Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

rubygems Security Advisories

Loading...
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTlmaDMtdmgzaC1xNGcz
activesupport Cross-site Scripting vulnerability
Ecosystems: rubygems
Packages: activesupport
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXc2cmMtcTM4Ny12cGdx
insecure temporary directory usage in passenger
Ecosystems: rubygems
Packages: passenger
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXA0YzYtNzdnYy02OTR4
session fixation protection mechanism in cgi_process.rb in Rails
Ecosystems: rubygems
Packages: rails
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
Moderate
GSA_kwCzR0hTQS02eHhxLWozOXctZzNmNs4AATUt
Puppet Arbitrary Command Execution
Ecosystems: rubygems
Packages: puppet
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: almost 2 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXEzNGMtNDhnYy1tOWc4
actionpack allows remote attackers to bypass database-query restrictions, perform NULL checks via crafted request
Ecosystems: rubygems
Packages: actionpack
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
Moderate
GSA_kwCzR0hTQS05cHZ4LWZ3d2gtdzI4Oc4AATVb
Puppet does not properly restrict access to node resources
Ecosystems: rubygems
Packages: puppet
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: almost 2 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXg0ODktamp3bS01Mmc3
Tinfoil Devise-two-factor does not "burn" a successfully validated one-time password (OTP)
Ecosystems: rubygems
Packages: devise-two-factor
Source: GitHub Advisory Database
Blast Radius: 17.3
Published: over 5 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWp3aHYtcmdxYy1mcWo1
Session fixation vulnerability in Rails
Ecosystems: rubygems
Packages: rails
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWM2cXItaDV2cS01OWpj
Untrusted users can run pending migrations in production in Rails
Ecosystems: rubygems
Packages: actionpack
Source: GitHub Advisory Database
Blast Radius: 38.6
Published: almost 4 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWptZ2YtcDQ2eC05ODJo
rails is vulnerable to CRLF injection
Ecosystems: rubygems
Packages: rails
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWZjcWYtaDRoNC02OTVt
actionpack CRLF injection vulnerability
Ecosystems: rubygems
Packages: actionpack
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTN2ZnctN3JjcC0zeGdt
actionpack Improper Input Validation vulnerability
Ecosystems: rubygems
Packages: actionpack
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
Moderate
GSA_kwCzR0hTQS1neGh4LWc0ZnEtNDloas4AA3a3
CarrierWave Content-Type allowlist bypass vulnerability, possibly leading to XSS
Ecosystems: rubygems
Packages: carrierwave
Source: GitHub Advisory Database
Blast Radius: 32.8
Published: 5 months ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXE0NHItZjJobS12NzZ2
Pupper does not properly restrict characters in Common Name field of Certificate Signing Request
Ecosystems: rubygems
Packages: puppet
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTVqanYteDRmcS1xandw
Possible timing attack in derivation_endpoint
Ecosystems: rubygems
Packages: shrine
Source: GitHub Advisory Database
Blast Radius: 16.3
Published: over 3 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXI1anctNjJ4Zy1qNDMz
Cross-Site Scripting in Kaminari
Ecosystems: rubygems
Packages: kaminari
Source: GitHub Advisory Database
Blast Radius: 31.3
Published: almost 4 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLW03cDgtOXc2Ni05ZnJt
net-ldap Improper Certificate Validation vulnerability
Ecosystems: rubygems
Packages: net-ldap
Source: GitHub Advisory Database
Blast Radius: 22.8
Published: over 6 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWdtMjUtZnBtci00M2Zq
Moderate severity vulnerability that affects rails
Ecosystems: rubygems
Packages: rails
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLW0zcTctcmo4Zy1tNDU3
ember-source Cross-site Scripting vulnerability
Ecosystems: rubygems
Packages: ember-source
Source: GitHub Advisory Database
Blast Radius: 21.5
Published: over 5 years ago
Moderate
GSA_kwCzR0hTQS1xNGc3LWpyeHYtNjdyOc0XeQ
Silent Configuration Failure in Puppet Agent
Ecosystems: rubygems
Packages: puppet
Source: GitHub Advisory Database
Blast Radius: 26.6
Published: over 2 years ago
Moderate
GSA_kwCzR0hTQS1wMzNxLTRoNG0tajk5NM4AAwy7
Inline SVG vulnerable to Cross-site Scripting
Ecosystems: rubygems
Packages: inline_svg
Source: GitHub Advisory Database
Blast Radius: 18.4
Published: over 1 year ago
Moderate
GSA_kwCzR0hTQS05aG1xLWZtMzMteDR4eM4AA34I
Resque Scheduler Reflected XSS In Delayed Jobs View
Ecosystems: rubygems
Packages: resque-scheduler
Source: GitHub Advisory Database
Blast Radius: 21.7
Published: 5 months ago
Moderate
GSA_kwCzR0hTQS1nN2dmLTJycXctNXJ3eM4AAxPk
Publify contains Weak Password Requirements
Ecosystems: rubygems
Packages: publify_core
Source: GitHub Advisory Database
Blast Radius: 5.9
Published: over 1 year ago
Moderate
GSA_kwCzR0hTQS03OW0zLXEzd2gtYzNxbc4AAX6X
Publify Incorrect Authorization
Ecosystems: rubygems
Packages: publify_core
Source: GitHub Advisory Database
Blast Radius: 5.9
Published: almost 2 years ago
Moderate
GSA_kwCzR0hTQS13bWg5LXgyOGotYzZncs4AArK6
Cross site scripting in publify
Ecosystems: rubygems
Packages: publify_core
Source: GitHub Advisory Database
Blast Radius: 4.9
Published: almost 2 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXc2NHctcXFwaC01Z3ht
HTTP Smuggling via Transfer-Encoding Header in Puma
Ecosystems: rubygems
Packages: puma
Source: GitHub Advisory Database
Blast Radius: 38.1
Published: almost 4 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTZocm0tanFwMy02NGN2
Improper Certificate Validation in TweetStream
Ecosystems: rubygems
Packages: tweetstream
Source: GitHub Advisory Database
Blast Radius: 17.2
Published: about 3 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTd4eDMtbTU4NC14OTk0
A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack
Ecosystems: rubygems
Packages: puma
Source: GitHub Advisory Database
Blast Radius: 29.7
Published: over 4 years ago
Moderate
GSA_kwCzR0hTQS14MjRqLTg3eDktanZ2Nc0W1Q
Publify `guest` role users can self-register even when the admin does not allow it
Ecosystems: rubygems
Packages: publify_core
Source: GitHub Advisory Database
Blast Radius: 5.9
Published: over 2 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWg4MzUtNzVody1wajg5
activesupport Cross-site Scripting vulnerability
Ecosystems: rubygems
Packages: activesupport
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
Moderate
GSA_kwCzR0hTQS03NTZtLTNxZjItaHA1OM4AAgTU
openshift-origin-node Improper Input Validation vulnerability
Ecosystems: rubygems
Packages: openshift-origin-node
Source: GitHub Advisory Database
Blast Radius: 5.7
Published: almost 2 years ago
Moderate
GSA_kwCzR0hTQS1jMmY0LWN2cW0tNjV3Ms4AA4Qh
Puma HTTP Request/Response Smuggling vulnerability
Ecosystems: rubygems
Packages: puma
Source: GitHub Advisory Database
Blast Radius: 33.1
Published: 4 months ago
Moderate
GSA_kwCzR0hTQS14NHZqLTI3OXgtcXdmMs4AAXfi
VladTheEnterprising allows local users to write to arbitrary files via a symlink attack
Ecosystems: rubygems
Packages: VladTheEnterprising
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: almost 2 years ago
Moderate
GSA_kwCzR0hTQS1od2hmLTY0bWgtcjY2Ms0Wwg
ReDoS vulnerability in parser_apache2
Ecosystems: rubygems
Packages: fluentd
Source: GitHub Advisory Database
Blast Radius: 20.6
Published: over 2 years ago
Moderate
GSA_kwCzR0hTQS1wNHh4LXc2ZnItYzR3Oc4AAxVr
Clockwork Web contains a Cross-Site Request Forgery Vulnerability with Rails < 5.2
Ecosystems: rubygems
Packages: clockwork_web
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: about 1 year ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXEzd3ItcXczZy0zcDRo
Injection/XSS in Redcarpet
Ecosystems: rubygems
Packages: redcarpet
Source: GitHub Advisory Database
Blast Radius: 33.4
Published: over 3 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXZyOHEtZzVjNy1tNTRt
Nokogiri::XML::Schema trusts input by default, exposing risk of XXE vulnerability
Ecosystems: rubygems
Packages: nokogiri
Source: GitHub Advisory Database
Blast Radius: 26.0
Published: over 3 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWdyNDQtN2dyYy0zN3Zx
ActiveRecord vulnerable to modification of protected model attributes
Ecosystems: rubygems
Packages: activerecord
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
Moderate
GSA_kwCzR0hTQS12Y2MzLXJ3NmYtanY5N84AA6Gq
Use-after-free in libxml2 via Nokogiri::XML::Reader
Ecosystems: rubygems
Packages: nokogiri
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: about 1 month ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWM5YzUtOWZwci1tODgy
sentry-raven allows remote attackers to cause a denial of service via a large exponent value in a scientific number
Ecosystems: rubygems
Packages: sentry-raven
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
Moderate
GSA_kwCzR0hTQS14bWdqLTVmaDMteGptbc0c1A
Path traversal when MessageBus::Diagnostics is enabled
Ecosystems: rubygems
Packages: message_bus
Source: GitHub Advisory Database
Blast Radius: 12.4
Published: over 2 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTU5YzctNHhqMi1oZ3Z3
rails-html-sanitizer Cross-site Scripting vulnerability
Ecosystems: rubygems
Packages: rails-html-sanitizer
Source: GitHub Advisory Database
Blast Radius: 34.9
Published: over 6 years ago
Moderate
GSA_kwCzR0hTQS0zd3FmLTR4ODktOWc3Oc3uvQ
Bootstrap vulnerable to Cross-Site Scripting (XSS)
Ecosystems: rubygems, npm
Packages: bootstrap
Source: GitHub Advisory Database
Blast Radius: 63.7
Published: almost 2 years ago
Moderate
GSA_kwCzR0hTQS05M2o1LWc4NDUtOXdxcM0XhQ
Unsafe HTTP Redirect in Puppet Agent and Puppet Server
Ecosystems: rubygems
Packages: puppet
Source: GitHub Advisory Database
Blast Radius: 26.6
Published: over 2 years ago
Moderate
GSA_kwCzR0hTQS1nYzNqLXZ2d2YtNHJwOM4AA34M
Resque vulnerable to reflected XSS in resque-web failed and queues lists
Ecosystems: rubygems
Packages: resque
Source: GitHub Advisory Database
Blast Radius: 24.6
Published: 5 months ago
Moderate
GSA_kwCzR0hTQS05NXZ4LXE0YzItNjRncs2XWw
RubyGems file overwrite vulnerability
Ecosystems: rubygems
Packages: rubygems-update
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: about 2 years ago
Moderate
GSA_kwCzR0hTQS00Mjg0LWpmaGMtZjg1NM4AASqQ
Phusion Passenger incorrect permission assignment
Ecosystems: rubygems
Packages: passenger
Source: GitHub Advisory Database
Blast Radius: 18.7
Published: almost 2 years ago
Moderate
GSA_kwCzR0hTQS1xaDNnLTI3amYtM2o1NM4AATVQ
Puppet allows local users to modify the permissions of arbitrary files
Ecosystems: rubygems
Packages: puppet
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: almost 2 years ago
Moderate
GSA_kwCzR0hTQS04YzU2LXYyNXctZjg5Y84AATVI
Puppet arbitrary file overwrite
Ecosystems: rubygems
Packages: puppet
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: almost 2 years ago
Moderate
GSA_kwCzR0hTQS1tN3I2LTQzdjItNDl2Zs2t2Q
Mongrel vulnerable to directory traversal via double-encoded sequences
Ecosystems: rubygems
Packages: mongrel
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: about 2 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTlxajctanZnNC1xcjJ4
Phusion Passenger Denial of Service
Ecosystems: rubygems
Packages: passenger
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
Moderate
GSA_kwCzR0hTQS1tODc1LTN4ZjYtbWY3OM4AAyeB
unpoly-rails Denial of Service vulnerability
Ecosystems: rubygems
Packages: unpoly-rails
Source: GitHub Advisory Database
Blast Radius: 6.1
Published: about 1 year ago
Moderate
GSA_kwCzR0hTQS1jYzhjLTI2cmotdjJ2eM4AAt2Q
administrate vulnerable to Cross-Site Request Forgery
Ecosystems: rubygems
Packages: administrate
Source: GitHub Advisory Database
Blast Radius: 16.7
Published: over 1 year ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWZoMzktdjczMy1teGZy
Active Record vulnerable to SQL Injection via nested query parameters
Ecosystems: rubygems
Packages: activerecord
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
Moderate
GSA_kwCzR0hTQS1jaDNoLWoydmYtOTVwds1BUQ
XSS Vulnerability in Action View tag helpers
Ecosystems: rubygems
Packages: actionview
Source: GitHub Advisory Database
Blast Radius: 35.3
Published: about 2 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXczN2MtcTY1My1xZzk1
actionpack Cross-site Scripting vulnerability
Ecosystems: rubygems
Packages: actionpack
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXdqeDItN2hxcS04aDdt
rails_admin ruby gem XSS vulnerability
Ecosystems: rubygems
Packages: rails_admin
Source: GitHub Advisory Database
Blast Radius: 24.2
Published: over 3 years ago
Moderate
GSA_kwCzR0hTQS03M3ByLWc2amotNWhjOc4AAtBO
Externally Controlled Reference to a Resource in Another Sphere in ruby-mysql
Ecosystems: rubygems
Packages: ruby-mysql
Source: GitHub Advisory Database
Blast Radius: 15.8
Published: almost 2 years ago
Moderate
GSA_kwCzR0hTQS04cXdoLXJtNmMtanY5Ns4AAwnZ
Oxidized Web vulnerable to Cross-site Scripting
Ecosystems: rubygems
Packages: oxidized-web
Source: GitHub Advisory Database
Blast Radius: 15.3
Published: over 1 year ago
Moderate
GSA_kwCzR0hTQS1mM3FtLXZmYzMtamc2ds4AA5ZJ
Possible CSRF attack at questionnaire templates preview
Ecosystems: rubygems
Packages: decidim-templates
Source: GitHub Advisory Database
Blast Radius: 10.2
Published: 2 months ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWhxZjktcmM5ai01Zm1q
Array data injection vulnerability in activerecord
Ecosystems: rubygems
Packages: activerecord
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
Moderate
GSA_kwCzR0hTQS1oM2ZnLWg1djMtdmY4bc0gsw
CSRF forgery protection bypass in solidus_frontend
Ecosystems: rubygems
Packages: solidus_frontend
Source: GitHub Advisory Database
Blast Radius: 14.1
Published: over 2 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLW00NnAtZ2dtNS01ajgz
Rails vulnerable to Cross-site Scripting
Ecosystems: rubygems
Packages: actionpack, rails
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXhnajYtcGdybS14NHIy
gtk2 vulnerable to Use of Externally-Controlled Format String
Ecosystems: rubygems
Packages: gtk2
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWp4anItNWg2OS1xdzN3
Heap-based buffer overflow in nokogiri
Ecosystems: rubygems
Packages: nokogiri
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 5 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTZ4ODUtajVqMi0yN2p4
actionpack Path Traversal vulnerability
Ecosystems: rubygems
Packages: actionpack
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXJteGctNzNnZy00cDk4
Cross-Site Scripting (XSS) in jquery
Ecosystems: maven, rubygems, npm, nuget
Packages: org.webjars.npm:jquery, jquery-rails, jquery, jQuery
Source: GitHub Advisory Database
Blast Radius: 104.9
Published: over 6 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTlwMjktOTRocC04cnZj
qiita-markdown Cross-site Scripting vulnerability
Ecosystems: rubygems
Packages: qiita-markdown
Source: GitHub Advisory Database
Blast Radius: 9.2
Published: over 2 years ago
Moderate
GSA_kwCzR0hTQS01ODQ0LXEzZmMtNTZyaM4AA3lZ
pubnub Insufficient Entropy vulnerability
Ecosystems: swift, pypi, pub, packagist, cargo, rubygems, nuget, go, maven, npm
Packages: github.com/pubnub/swift, pubnub, pubnub/pubnub, Pubnub, github.com/pubnub/go/v5, github.com/pubnub/go/v6, github.com/pubnub/go, github.com/pubnub/go/v7, com.pubnub:pubnub, com.pubnub:pubnub-kotlin
Source: GitHub Advisory Database
Blast Radius: 82.5
Published: 5 months ago
Moderate
GSA_kwCzR0hTQS1weHZnLTJxajUtMzdqcc4AAytn
Nokogiri updates packaged libxml2 to v2.10.4 to resolve multiple CVEs
Ecosystems: rubygems
Packages: nokogiri
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: about 1 year ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWdqeHctNXcycS03Z3Jm
Rails activerecord gem has Improper Input Validation vulnerability
Ecosystems: rubygems
Packages: activerecord
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTJycXctdjI2NS1qZjhj
Open Redirect in ActionPack
Ecosystems: rubygems
Packages: actionpack
Source: GitHub Advisory Database
Blast Radius: 36.2
Published: over 2 years ago
Moderate
GSA_kwCzR0hTQS05NDQ1LTRjcjYtMzM2cs4AAxDx
Open Redirect Vulnerability in Action Pack
Ecosystems: rubygems
Packages: actionpack
Source: GitHub Advisory Database
Blast Radius: 36.2
Published: over 1 year ago
Moderate
GSA_kwCzR0hTQS01cHE3LTUybWctaHI0Ms4AAwuQ
httparty has multipart/form-data request tampering vulnerability
Ecosystems: rubygems
Packages: httparty
Source: GitHub Advisory Database
Blast Radius: 31.3
Published: over 1 year ago
Moderate
GSA_kwCzR0hTQS01ZzRyLTJxaHgtdnFmbc4AArZZ
Use of Uninitialized Variable in trilogy
Ecosystems: rubygems
Packages: trilogy
Source: GitHub Advisory Database
Blast Radius: 8.0
Published: almost 2 years ago
Moderate
GSA_kwCzR0hTQS1mMjVoLTNtajYtNGpwZ84AAe1f
Fat Free CRM vulnerable to Exposure of Sensitive Information
Ecosystems: rubygems
Packages: fat_free_crm
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: almost 2 years ago
Moderate
GSA_kwCzR0hTQS1tY3ZxLTd4anEtNDZ4Ns4AAe1M
Fat Free CRM contains Cross-site Request Forgery vulnerablilities
Ecosystems: rubygems
Packages: fat_free_crm
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: almost 2 years ago
Moderate
GSA_kwCzR0hTQS00eHE5LXZ3ODktcDVjeM4AAe1N
Fat Free CRM allows remote attackers to obtain sensitive information via a direct request
Ecosystems: rubygems
Packages: fat_free_crm
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: almost 2 years ago
Moderate
GSA_kwCzR0hTQS03OXdxLWc0djktZ2ZqNM4AAw-2
Publify Core does not strip metadata from images
Ecosystems: rubygems
Packages: publify_core
Source: GitHub Advisory Database
Blast Radius: 5.9
Published: over 1 year ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTMzcHAtMzc2My1tcmZw
sprockets vulnerable to Path Traversal
Ecosystems: rubygems
Packages: sprockets
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWh4aGotaHA5bS1xd2M0
private_address_check vulnerable to bypass of Resolv.getaddresses method
Ecosystems: rubygems
Packages: private_address_check
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTdycm0tdjQ1Zi1qcDY0
Nokogiri updates packaged dependency on libxml2 from 2.9.10 to 2.9.12
Ecosystems: rubygems
Packages: nokogiri
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: almost 3 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWo5NnIteHZqcS1yOXBn
activesupport vulnerable to Denial of Service via large XML document depth
Ecosystems: rubygems
Packages: activesupport
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
Moderate
GSA_kwCzR0hTQS13M3E4LW00OTItNHB3cM4AA5Zd
Possibility to circumvent the invitation token expiry period
Ecosystems: rubygems
Packages: decidim-system, decidim-admin, decidim, devise_invitable
Source: GitHub Advisory Database
Blast Radius: 19.6
Published: 2 months ago
Moderate
GSA_kwCzR0hTQS13Y2Z4LTNtNnYtNGZyZ84AAeVa
Fat Free CRM subject to Cross-site Scripting
Ecosystems: rubygems
Packages: fat_free_crm
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: almost 2 years ago
Moderate
GSA_kwCzR0hTQS13eDdjLThqMzUtbXBnOM4AAWDM
Fat Free CRM Cross-Site Request Forgery vulnerability
Ecosystems: rubygems
Packages: fat_free_crm
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: almost 2 years ago
Moderate
GSA_kwCzR0hTQS14Mmg4LXFtajQtZzYyZs4AA6Fh
ROTP 6.2.2 and 6.2.1 has 0666 permissions for the .rb files.
Ecosystems: rubygems
Packages: rotp
Source: GitHub Advisory Database
Blast Radius: 18.5
Published: about 1 month ago
Moderate
GSA_kwCzR0hTQS1yMncyLWg2cjgtM3I1M84AAqXz
Camaleon CMS vulnerable to Uncaught Exception
Ecosystems: rubygems
Packages: camaleon_cms
Source: GitHub Advisory Database
Blast Radius: 5.5
Published: almost 2 years ago
Moderate
GSA_kwCzR0hTQS0ycWM2LW1jdnctOTJjd84AAvaT
Update bundled libxml2 to v2.10.3 to resolve multiple CVEs
Ecosystems: rubygems
Packages: nokogiri
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 1 year ago
Moderate
GSA_kwCzR0hTQS1tcG14LWdtNXYtcTc4Oc4AATVg
Puppet uses predictable filenames, allowing arbitrary file overwrite
Ecosystems: rubygems
Packages: puppet
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: almost 2 years ago
Moderate
GSA_kwCzR0hTQS05d2hoLTU4MnItNTg5aM4AAW52
ldap_fluff authentication bypass
Ecosystems: rubygems
Packages: ldap_fluff
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: almost 2 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWo4MzgtdmZwcS1mbWYy
actionpack Cross-site Scripting vulnerability
Ecosystems: rubygems
Packages: actionpack
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
Moderate
GSA_kwCzR0hTQS1jcHY2LXBmcTYtajJ2N84AARb-
katello Improper Privilege Management vulnerability
Ecosystems: rubygems
Packages: katello
Source: GitHub Advisory Database
Blast Radius: 4.3
Published: almost 2 years ago
Moderate
GSA_kwCzR0hTQS1od3J4LXdjNzUtbWdoN84AAV4o
Spree allows remote attackers to obtain sensitive information
Ecosystems: rubygems
Packages: spree
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: almost 2 years ago
Moderate
GSA_kwCzR0hTQS03cXc0LXc3aGYtMjJxM84AAWZ_
xapian-core Cross-site Scripting vulnerability
Ecosystems: rubygems
Packages: xapian-core
Source: GitHub Advisory Database
Blast Radius: 2.9
Published: almost 2 years ago
Moderate
GSA_kwCzR0hTQS13M2o0LTc2cXctd3dqbc0VnQ
Older releases of better_errors open to Cross-Site Request Forgery attack
Ecosystems: rubygems
Packages: better_errors
Source: GitHub Advisory Database
Blast Radius: 30.4
Published: over 2 years ago
Moderate
GSA_kwCzR0hTQS1wNzVjLTV4M2gtY3hjZ84AAvNV
Fat Free CRM vulnerable to Remote Denial of Service via Tasks endpoint
Ecosystems: rubygems
Packages: fat_free_crm
Source: GitHub Advisory Database
Blast Radius: 10.4
Published: over 1 year ago
Moderate
GSA_kwCzR0hTQS03Zjg0LTljcWYtZzRqOc3r0A
Camaleon CMS vulnerable to Stored Cross-site Scripting
Ecosystems: rubygems
Packages: camaleon_cms
Source: GitHub Advisory Database
Blast Radius: 7.8
Published: almost 2 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWNqOTItYzRmai13OWM1
Mail Gem Path Traversal vulnerability
Ecosystems: rubygems
Packages: mail
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXJnNW0tM2ZxcC02cHg4
actionmailer email address processing causes Denial of service
Ecosystems: rubygems
Packages: actionmailer
Source: GitHub Advisory Database
Blast Radius: 0.0
Published: over 6 years ago
Statistics
Advisories: 18,317
Packages: 8,278
Repositories: 285
Ecosystems: 12
Filter by Package
actionpack 57 nokogiri 42 rubygems-update 25 puppet 23 rack 22 activerecord 21 activesupport 14 publify_core 14 passenger 13 actionview 12 puma 11 rails 11 jquery-rails 10 fat_free_crm 10 org.webjars.npm:jquery 9 rails-html-sanitizer 9 jquery 9 jQuery 8 decidim 7 org.jruby:jruby-stdlib 7 jquery-ui 7 jquery-ui-rails 7 org.webjars.npm:jquery-ui 7 jQuery.UI.Combined 7 ember-source 6 loofah 6 katello 6 camaleon_cms 6 doorkeeper 6 bundler 5 sidekiq 5 spree 5 commonmarker 5 spree_auth_devise 5 webrick 4 sanitize 4 avo 4 carrierwave 4 grpcio 4 grpc 4 dragonfly 4 activestorage 4 fluentd 4 devise 4 sinatra 4 mail 4 rdoc 3 rack-cors 3 openssl 3 rails_admin 3 resque 3 chartkick 3 io.grpc:grpc-protobuf 3 cgi 3 decidim-core 3 private_address_check 3 rest-client 3 gollum 3 git 3 omniauth 3 ruby-saml 3 bootstrap 3 yard 3 bootstrap 3 json-jwt 3 geminabox 3 rubyzip 3 phlex 3 facter 2 logstash-core 2 pageflow 2 git-fastclone 2 ox 2 httparty 2 json 2 VladTheEnterprising 2 bson 2 devise-two-factor 2 net-ldap 2 twitter-bootstrap-rails 2 mini_magick 2 paperclip 2 pdfkit 2 omniauth-facebook 2 yajl-ruby 2 safemode 2 ruby-openid 2 bootstrap-sass 2 mapbox-rails 2 mapbox.js 2 secure_headers 2 sprockets 2 faye 2 sup 2 echor 2 uri 2 field_test 2 i18n 2 kramdown 2 spina 2 view_component 2 solidus_core 2 redcarpet 2 solidus_frontend 2 radiant 2 cocoapods-downloader 2 pyarrow 2 red-arrow 2 activeadmin 2 google-protobuf 2 com.google.protobuf:protobuf-kotlin 2 com.google.protobuf:protobuf-java 2 qiita-markdown 2 decidim-templates 2 pghero 2 user_agent_parser 2 mechanize 2 administrate 2 blazer 1 solidus_auth_devise 1 kaminari 1 rmagick 1 solidus_backend 1 github.com/github/hub 1 hub 1 websocket-extensions 1 railties 1 foreman_ansible 1 gitlab-grit 1 geokit-rails 1 multi_xml 1 keynote 1 twitter-stream 1 pysha3 1 sha3 1 cap-strap 1 ruby-jss 1 rack-mini-profiler 1 hiera 1 mcollective-client 1 wicked 1 actionmailer 1 kelredd-pruview 1 sqlite3-ruby 1 thin 1 matestack-ui-core 1 restforce 1 ruby_parser 1 better_errors 1 mongrel 1 unpoly-rails 1 bindata 1 oxidized-web 1 github.com/pubnub/swift 1 pubnub 1 pubnub 1 pubnub/pubnub 1 pubnub 1 pubnub 1 Pubnub 1 github.com/pubnub/go/v5 1 github.com/pubnub/go/v6 1 github.com/pubnub/go 1 github.com/pubnub/go/v7 1 com.pubnub:pubnub 1 rubocop 1 ruby-mysql 1 gtk2 1 rotp 1 @turbo-boost/commands 1 turbo_boost-commands 1 stringio 1 discordrb 1 diffy 1 recurly 1 md2pdf 1 sounder 1 date 1 octopoller 1 paratrooper-newrelic 1 jmespath 1 trilogy 1 sentry-raven 1 devise_invitable 1 ftpd 1 tweetstream 1 flash_tool 1 lean-ruport 1 openshift-origin-node 1 point-cli 1 govuk_tech_docs 1 audited 1 omniauth-apple 1 spree_api 1 omniauth-auth0 1 shrine 1 message_bus 1 inline_svg 1 pdf_info 1 rswag 1
Filter by Repository
https://github.com/rails/rails 53 https://github.com/sparklemotion/nokogiri 31 https://github.com/rubygems/rubygems 18 https://github.com/rack/rack 17 https://github.com/puppetlabs/puppet 15 https://github.com/publify/publify 13 https://github.com/puma/puma 11 https://github.com/phusion/passenger 10 https://github.com/jquery/jquery 10 https://github.com/rails/rails-html-sanitizer 9 https://github.com/fatfreecrm/fat_free_crm 9 https://github.com/decidim/decidim 8 https://github.com/doorkeeper-gem/doorkeeper 6 https://github.com/flavorjones/loofah 6 https://github.com/jquery/jquery-ui 6 https://github.com/solidusio/solidus 5 https://github.com/solidusio/solidus_auth_devise 5 https://github.com/owen2345/camaleon-cms 4 https://github.com/mikel/mail 4 https://github.com/markevans/dragonfly 4 https://github.com/Katello/katello 4 https://github.com/ruby/openssl 4 https://github.com/avo-hq/avo 4 https://github.com/grpc/grpc 4 https://github.com/carrierwaveuploader/carrierwave 4 https://github.com/rgrove/sanitize 4 https://github.com/sinatra/sinatra 4 https://github.com/fluent/fluentd 4 https://github.com/sidekiq/sidekiq 3 https://github.com/rubygems/rubygems.org 3 https://github.com/ruby-git/ruby-git 3 https://github.com/rubyzip/rubyzip 3 https://github.com/resque/resque 3 https://github.com/spree/spree 3 https://github.com/phlex-ruby/phlex 3 https://github.com/rest-client/rest-client 3 https://github.com/geminabox/geminabox 3 https://github.com/cyu/rack-cors 3 https://github.com/twbs/bootstrap 3 https://github.com/gjtorikian/commonmarker 3 https://github.com/lsegal/yard 3 https://github.com/gollum/gollum 3 https://github.com/jtdowney/private_address_check 3 https://github.com/emberjs/ember.js 2 https://github.com/codevise/pageflow 2 https://github.com/CocoaPods/cocoapods-downloader 2 https://github.com/brianmario/yajl-ruby 2 https://github.com/ankane/pghero 2 https://github.com/ankane/field_test 2 https://github.com/ruby-ldap/ruby-net-ldap 2 https://github.com/ankane/chartkick 2 https://github.com/ruby/rdoc 2 https://github.com/ruby/uri 2 https://github.com/ruby/webrick 2 https://github.com/activeadmin/activeadmin 2 https://github.com/faye/faye 2 https://github.com/gettalong/kramdown 2 https://github.com/github/cmark-gfm 2 https://github.com/increments/qiita-markdown 2 https://github.com/jnunemaker/httparty 2 https://github.com/protocolbuffers/protobuf 2 https://github.com/plataformatec/devise 2 https://github.com/mongodb/bson-ruby 2 https://github.com/mperham/sidekiq 2 https://github.com/nov/json-jwt 2 https://github.com/openid/ruby-openid 2 https://github.com/omniauth/omniauth 2 https://github.com/ohler55/ox 2 https://github.com/vmg/redcarpet 2 https://github.com/sparklemotion/mechanize 2 https://github.com/twitter/secure_headers 2 https://github.com/square/git-fastclone 2 https://github.com/tinfoil/devise-two-factor 2 https://github.com/sup-heliotrope/sup 2 https://github.com/svenfuchs/i18n 2 https://github.com/svenfuchs/safemode 2 https://github.com/thoughtbot/paperclip 2 https://gitlab.com/gitlab-org/cves 2 https://github.com/github/view_component 1 https://github.com/github/trilogy 1 https://github.com/github/hub 1 https://github.com/twbs/bootstrap-sass 1 https://github.com/kaminari/kaminari 1 https://github.com/theforeman/ldap_fluff 1 https://github.com/getsentry/raven-ruby 1 https://github.com/geokit/geokit-rails 1 https://github.com/tzinfo/tzinfo 1 https://github.com/gazay/gon 1 https://github.com/fnando/svg_optimizer 1 https://github.com/ua-parser/uap-core 1 https://github.com/flori/json 1 https://github.com/ua-parser/uap-ruby 1 https://github.com/ffi/ffi 1 https://github.com/faye/websocket-extensions-ruby 1 https://github.com/faye/faye-websocket-ruby 1 https://github.com/unpoly/unpoly-rails 1 https://github.com/ViewComponent/view_component 1 https://github.com/theforeman/foreman_fog_proxmox 1 https://github.com/exiftool-rb/exiftool_vendored.rb 1 https://github.com/excon/excon 1 https://github.com/evan/ccsv 1 https://github.com/thoughtbot/cocaine 1 https://github.com/jnunemaker/crack 1 https://github.com/jmespath/jmespath.rb 1 https://github.com/jirutka/asciidoctor-include-ext 1 https://github.com/jgarber/redcloth 1 https://github.com/jekyll/jekyll 1 https://github.com/janko/image_processing 1 https://github.com/jamesmartin/inline_svg 1 https://github.com/inukshuk/bibtex-ruby 1 https://github.com/jordansissel/ruby-arr-pm 1 https://github.com/josh/rack-ssl 1 https://github.com/imsebao/404team 1 https://github.com/thoughtbot/clearance 1 https://github.com/igrigorik/em-http-request 1 https://github.com/hopsoft/turbo_boost-commands 1 https://github.com/heartcombo/devise 1 https://github.com/thoughtbot/administrate 1 https://github.com/haml/haml 1 https://github.com/halostatue/minitar 1 https://github.com/Gurpartap/aescrypt 1 https://github.com/tigris/open-uri-cached 1 https://github.com/theforeman/smart_proxy_dynflow 1 https://github.com/GNOME/libxml2 1 https://github.com/TrestleAdmin/trestle-auth 1 https://github.com/binarylogic/authlogic 1 https://github.com/BetterErrors/better_errors 1 https://github.com/beenhero/omniauth-weibo-oauth2 1 https://github.com/bdmac/strong_password 1 https://github.com/bbatsov/rubocop 1 https://github.com/basecamp/marginalia 1 https://github.com/basecamp/easymon 1 https://github.com/aws/aws-sdk-ruby 1 https://github.com/zendesk/samlr 1 https://github.com/auth0/omniauth-auth0 1 https://github.com/asteinhauser/fat_free_crm 1 https://github.com/asciidoctor/asciidoctor 1 https://github.com/ankane/pgsync 1 https://github.com/zenspider/ruby_parser-legacy 1 https://github.com/zvory/csv-safe 1 https://github.com/ankane/clockwork_web 1 https://github.com/ankane/chartkick.js 1 https://gitlab.com/2013/11 1 https://github.com/ankane/blazer 1 https://github.com/amro/gibbon 1 https://github.com/alphagov/tech-docs-gem 1 https://github.com/alexreisner/geocoder 1 https://github.com/AlchemyCMS/alchemy_cms 1 https://github.com/airbrake/airbrake-ruby 1 https://github.com/ahorner/text-helpers 1 https://github.com/affix/CVE-2022-36231 1 https://github.com/adamzaninovich/sounder 1 https://github.com/elastic/logstash 1 https://github.com/elastic/apm-agent-ruby 1 https://github.com/ejschmitt/delayed_job_web 1 https://github.com/dspinhirne/netaddr-rb 1 https://github.com/doorkeeper-gem/doorkeeper-openid_connect 1 https://github.com/voloko/twitter-stream 1 https://github.com/dmendel/bindata 1 https://github.com/discourse/rails_multisite 1 https://github.com/discourse/message_bus 1 https://github.com/denkGroot/Spina 1 https://github.com/dejan/espeak-ruby 1 https://github.com/wconrad/ftpd 1 https://github.com/datamapper/extlib 1 https://github.com/webbynode/webbynode 1 https://github.com/ConradIrwin/em-imap 1 https://github.com/collectiveidea/audited 1 https://github.com/whiteleaf7/narou 1 https://github.com/codders/dataset 1 https://github.com/wycats/handlebars.js 1 https://github.com/chef/mixlib-archive 1 https://github.com/cgriego/active_attr 1 https://github.com/XKCP/XKCP 1 https://github.com/camilova/activerecord-update-by-case 1 https://github.com/bvsatyaram/random_password_generator 1 https://github.com/bundler/bundler 1 https://github.com/ytti/oxidized-web 1 https://github.com/sinatra/rack-protection 1 https://github.com/rf-/keynote 1 https://github.com/restforce/restforce 1 https://github.com/sisimai/rb-sisimai 1 https://github.com/resque/resque-scheduler 1 https://github.com/Smashing/smashing 1 https://github.com/redis-store/redis-store 1 https://github.com/recurly/recurly-client-ruby 1 https://github.com/rdoc/rdoc 1 https://github.com/rcook/rgpg 1 https://github.com/rapid7/metasploit-framework 1 https://github.com/rails/web-console 1 https://github.com/rails/sprockets 1 https://github.com/Snorby/snorby 1 https://github.com/socketry/protocol-http1 1 https://github.com/rails/kredis 1 https://github.com/rails/jquery-rails 1 https://github.com/rails/globalid 1 https://github.com/railsdog/spree 1 https://github.com/railsadminteam/rails_admin 1 https://github.com/rails/activeresource 1