3gKA
Nokogiri vulnerable to DoS while parsing XML entities
Ecosystems: rubygems
Packages: nokogiri
Source: GitHub Advisory Database
Blast Radius: 39.3
Published: about 2 years ago
Moderate
GSA_kwCzR0hTQS03bWo0LTI5ODQtOTU1Zs4AAUyG
AlchemyCMS is vulnerable to stored XSS via the /admin/pictures image field
Ecosystems: rubygems
Packages: alchemy_cms
Source: GitHub Advisory Database
Blast Radius: 11.5
Published: about 2 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLThyNmgtN3g5Zy14bXc5
will_paginate Cross-site Scripting vulnerability
Ecosystems: rubygems
Packages: will_paginate
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXZ4dnAtNHh3Yy1qcHA2
activesupport Cross-site Scripting vulnerability
Ecosystems: rubygems
Packages: activesupport
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
Moderate
GSA_kwCzR0hTQS00NjloLW1xZzgtNTM1cs4AA0m3
Decidim Cross-site Scripting vulnerability in the external link redirections
Ecosystems: rubygems
Packages: decidim-core, decidim
Source: GitHub Advisory Database
Blast Radius: 15.2
Published: 10 months ago
Moderate
GSA_kwCzR0hTQS05aHhmLXBwanYtdzZycc4AA0dy
gRPC connection termination issue
Ecosystems: rubygems, pypi, maven
Packages: grpc, grpcio, io.grpc:grpc-protobuf
Source: GitHub Advisory Database
Blast Radius: 63.4
Published: 11 months ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTNqOTUtZmp2Mi0zbTRw
CSS Injection in Chartkick gem
Ecosystems: rubygems
Packages: chartkick
Source: GitHub Advisory Database
Blast Radius: 22.2
Published: almost 4 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTU0M3YtZ2oyYy1yM2No
activemodel contains Improper Input Validation
Ecosystems: rubygems
Packages: activemodel
Source: GitHub Advisory Database
Blast Radius: 31.6
Published: over 6 years ago
Moderate
GSA_kwCzR0hTQS14cDVoLWY4amYtcmM4cc4AAzxa
rails-ujs vulnerable to DOM Based Cross-site Scripting contenteditable HTML Elements
Ecosystems: rubygems
Packages: actionview
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: 12 months ago
Moderate
GSA_kwCzR0hTQS1jOHY2LTc4Nmctdmp4Ns4AA5mu
json-jwt allows bypass of identity checks via a sign/encryption confusion attack
Ecosystems: rubygems
Packages: json-jwt
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: 3 months ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXY5djQtN2pwNi04Yzcz
rails Cross-site Scripting vulnerability
Ecosystems: rubygems
Packages: activesupport, actionpack
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTY3ajYteHYyNy13Nnd3
Web Console (Ruby gem) contains whitelisted_ips bypass
Ecosystems: rubygems
Packages: web-console
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWpwNXYtNWd4NC1qbWo5
Ability to forge per-form CSRF tokens in Rails
Ecosystems: rubygems
Packages: actionpack
Source: GitHub Advisory Database
Blast Radius: 25.6
Published: almost 4 years ago
Moderate
GSA_kwCzR0hTQS12ZzNyLXJtN3ctMnhnaM4AA8Kv
REXML contains a denial of service vulnerability
Ecosystems: rubygems
Packages: rexml
Source: GitHub Advisory Database
Blast Radius: 28.8
Published: 4 days ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTY1Y3YtcjZ4Ny03OWh2
Cross site scripting vulnerability in ActionView
Ecosystems: rubygems
Packages: actionview
Source: GitHub Advisory Database
Blast Radius: 27.7
Published: about 4 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTc1dzYtcDZtZy12aDhq
Rails actionpack gem vulnerable to Cross-site Scripting
Ecosystems: rubygems
Packages: actionview, actionpack
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWZnOXctZzZtNC01NTdq
actionpack and activesupport vulnerable to information leaks
Ecosystems: rubygems
Packages: activesupport, actionpack
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXE1OGctNDU1cC04dnc5
In RubyGem excon, interrupted Persistent Connections May Leak Response Data
Ecosystems: rubygems
Packages: excon
Source: GitHub Advisory Database
Blast Radius: 28.1
Published: over 4 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWdxdmYtODkyci12am01
Improper Certificate Validation in Puppet
Ecosystems: rubygems
Packages: puppet
Source: GitHub Advisory Database
Blast Radius: 26.6
Published: about 3 years ago
Moderate
GSA_kwCzR0hTQS02MnFwLTNmeG0tOXd4Zs3gJg
Nokogiri vulnerable to DoS while parsing XML documents
Ecosystems: rubygems
Packages: nokogiri
Source: GitHub Advisory Database
Blast Radius: 39.3
Published: about 2 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXdnOW0tZ3czaC1oZzgz
field_test gem contains injection vulnerability
Ecosystems: rubygems
Packages: field_test
Source: GitHub Advisory Database
Blast Radius: 11.4
Published: almost 5 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTczcmYtNm1yZi03NTlx
devise Time-of-check Time-of-use Race Condition vulnerability
Ecosystems: rubygems
Packages: devise
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: about 5 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXh4cjgtODMzdi1jN3dj
Cross-site Scripting vulnerability in i18n translations helper method
Ecosystems: rubygems
Packages: actionpack
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
Moderate
GSA_kwCzR0hTQS03dmg3LWZ3ODgtd2o4N84AA1Il
Several quadratic complexity bugs may lead to denial of service in Commonmarker
Ecosystems: rubygems
Packages: commonmarker
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: 10 months ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTI0ZmctcDk2di1oeGg4
actionpack Cross-Site Request Forgery vulnerability
Ecosystems: rubygems
Packages: actionpack
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTZ4NDUtODZxNi1yY21y
Gyazo allows local users to write arbitrary files
Ecosystems: rubygems
Packages: gyazo
Source: GitHub Advisory Database
Blast Radius: 5.9
Published: over 6 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXZ2NGMtZzZxNy1wM3E3
Doorkeeper-openid_connect contains Open Redirect
Ecosystems: rubygems
Packages: doorkeeper-openid_connect
Source: GitHub Advisory Database
Blast Radius: 18.0
Published: about 5 years ago
Moderate
GSA_kwCzR0hTQS1xdjYyLXhmajYtMzJ4bc4AAYCz
RubyGems Improper Input Validation vulnerability
Ecosystems: rubygems
Packages: rubygems-update
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: about 2 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLW0ycTMtNTNmcS03aDY2
Gollum Exposure of Sensitive Information
Ecosystems: rubygems
Packages: gollum
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 5 years ago
Moderate
GSA_kwCzR0hTQS0yODZ2LXBjZjUtMjVyY84AAof1
Nokogiri Implements libxml2 version vulnerable to null pointer dereferencing
Ecosystems: rubygems
Packages: nokogiri
Source: GitHub Advisory Database
Blast Radius: 35.6
Published: almost 2 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLW1xMzUtd3F2Zi1yMjNj
Sinatra Cross-site Scripting vulnerability
Ecosystems: rubygems
Packages: sinatra
Source: GitHub Advisory Database
Blast Radius: 31.5
Published: almost 6 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWh3aGgtMmZ3bS1jZmd3
Doorkeeper is vulnerable to stored XSS and code execution
Ecosystems: rubygems
Packages: doorkeeper
Source: GitHub Advisory Database
Blast Radius: 22.8
Published: about 6 years ago
Moderate
GSA_kwCzR0hTQS14Yzg1LTMybWYteHB2OM3iYQ
Rack arbitrary code execution via timing attack
Ecosystems: rubygems
Packages: rack
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: about 2 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTVocTIteGY4OS05anhx
Possible Open Redirect Vulnerability in Action Pack
Ecosystems: rubygems
Packages: actionpack
Source: GitHub Advisory Database
Blast Radius: 36.2
Published: about 3 years ago
Moderate
GSA_kwCzR0hTQS00OHdwLXA5cXYtNGo2NM4AAytp
Commonmarker vulnerable to to several quadratic complexity bugs that may lead to denial of service
Ecosystems: rubygems
Packages: commonmarker
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: about 1 year ago
Moderate
GSA_kwCzR0hTQS0zZ2c0LTZocWctMnZqeM4AARoc
Logstash Logs Sensitive Information
Ecosystems: rubygems
Packages: logstash-core
Source: GitHub Advisory Database
Blast Radius: 19.7
Published: about 2 years ago
Moderate
GSA_kwCzR0hTQS02andjLXFyMnEtN3h3as4AA1CM
protocol-http1 HTTP Request/Response Smuggling vulnerability
Ecosystems: rubygems
Packages: protocol-http1
Source: GitHub Advisory Database
Blast Radius: 16.6
Published: 10 months ago
Moderate
GSA_kwCzR0hTQS04OHA4LTR2djUtODJqN84AAxNG
xaviershay-dm-rails Gem for Ruby exposes sensitive information via the process table
Ecosystems: rubygems
Packages: xaviershay-dm-rails
Source: GitHub Advisory Database
Blast Radius: 1.0
Published: over 1 year ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWM0M3YtaHJtZy01NnI0
Cocaine Gem OS Command Injection vulnerability
Ecosystems: rubygems
Packages: cocaine
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
Moderate
GSA_kwCzR0hTQS00OWp4LTljbWMteGp4bc3ilw
Bundler may install gems from a different source than expected
Ecosystems: rubygems
Packages: bundler
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: about 2 years ago
Moderate
GSA_kwCzR0hTQS12cHF2LW1xdmMtcGN4Ms4AAyKB
Reflective Cross-site Scripting Vulnerability in twitter-bootstrap-rails
Ecosystems: rubygems
Packages: twitter-bootstrap-rails
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: about 1 year ago
Moderate
GSA_kwCzR0hTQS04eG0zLWdtN2MtNWZqeM4AAWfr
Ember.js Cross-site Scripting vulnerability
Ecosystems: rubygems
Packages: ember-source
Source: GitHub Advisory Database
Blast Radius: 19.0
Published: about 2 years ago
Moderate
GSA_kwCzR0hTQS00MmdxLWg3eGotMzNyNM3ggA
Features file injection vulnerability
Ecosystems: rubygems
Packages: features
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: about 2 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXc3cTkteHIyeC13aDd4
delayed_job_web Cross-site Scripting vulnerability
Ecosystems: rubygems
Packages: delayed_job_web
Source: GitHub Advisory Database
Blast Radius: 15.7
Published: about 6 years ago
Moderate
GSA_kwCzR0hTQS12NmozLTdqcnctaHEycM4AAe7J
Rack Gem Subject to Denial of Service via Hash Collisions
Ecosystems: maven, rubygems
Packages: org.jruby:jruby-parent, rack
Source: GitHub Advisory Database
Blast Radius: 1.0
Published: about 2 years ago
Moderate
GSA_kwCzR0hTQS1wajczLXY1bXctcG05as4AAyIp
Possible XSS Security Vulnerability in SafeBuffer#bytesplice
Ecosystems: rubygems
Packages: activesupport
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: about 1 year ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWY1OTktNW03cC1oY3Bm
grape subject to Cross-site Scripting
Ecosystems: rubygems
Packages: grape
Source: GitHub Advisory Database
Blast Radius: 23.7
Published: almost 6 years ago
Moderate
GSA_kwCzR0hTQS04N3F4LWc1d2ctbXdtas4AATa0
RubyGems Cross-site Scripting vulnerability
Ecosystems: maven, rubygems
Packages: org.jruby:jruby-stdlib, rubygems-update
Source: GitHub Advisory Database
Blast Radius: 22.6
Published: about 2 years ago
Moderate
GSA_kwCzR0hTQS04cXhnLW1mZjUtajN3Y84AAUt2
RubyGems Path Traversal vulnerability
Ecosystems: maven, rubygems
Packages: org.jruby:jruby-stdlib, rubygems-update
Source: GitHub Advisory Database
Blast Radius: 20.4
Published: about 2 years ago
Moderate
GSA_kwCzR0hTQS1tdnFyLXI3NmMtd201Zs4AAiIZ
Devise Token Auth vulnerable to Cross-site Scripting
Ecosystems: rubygems
Packages: devise_token_auth
Source: GitHub Advisory Database
Blast Radius: 20.7
Published: almost 2 years ago
Moderate
GSA_kwCzR0hTQS0zaDd2LXdxdzctZmYyOM4AArCV
Cross site scripting in publify
Ecosystems: rubygems
Packages: publify_core
Source: GitHub Advisory Database
Blast Radius: 4.9
Published: almost 2 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXE2Y3ctMjU1My03ODM3
newrelic_rpm Gem Discloses Sensitive Information
Ecosystems: rubygems
Packages: newrelic_rpm
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
Moderate
GSA_kwCzR0hTQS1ocnA2LXc0djItODczN84AAfFd
Rack-Cache caches sensitive headers
Ecosystems: rubygems
Packages: rack-cache
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: about 2 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTV2M2YtNzNndi14N3g1
cairo is vulnerable to denial of service due to a null pointer dereference
Ecosystems: rubygems
Packages: cairo
Source: GitHub Advisory Database
Blast Radius: 16.6
Published: over 6 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXd3NzktOHh3di05MzJ4
rbovirt uses the rest-client gem with SSL verification disabled
Ecosystems: rubygems
Packages: rbovirt
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXg3cDIteDJqNi1td2hy
Gemirro Stored XSS in Gemspec "homepage" value
Ecosystems: rubygems
Packages: gemirro
Source: GitHub Advisory Database
Blast Radius: 1.8
Published: over 6 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTY4OGMtM3g0OS02cnFq
rack-protection gem timing attack vulnerability when validating CSRF token
Ecosystems: rubygems
Packages: rack-protection
Source: GitHub Advisory Database
Blast Radius: 30.1
Published: about 6 years ago
Moderate
GSA_kwCzR0hTQS1majdmLXZxODQtZmg0M80Z-g
Local Code Execution through Argument Injection via dash leading git url parameter in Gemfile.
Ecosystems: rubygems
Packages: bundler
Source: GitHub Advisory Database
Blast Radius: 35.9
Published: over 2 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWZqZmctcTY2Mi1nbTZq
Moderate severity vulnerability that affects rails
Ecosystems: rubygems
Packages: rails
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXE4NmYtZm1xZi1xcmY2
Mail Gem CRLF Injection vulnerability
Ecosystems: rubygems
Packages: mail
Source: GitHub Advisory Database
Blast Radius: 36.2
Published: over 6 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXFxeHAteHA5di12dng2
jquery-ui Tooltip widget vulnerable to XSS
Ecosystems: nuget, maven, rubygems, npm
Packages: jQuery.UI.Combined, org.webjars.npm:jquery-ui, jquery-ui-rails, jquery-ui
Source: GitHub Advisory Database
Blast Radius: 1.0
Published: over 6 years ago
Moderate
GSA_kwCzR0hTQS1tbTMzLTV2ZnEtM21tM81BUA
Cross-site Scripting Vulnerability in Action Pack
Ecosystems: rubygems
Packages: actionpack
Source: GitHub Advisory Database
Blast Radius: 36.2
Published: about 2 years ago
Moderate
GSA_kwCzR0hTQS1qbTM1LWg4cTItNzNtcM05RA
Improper one time password handling in devise-two-factor
Ecosystems: rubygems
Packages: devise-two-factor
Source: GitHub Advisory Database
Blast Radius: 17.3
Published: about 2 years ago
Moderate
GSA_kwCzR0hTQS0yNTRqLW1tYzUtcWhweM4AApCM
Smashing Cross-site Scripting vulnerability
Ecosystems: rubygems
Packages: smashing
Source: GitHub Advisory Database
Blast Radius: 12.6
Published: almost 2 years ago
Moderate
GSA_kwCzR0hTQS01Z3hwLWMzNzktcGo0Ms4AAYUG
ccsv Double Free vulnerability
Ecosystems: rubygems
Packages: ccsv
Source: GitHub Advisory Database
Blast Radius: 5.0
Published: about 2 years ago
Moderate
GSA_kwCzR0hTQS1yeDdqLW13NGMtNzZnOc4AATRU
Authlogic Information Exposure vulnerability
Ecosystems: rubygems
Packages: authlogic
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: about 2 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTJwcWotaDN2ai1wcWd3
Cross-Site Scripting in jquery
Ecosystems: rubygems, nuget, maven, npm
Packages: jquery-rails, jQuery, org.webjars.npm:jquery, jquery
Source: GitHub Advisory Database
Blast Radius: 104.9
Published: over 3 years ago
Moderate
GSA_kwCzR0hTQS14Nzh2LTRmdmotcmc5as4AArLe
Camaleon CMS Stored Cross-site Scripting vulnerability
Ecosystems: rubygems
Packages: camaleon_cms
Source: GitHub Advisory Database
Blast Radius: 7.8
Published: almost 2 years ago
Moderate
GSA_kwCzR0hTQS12eDZwLXE0Z2oteDZ4eM4AAqWr
Camaleon CMS vulnerable to Server-Side Request Forgery
Ecosystems: rubygems
Packages: camaleon_cms
Source: GitHub Advisory Database
Blast Radius: 6.3
Published: almost 2 years ago
Moderate
GSA_kwCzR0hTQS02MzZmLXhtNWotcGo5bc4AAxIx
Several quadratic complexity bugs may lead to denial of service in Commonmarker
Ecosystems: rubygems
Packages: commonmarker
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 1 year ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTloeDktdzJqNi1ydzc2
Script Injection in Show In Browser gem
Ecosystems: rubygems
Packages: show_in_browser
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
Moderate
GSA_kwCzR0hTQS12dzIyLTQ2NXAtOGo1d84AAR7S
Tarball permission preservation in puppet
Ecosystems: rubygems
Packages: puppet
Source: GitHub Advisory Database
Blast Radius: 22.5
Published: about 2 years ago
Moderate
GSA_kwCzR0hTQS1majJ3LXFtanAtM3Jqbc4AAtaY
Gollum Cross-site Scripting vulnerability via filename parameter to New Page dialog
Ecosystems: rubygems
Packages: gollum
Source: GitHub Advisory Database
Blast Radius: 18.0
Published: almost 2 years ago
Moderate
GSA_kwCzR0hTQS1oNmdqLTZqanEtaDhnOc4AAtcw
jQuery UI vulnerable to XSS when refreshing a checkboxradio with an HTML-like initial text label
Ecosystems: nuget, rubygems, maven, npm
Packages: jQuery.UI.Combined, jquery-ui-rails, org.webjars.npm:jquery-ui, jquery-ui
Source: GitHub Advisory Database
Blast Radius: 55.7
Published: almost 2 years ago
Moderate
GSA_kwCzR0hTQS1yOHh4LTh2bTgteDZ3as4AA34N
Resque vulnerable to Reflected Cross Site Scripting through pathnames
Ecosystems: rubygems
Packages: resque
Source: GitHub Advisory Database
Blast Radius: 24.6
Published: 5 months ago
Moderate
GSA_kwCzR0hTQS14aHZ2LTNqd3ctYzQ4N84AA4D6
ActiveAdmin CSV Injection leading to sensitive information disclosure
Ecosystems: rubygems
Packages: activeadmin
Source: GitHub Advisory Database
Blast Radius: 21.9
Published: 5 months ago
Moderate
GSA_kwCzR0hTQS1yOW1xLW03MngtMjU3Z84AA34L
Resque vulnerable to reflected XSS in Queue Endpoint
Ecosystems: rubygems
Packages: resque
Source: GitHub Advisory Database
Blast Radius: 24.6
Published: 5 months ago
Moderate
GSA_kwCzR0hTQS1ycmZjLTdnOHAtOTlxOM4AAwSi
Possible XSS vulnerability with certain configurations of rails-html-sanitizer
Ecosystems: rubygems
Packages: rails-html-sanitizer
Source: GitHub Advisory Database
Blast Radius: 34.9
Published: over 1 year ago
Moderate
GSA_kwCzR0hTQS05aDlnLTkzZ2MtNjIzaM4AAwSh
Possible XSS vulnerability with certain configurations of rails-html-sanitizer
Ecosystems: rubygems
Packages: rails-html-sanitizer
Source: GitHub Advisory Database
Blast Radius: 34.9
Published: over 1 year ago
Moderate
GSA_kwCzR0hTQS1tY3ZmLTJxMm0teDcybc4AAwSg
Improper neutralization of data URIs may allow XSS in rails-html-sanitizer
Ecosystems: rubygems
Packages: rails-html-sanitizer
Source: GitHub Advisory Database
Blast Radius: 34.9
Published: over 1 year ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTZtcTItMzdqNS13NnI2
WEBrick Improper Input Validation vulnerability
Ecosystems: rubygems
Packages: webrick
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
Moderate
GSA_kwCzR0hTQS13ZjJ4LTh3NmotcXczN84AA4My
view_component Cross-site Scripting vulnerability
Ecosystems: rubygems
Packages: view_component
Source: GitHub Advisory Database
Blast Radius: 19.5
Published: 5 months ago
Moderate
GSA_kwCzR0hTQS1nOHZwLTJ2NXAtOXFmaM4AA4ir
Cross-site scripting (XSS) in Action messages on Avo
Ecosystems: rubygems
Packages: avo
Source: GitHub Advisory Database
Blast Radius: 9.5
Published: 4 months ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXc1NDItY3BwOS1yM2c3
Field Test CSRF vulnerability
Ecosystems: rubygems
Packages: field_test
Source: GitHub Advisory Database
Blast Radius: 9.2
Published: almost 4 years ago
Moderate
GSA_kwCzR0hTQS1oNGg1LTNocjQtajNnMs4AAvKm
protobuf-java has a potential Denial of Service issue
Ecosystems: maven, rubygems
Packages: com.google.protobuf:protobuf-kotlin-lite, com.google.protobuf:protobuf-javalite, google-protobuf, com.google.protobuf:protobuf-kotlin, com.google.protobuf:protobuf-java
Source: GitHub Advisory Database
Blast Radius: 47.0
Published: over 1 year ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWNqNDMtOWgzdy12OTc2
Puppet allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service
Ecosystems: rubygems
Packages: puppet
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
Moderate
GSA_kwCzR0hTQS14Yzl4LWpqNzctOXA5as4AA5Ek
Nokogiri update packaged libxml2 to v2.12.5 to resolve CVE-2024-25062
Ecosystems: rubygems
Packages: nokogiri
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: 3 months ago
Moderate
GSA_kwCzR0hTQS00cXc0LWpwcDQtOGd2cM4AAu97
Unbounded resource exhaustion in cmark-gfm autolink extension may lead to denial of service
Ecosystems: rubygems
Packages: commonmarker
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 1 year ago
Moderate
GSA_kwCzR0hTQS1mNjhtLXEyNnItNjRmNs4AAfmQ
Chef Improper Access Control vulnerability
Ecosystems: rubygems
Packages: chef
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: about 2 years ago
Moderate
GSA_kwCzR0hTQS1xcGhjLWhmNXEtdjhmY80bRw
actionpack Open Redirect in Host Authorization Middleware
Ecosystems: rubygems
Packages: actionpack
Source: GitHub Advisory Database
Blast Radius: 36.2
Published: over 2 years ago
Moderate
GSA_kwCzR0hTQS1qN3F2LXBnZjYtaHZoNM0Wtw
XSS in `*Text` options of the Datepicker widget in jquery-ui
Ecosystems: rubygems, nuget, maven, npm
Packages: jquery-ui-rails, jQuery.UI.Combined, org.webjars.npm:jquery-ui, jquery-ui
Source: GitHub Advisory Database
Blast Radius: 59.3
Published: over 2 years ago
Moderate
GSA_kwCzR0hTQS1ncHFxLTk1MnEtNTMyN80Wtg
XSS in the `of` option of the `.position()` util in jquery-ui
Ecosystems: rubygems, nuget, maven, npm
Packages: jquery-ui-rails, jQuery.UI.Combined, org.webjars.npm:jquery-ui, jquery-ui
Source: GitHub Advisory Database
Blast Radius: 59.3
Published: over 2 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXB4M3Itam05Zy1jOHc4
rails-html-sanitizer Cross-site Scripting vulnerability
Ecosystems: rubygems
Packages: rails-html-sanitizer
Source: GitHub Advisory Database
Blast Radius: 34.9
Published: about 6 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTY1M20tcjMzeC0zOWZm
Geminabox contains Cross-site Scripting
Ecosystems: rubygems
Packages: geminabox
Source: GitHub Advisory Database
Blast Radius: 14.9
Published: over 6 years ago
Moderate
GSA_kwCzR0hTQS0zM3doLXc0bTctYzZyOM4AAt8F
update_by_case before 0.1.3 can be vulnerable to sql injection
Ecosystems: rubygems
Packages: update_by_case
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: almost 2 years ago
Statistics
Advisories: 18,793
Packages: 8,393
Repositories: 285
Ecosystems: 12
Filter by Package
actionpack 57 nokogiri 43 rubygems-update 25 puppet 23 rack 22 activerecord 21 publify_core 14 activesupport 14 passenger 13 actionview 12 rails 11 puma 11 fat_free_crm 10 jquery-rails 9 rails-html-sanitizer 9 jquery 8 org.webjars.npm:jquery 8 decidim 7 jQuery.UI.Combined 7 org.webjars.npm:jquery-ui 7 jQuery 7 org.jruby:jruby-stdlib 7 jquery-ui-rails 7 jquery-ui 7 camaleon_cms 6 katello 6 loofah 6 doorkeeper 6 ember-source 6 commonmarker 5 bundler 5 spree_auth_devise 5 spree 5 sidekiq 5 sanitize 4 grpc 4 grpcio 4 carrierwave 4 webrick 4 activestorage 4 mail 4 sinatra 4 devise 4 dragonfly 4 avo 4 fluentd 4 gollum 3 decidim-core 3 chartkick 3 openssl 3 bootstrap 3 geminabox 3 rubyzip 3 resque 3 ruby-saml 3 bootstrap 3 yard 3 cgi 3 omniauth 3 rest-client 3 rdoc 3 json-jwt 3 private_address_check 3 rails_admin 3 rack-cors 3 git 3 io.grpc:grpc-protobuf 3 phlex 3 paperclip 2 omniauth-facebook 2 net-ldap 2 echor 2 mini_magick 2 twitter-bootstrap-rails 2 sup 2 sprockets 2 bson 2 json 2 rexml 2 safemode 2 ox 2 user_agent_parser 2 pghero 2 field_test 2 solidus_core 2 faye 2 view_component 2 spina 2 cocoapods-downloader 2 solidus_frontend 2 uri 2 devise-two-factor 2 redcarpet 2 pdfkit 2 kramdown 2 i18n 2 httparty 2 VladTheEnterprising 2 red-arrow 2 pyarrow 2 radiant 2 mechanize 2 activeadmin 2 logstash-core 2 google-protobuf 2 com.google.protobuf:protobuf-kotlin 2 administrate 2 pageflow 2 yajl-ruby 2 secure_headers 2 decidim-templates 2 qiita-markdown 2 mapbox.js 2 mapbox-rails 2 bootstrap-sass 2 facter 2 git-fastclone 2 ruby-openid 2 com.google.protobuf:protobuf-java 2 blazer 1 rmagick 1 geokit-rails 1 multi_xml 1 gitlab-grit 1 brbackup 1 foreman_ansible 1 solidus_auth_devise 1 keynote 1 railties 1 twitter-stream 1 hiera 1 mcollective-client 1 wicked 1 actionmailer 1 kelredd-pruview 1 hub 1 sqlite3-ruby 1 github.com/github/hub 1 websocket-extensions 1 thin 1 rack-mini-profiler 1 ruby-jss 1 cap-strap 1 matestack-ui-core 1 sha3 1 pysha3 1 restforce 1 solidus_backend 1 better_errors 1 mongrel 1 unpoly-rails 1 bindata 1 oxidized-web 1 github.com/pubnub/swift 1 pubnub 1 pubnub 1 pubnub/pubnub 1 pubnub 1 pubnub 1 Pubnub 1 github.com/pubnub/go/v5 1 github.com/pubnub/go/v6 1 github.com/pubnub/go 1 github.com/pubnub/go/v7 1 com.pubnub:pubnub 1 com.pubnub:pubnub-kotlin 1 rubocop 1 ruby-mysql 1 gtk2 1 rotp 1 @turbo-boost/commands 1 turbo_boost-commands 1 discordrb 1 diffy 1 recurly 1 md2pdf 1 sounder 1 date 1 octopoller 1 paratrooper-newrelic 1 jmespath 1 trilogy 1 sentry-raven 1 ruby_parser 1 ftpd 1 tweetstream 1 flash_tool 1 lean-ruport 1 openshift-origin-node 1 point-cli 1 govuk_tech_docs 1 audited 1 omniauth-apple 1 spree_api 1 omniauth-auth0 1 shrine 1 message_bus 1 inline_svg 1 pdf_info 1 rswag 1
Filter by Repository
https://github.com/rails/rails 53 https://github.com/sparklemotion/nokogiri 32 https://github.com/rubygems/rubygems 18 https://github.com/rack/rack 17 https://github.com/puppetlabs/puppet 15 https://github.com/publify/publify 13 https://github.com/puma/puma 11 https://github.com/phusion/passenger 10 https://github.com/jquery/jquery 9 https://github.com/rails/rails-html-sanitizer 9 https://github.com/fatfreecrm/fat_free_crm 9 https://github.com/decidim/decidim 8 https://github.com/doorkeeper-gem/doorkeeper 6 https://github.com/flavorjones/loofah 6 https://github.com/jquery/jquery-ui 6 https://github.com/solidusio/solidus 5 https://github.com/solidusio/solidus_auth_devise 5 https://github.com/owen2345/camaleon-cms 4 https://github.com/mikel/mail 4 https://github.com/markevans/dragonfly 4 https://github.com/Katello/katello 4 https://github.com/ruby/openssl 4 https://github.com/avo-hq/avo 4 https://github.com/grpc/grpc 4 https://github.com/carrierwaveuploader/carrierwave 4 https://github.com/rgrove/sanitize 4 https://github.com/sinatra/sinatra 4 https://github.com/fluent/fluentd 4 https://github.com/sidekiq/sidekiq 3 https://github.com/rubygems/rubygems.org 3 https://github.com/ruby-git/ruby-git 3 https://github.com/rubyzip/rubyzip 3 https://github.com/resque/resque 3 https://github.com/spree/spree 3 https://github.com/phlex-ruby/phlex 3 https://github.com/rest-client/rest-client 3 https://github.com/cyu/rack-cors 3 https://github.com/geminabox/geminabox 3 https://github.com/twbs/bootstrap 3 https://github.com/lsegal/yard 3 https://github.com/gjtorikian/commonmarker 3 https://github.com/gollum/gollum 3 https://github.com/jtdowney/private_address_check 3 https://github.com/emberjs/ember.js 2 https://github.com/codevise/pageflow 2 https://github.com/CocoaPods/cocoapods-downloader 2 https://github.com/brianmario/yajl-ruby 2 https://github.com/ankane/pghero 2 https://github.com/ankane/field_test 2 https://github.com/ruby-ldap/ruby-net-ldap 2 https://github.com/ankane/chartkick 2 https://github.com/ruby/rdoc 2 https://github.com/ruby/rexml 2 https://github.com/ruby/uri 2 https://github.com/ruby/webrick 2 https://github.com/activeadmin/activeadmin 2 https://github.com/faye/faye 2 https://github.com/gettalong/kramdown 2 https://github.com/github/cmark-gfm 2 https://github.com/increments/qiita-markdown 2 https://github.com/jnunemaker/httparty 2 https://github.com/protocolbuffers/protobuf 2 https://github.com/plataformatec/devise 2 https://github.com/mongodb/bson-ruby 2 https://github.com/mperham/sidekiq 2 https://github.com/nov/json-jwt 2 https://github.com/openid/ruby-openid 2 https://github.com/omniauth/omniauth 2 https://github.com/ohler55/ox 2 https://github.com/vmg/redcarpet 2 https://github.com/sparklemotion/mechanize 2 https://github.com/square/git-fastclone 2 https://github.com/twitter/secure_headers 2 https://github.com/tinfoil/devise-two-factor 2 https://github.com/sup-heliotrope/sup 2 https://github.com/svenfuchs/i18n 2 https://github.com/svenfuchs/safemode 2 https://github.com/thoughtbot/paperclip 2 https://gitlab.com/gitlab-org/cves 2 https://github.com/github/view_component 1 https://github.com/github/trilogy 1 https://github.com/github/hub 1 https://github.com/twbs/bootstrap-sass 1 https://github.com/theforeman/smart_proxy_dynflow 1 https://github.com/kaminari/kaminari 1 https://github.com/getsentry/raven-ruby 1 https://github.com/geokit/geokit-rails 1 https://github.com/tzinfo/tzinfo 1 https://github.com/gazay/gon 1 https://github.com/fnando/svg_optimizer 1 https://github.com/ua-parser/uap-core 1 https://github.com/flori/json 1 https://github.com/ua-parser/uap-ruby 1 https://github.com/ffi/ffi 1 https://github.com/faye/websocket-extensions-ruby 1 https://github.com/faye/faye-websocket-ruby 1 https://github.com/unpoly/unpoly-rails 1 https://github.com/ViewComponent/view_component 1 https://github.com/theforeman/ldap_fluff 1 https://github.com/exiftool-rb/exiftool_vendored.rb 1 https://github.com/excon/excon 1 https://github.com/jnunemaker/crack 1 https://github.com/jmespath/jmespath.rb 1 https://github.com/jirutka/asciidoctor-include-ext 1 https://github.com/jgarber/redcloth 1 https://github.com/jekyll/jekyll 1 https://github.com/janko/image_processing 1 https://github.com/jamesmartin/inline_svg 1 https://github.com/inukshuk/bibtex-ruby 1 https://github.com/thoughtbot/cocaine 1 https://github.com/imsebao/404team 1 https://github.com/jordansissel/ruby-arr-pm 1 https://github.com/igrigorik/em-http-request 1 https://github.com/josh/rack-ssl 1 https://github.com/hopsoft/turbo_boost-commands 1 https://github.com/heartcombo/devise 1 https://github.com/haml/haml 1 https://github.com/thoughtbot/clearance 1 https://github.com/halostatue/minitar 1 https://github.com/Gurpartap/aescrypt 1 https://github.com/tigris/open-uri-cached 1 https://github.com/thoughtbot/administrate 1 https://github.com/GNOME/libxml2 1 https://github.com/TrestleAdmin/trestle-auth 1 https://github.com/evan/ccsv 1 https://github.com/binarylogic/authlogic 1 https://github.com/BetterErrors/better_errors 1 https://github.com/beenhero/omniauth-weibo-oauth2 1 https://github.com/bdmac/strong_password 1 https://github.com/bbatsov/rubocop 1 https://github.com/basecamp/marginalia 1 https://github.com/basecamp/easymon 1 https://github.com/aws/aws-sdk-ruby 1 https://github.com/zendesk/samlr 1 https://github.com/auth0/omniauth-auth0 1 https://github.com/asteinhauser/fat_free_crm 1 https://github.com/asciidoctor/asciidoctor 1 https://github.com/ankane/pgsync 1 https://github.com/zenspider/ruby_parser-legacy 1 https://github.com/zvory/csv-safe 1 https://github.com/ankane/clockwork_web 1 https://github.com/ankane/chartkick.js 1 https://gitlab.com/2013/11 1 https://github.com/ankane/blazer 1 https://github.com/amro/gibbon 1 https://github.com/alphagov/tech-docs-gem 1 https://github.com/alexreisner/geocoder 1 https://github.com/AlchemyCMS/alchemy_cms 1 https://github.com/airbrake/airbrake-ruby 1 https://github.com/ahorner/text-helpers 1 https://github.com/affix/CVE-2022-36231 1 https://github.com/adamzaninovich/sounder 1 https://github.com/elastic/logstash 1 https://github.com/elastic/apm-agent-ruby 1 https://github.com/ejschmitt/delayed_job_web 1 https://github.com/dspinhirne/netaddr-rb 1 https://github.com/doorkeeper-gem/doorkeeper-openid_connect 1 https://github.com/voloko/twitter-stream 1 https://github.com/dmendel/bindata 1 https://github.com/discourse/rails_multisite 1 https://github.com/discourse/message_bus 1 https://github.com/denkGroot/Spina 1 https://github.com/dejan/espeak-ruby 1 https://github.com/wconrad/ftpd 1 https://github.com/datamapper/extlib 1 https://github.com/webbynode/webbynode 1 https://github.com/ConradIrwin/em-imap 1 https://github.com/collectiveidea/audited 1 https://github.com/whiteleaf7/narou 1 https://github.com/codders/dataset 1 https://github.com/wycats/handlebars.js 1 https://github.com/chef/mixlib-archive 1 https://github.com/cgriego/active_attr 1 https://github.com/XKCP/XKCP 1 https://github.com/camilova/activerecord-update-by-case 1 https://github.com/bvsatyaram/random_password_generator 1 https://github.com/bundler/bundler 1 https://github.com/ytti/oxidized-web 1 https://github.com/boazsegev/iodine 1 https://github.com/rf-/keynote 1 https://github.com/restforce/restforce 1 https://github.com/sisimai/rb-sisimai 1 https://github.com/resque/resque-scheduler 1 https://github.com/Smashing/smashing 1 https://github.com/redis-store/redis-store 1 https://github.com/recurly/recurly-client-ruby 1 https://github.com/rdoc/rdoc 1 https://github.com/rcook/rgpg 1 https://github.com/rapid7/metasploit-framework 1 https://github.com/rails/web-console 1 https://github.com/rails/sprockets 1 https://github.com/Snorby/snorby 1 https://github.com/socketry/protocol-http1 1 https://github.com/rails/kredis 1 https://github.com/rails/jquery-rails 1 https://github.com/rails/globalid 1 https://github.com/railsdog/spree 1 https://github.com/railsadminteam/rails_admin 1 https://github.com/rails/activeresource 1