Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

rubygems Security Advisories

Loading...
Critical
GSA_kwCzR0hTQS1yaHd4LWhqeDIteDRxcs4AAuuA
PDFKit vulnerable to Command Injection
Ecosystems: rubygems
Packages: pdfkit
Source: GitHub Advisory Database
Blast Radius: 32.2
Published: over 1 year ago
Critical
GSA_kwCzR0hTQS0zOXY3LXhwcTQtODg4NM3hUQ
PDFKit Improper Input Validation vulnerability
Ecosystems: rubygems
Packages: pdfkit
Source: GitHub Advisory Database
Blast Radius: 32.2
Published: almost 2 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXFoNHctN3B3My1wNHJw
BSON rubygem contains potential denial of service
Ecosystems: rubygems
Packages: bson
Source: GitHub Advisory Database
Blast Radius: 32.2
Published: about 4 years ago
Critical
GSA_kwCzR0hTQS1tbXJxLTY5OTktNzJ2OM4AASvC
Ruby Openssl Allows Incorrect Value Comparison
Ecosystems: rubygems
Packages: openssl
Source: GitHub Advisory Database
Blast Radius: 32.1
Published: almost 2 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTVtMnYtaGM2NC01Nmg2
Rubyzip denial of service
Ecosystems: rubygems
Packages: rubyzip
Source: GitHub Advisory Database
Blast Radius: 32.0
Published: over 4 years ago
Critical
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWM1cjUtN3BmaC02cWc2
BibTeX-Ruby vulnerable to OS command injection
Ecosystems: rubygems
Packages: bibtex-ruby
Source: GitHub Advisory Database
Blast Radius: 32.0
Published: about 4 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTJ2NWMtNzU1cC1wNGd2
Missing TLS certificate verification in faye-websocket
Ecosystems: rubygems
Packages: faye-websocket
Source: GitHub Advisory Database
Blast Radius: 31.6
Published: over 3 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXhycjYtM3BjNC1tNDQ3
Active Record Improper Access Control
Ecosystems: rubygems
Packages: activerecord
Source: GitHub Advisory Database
Blast Radius: 31.6
Published: over 6 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTU0M3YtZ2oyYy1yM2No
activemodel contains Improper Input Validation
Ecosystems: rubygems
Packages: activemodel
Source: GitHub Advisory Database
Blast Radius: 31.6
Published: over 6 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXZ4OWotNDZyaC1mcXI4
actionview contains Path Traversal vulnerability
Ecosystems: rubygems
Packages: actionpack, actionview
Source: GitHub Advisory Database
Blast Radius: 31.5
Published: over 6 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLW1xMzUtd3F2Zi1yMjNj
Sinatra Cross-site Scripting vulnerability
Ecosystems: rubygems
Packages: sinatra
Source: GitHub Advisory Database
Blast Radius: 31.5
Published: almost 6 years ago
Critical
GSA_kwCzR0hTQS1ncHFjLTRwcDctNTk1NM0XVQ
Authentication Bypass by CSRF Weakness
Ecosystems: rubygems
Packages: spree_auth_devise
Source: GitHub Advisory Database
Blast Radius: 31.4
Published: over 2 years ago
Critical
GSA_kwCzR0hTQS04eGZ3LTVxODItMzY1Ms0XVA
Authentication Bypass by CSRF Weakness
Ecosystems: rubygems
Packages: spree_auth_devise
Source: GitHub Advisory Database
Blast Radius: 31.4
Published: over 2 years ago
Critical
GSA_kwCzR0hTQS0yNnh4LW00cTIteGhxOM0XUg
Authentication Bypass by CSRF Weakness
Ecosystems: rubygems
Packages: spree_auth_devise
Source: GitHub Advisory Database
Blast Radius: 31.4
Published: over 2 years ago
Critical
GSA_kwCzR0hTQS02bXFyLXE4NnEtNmd3cs0XUw
Authentication Bypass by CSRF Weakness
Ecosystems: rubygems
Packages: spree_auth_devise
Source: GitHub Advisory Database
Blast Radius: 31.4
Published: over 2 years ago
High
GSA_kwCzR0hTQS1xZzU0LTY5NHAtd2dwcM0XPQ
Regular expression denial of service vulnerability (ReDoS) in date
Ecosystems: rubygems
Packages: date
Source: GitHub Advisory Database
Blast Radius: 31.4
Published: over 2 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXI1anctNjJ4Zy1qNDMz
Cross-Site Scripting in Kaminari
Ecosystems: rubygems
Packages: kaminari
Source: GitHub Advisory Database
Blast Radius: 31.3
Published: almost 4 years ago
Moderate
GSA_kwCzR0hTQS01cHE3LTUybWctaHI0Ms4AAwuQ
httparty has multipart/form-data request tampering vulnerability
Ecosystems: rubygems
Packages: httparty
Source: GitHub Advisory Database
Blast Radius: 31.3
Published: over 1 year ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWNmanYtNTQ5OC1tcGg1
XSS in Action View
Ecosystems: rubygems
Packages: actionview
Source: GitHub Advisory Database
Blast Radius: 31.2
Published: over 3 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXI1M3ctZzR4bS0zZ2M2
Haml vulnerable to cross-site scripting
Ecosystems: rubygems
Packages: haml
Source: GitHub Advisory Database
Blast Radius: 31.0
Published: over 4 years ago
High
GSA_kwCzR0hTQS13aGZ4LTg3N2MtNXAyOM4AASot
Insecure Permissions in Phusion Passenger
Ecosystems: rubygems
Packages: passenger
Source: GitHub Advisory Database
Blast Radius: 31.0
Published: almost 2 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWc0eHEtang0dy00Y2p2
Loofah Cross-site Scripting vulnerability
Ecosystems: rubygems
Packages: loofah
Source: GitHub Advisory Database
Blast Radius: 30.9
Published: over 5 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWMzZ3YtOWN4Zi02ZjU3
Loofah Allows Cross-site Scripting
Ecosystems: rubygems
Packages: loofah
Source: GitHub Advisory Database
Blast Radius: 30.9
Published: over 4 years ago
High
GSA_kwCzR0hTQS13cnhmLXg4cm0tNmdnZ84AAyiM
Fluent Fluentd and Fluent-ui use default password
Ecosystems: rubygems
Packages: fluentd-ui, fluentd
Source: GitHub Advisory Database
Blast Radius: 30.7
Published: about 1 year ago
Critical
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLW1nNXAtOTVtOS1ybWZw
Arbitrary file write in actionpack-page_caching gem
Ecosystems: rubygems
Packages: actionpack-page_caching
Source: GitHub Advisory Database
Blast Radius: 30.6
Published: almost 4 years ago
Critical
GSA_kwCzR0hTQS1majM0LWpoangteG12ds4AArUb
Arbitrary file write in dragonfly
Ecosystems: rubygems
Packages: dragonfly
Source: GitHub Advisory Database
Blast Radius: 30.5
Published: almost 2 years ago
Moderate
GSA_kwCzR0hTQS13M2o0LTc2cXctd3dqbc0VnQ
Older releases of better_errors open to Cross-Site Request Forgery attack
Ecosystems: rubygems
Packages: better_errors
Source: GitHub Advisory Database
Blast Radius: 30.4
Published: over 2 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWg1ZzItMzh4OS00Z3Yz
archive-tar-minitar and minitar vulnerable to Path Traversal
Ecosystems: rubygems
Packages: minitar, archive-tar-minitar
Source: GitHub Advisory Database
Blast Radius: 30.3
Published: over 6 years ago
High
GSA_kwCzR0hTQS14Z3Y3LXBxcWgtaDJ3Oc4AAxEu
jruby-openssl gem for JRuby fails to do proper certificate validation
Ecosystems: rubygems
Packages: jruby-openssl
Source: GitHub Advisory Database
Blast Radius: 30.3
Published: over 1 year ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTdmNDItcDg0ai1mNThw
Sanitize vulnerable to Improper Input Validation and Cross-site Scripting
Ecosystems: rubygems
Packages: sanitize
Source: GitHub Advisory Database
Blast Radius: 30.2
Published: about 6 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTY4OGMtM3g0OS02cnFq
rack-protection gem timing attack vulnerability when validating CSRF token
Ecosystems: rubygems
Packages: rack-protection
Source: GitHub Advisory Database
Blast Radius: 30.1
Published: about 6 years ago
Critical
GSA_kwCzR0hTQS03eHZjLXY0NGotNDZmaM4AA2RG
geokit-rails Command Injection vulnerability
Ecosystems: rubygems
Packages: geokit-rails
Source: GitHub Advisory Database
Blast Radius: 29.8
Published: 7 months ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTd4eDMtbTU4NC14OTk0
A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack
Ecosystems: rubygems
Packages: puma
Source: GitHub Advisory Database
Blast Radius: 29.7
Published: over 4 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXFwZzQtNHc3dy0ybXE1
Authentication and extension bypass in Faye
Ecosystems: rubygems
Packages: faye
Source: GitHub Advisory Database
Blast Radius: 29.6
Published: about 4 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXA0eDQtcncycC04ajht
Cross-site Scripting in Sanitize
Ecosystems: rubygems
Packages: sanitize
Source: GitHub Advisory Database
Blast Radius: 29.4
Published: almost 4 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXFycW0tZnB2Ni02cjhn
Command Injection Vulnerability in Mechanize
Ecosystems: rubygems
Packages: mechanize
Source: GitHub Advisory Database
Blast Radius: 29.4
Published: about 3 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWY5M2otaG1jci1qY3do
Moped Rubygem Data Injection Vulnerability
Ecosystems: rubygems
Packages: moped
Source: GitHub Advisory Database
Blast Radius: 29.4
Published: over 3 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXEyN2YtdjNyNi05djc3
Improper Certificate Validation in EM-HTTP-Request
Ecosystems: rubygems
Packages: em-http-request
Source: GitHub Advisory Database
Blast Radius: 29.2
Published: almost 3 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWpjOG0tY3hoai02Njh4
Improper Restriction of Excessive Authentication Attempts in Sorcery
Ecosystems: rubygems
Packages: sorcery
Source: GitHub Advisory Database
Blast Radius: 29.1
Published: almost 4 years ago
Moderate
GSA_kwCzR0hTQS04aDIyLThjZjctaHE2Z84AA5jP
Rails has possible Sensitive Session Information Leak in Active Storage
Ecosystems: rubygems
Packages: activestorage
Source: GitHub Advisory Database
Blast Radius: 28.9
Published: 2 months ago
High
GSA_kwCzR0hTQS1xajJ3LW13MnItcHYzOc4AATbJ
RubyGems Deserialization of Untrusted Data vulnerability
Ecosystems: maven, rubygems
Packages: org.jruby:jruby-stdlib, rubygems-update
Source: GitHub Advisory Database
Blast Radius: 28.9
Published: almost 2 years ago
Critical
GSA_kwCzR0hTQS12MjIyLTZtcjQtcWoyOc03aw
Command Injection vulnerability in asciidoctor-include-ext
Ecosystems: rubygems
Packages: asciidoctor-include-ext
Source: GitHub Advisory Database
Blast Radius: 28.7
Published: about 2 years ago
Critical
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWhyajUtcXA3eC1ycGc2
SQL Injection in marginalia
Ecosystems: rubygems
Packages: marginalia
Source: GitHub Advisory Database
Blast Radius: 28.7
Published: almost 5 years ago
Critical
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTQ5cGotNjl2Zi1jNjg5
netaddr before 1.5.3 and 2.0.4 has Incorrect Default Permissions
Ecosystems: rubygems
Packages: netaddr
Source: GitHub Advisory Database
Blast Radius: 28.7
Published: over 4 years ago
High
GSA_kwCzR0hTQS1xYzlwLW1qeG0tajJ3as4AASwT
Asciidoctor Infinite Loop vulnerability
Ecosystems: rubygems
Packages: asciidoctor
Source: GitHub Advisory Database
Blast Radius: 28.6
Published: almost 2 years ago
High
GSA_kwCzR0hTQS1mNXd3LWNxM20tcTNnN84AA0Xi
Sanitize vulnerable to Cross-site Scripting via insufficient neutralization of `style` element content
Ecosystems: rubygems
Packages: sanitize
Source: GitHub Advisory Database
Blast Radius: 28.6
Published: 10 months ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWZjanctOHJoai1nd3dj
Authentication Bypass in Devise
Ecosystems: rubygems
Packages: devise
Source: GitHub Advisory Database
Blast Radius: 28.4
Published: over 4 years ago
Critical
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTJwODItdjc3di1tcHBy
Airbrake keys not being filtered
Ecosystems: rubygems
Packages: airbrake-ruby
Source: GitHub Advisory Database
Blast Radius: 28.2
Published: over 4 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXE1OGctNDU1cC04dnc5
In RubyGem excon, interrupted Persistent Connections May Leak Response Data
Ecosystems: rubygems
Packages: excon
Source: GitHub Advisory Database
Blast Radius: 28.1
Published: over 4 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTY5NG0tamhyOS1wZjc3
Doorkeeper subject to Incorrect Permission Assignment
Ecosystems: rubygems
Packages: doorkeeper
Source: GitHub Advisory Database
Blast Radius: 28.0
Published: over 5 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWo3dngtOG1xai1jcXA5
Exposure of Sensitive Information to an Unauthorized Actor in Doorkeeper
Ecosystems: rubygems
Packages: doorkeeper
Source: GitHub Advisory Database
Blast Radius: 28.0
Published: almost 4 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTNxNDktaDhmOS05ZnI5
Missing TLS certificate verification
Ecosystems: rubygems
Packages: faye
Source: GitHub Advisory Database
Blast Radius: 27.9
Published: over 3 years ago
High
GSA_kwCzR0hTQS1neDY5LTZjcDQtaHhyas38Wg
RubyGems Link Following vulnerability
Ecosystems: maven, rubygems
Packages: org.jruby:jruby-stdlib, rubygems-update
Source: GitHub Advisory Database
Blast Radius: 27.8
Published: almost 2 years ago
High
GSA_kwCzR0hTQS03NHB2LXY5Z2gtaDI1cM4AASkU
RubyGems Infinite Loop vulnerability
Ecosystems: maven, rubygems
Packages: org.jruby:jruby-stdlib, rubygems-update
Source: GitHub Advisory Database
Blast Radius: 27.8
Published: almost 2 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTY1Y3YtcjZ4Ny03OWh2
Cross site scripting vulnerability in ActionView
Ecosystems: rubygems
Packages: actionview
Source: GitHub Advisory Database
Blast Radius: 27.7
Published: about 4 years ago
Moderate
GSA_kwCzR0hTQS1qajQ3LXg2OXgtbXhybc04iw
Buffer Overflow in yajl-ruby
Ecosystems: rubygems
Packages: yajl-ruby
Source: GitHub Advisory Database
Blast Radius: 27.5
Published: about 2 years ago
High
GSA_kwCzR0hTQS1qamhqLThneDcteDgzNs4AASpe
Incorrect Access Control in Phusion Passenger
Ecosystems: rubygems
Packages: passenger
Source: GitHub Advisory Database
Blast Radius: 27.5
Published: almost 2 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWNxeHctM3A3di1wOWdy
Phusion Passenger uses a known /tmp filename
Ecosystems: rubygems
Packages: passenger
Source: GitHub Advisory Database
Blast Radius: 27.5
Published: over 5 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWgyOWYtN2Y1Ni1qOHdo
Sinatra Path Traversal vulnerability
Ecosystems: rubygems
Packages: sinatra
Source: GitHub Advisory Database
Blast Radius: 27.4
Published: about 6 years ago
Critical
GSA_kwCzR0hTQS0yODltLTI5NjQtZjhxNc4AA2Rv
Puppet Bolt privilege escalation vulnerability
Ecosystems: rubygems
Packages: bolt
Source: GitHub Advisory Database
Blast Radius: 27.3
Published: 7 months ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXE2OXAtNWg3NC13MzZm
Content Injection via TileJSON Name in mapbox.js
Ecosystems: rubygems, npm
Packages: mapbox-rails, mapbox.js
Source: GitHub Advisory Database
Blast Radius: 27.1
Published: over 5 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXFyMjgtN2o2cC05aG12
Content Injection via TileJSON attribute in mapbox.js
Ecosystems: rubygems, npm
Packages: mapbox-rails, mapbox.js
Source: GitHub Advisory Database
Blast Radius: 27.1
Published: over 5 years ago
Moderate
GSA_kwCzR0hTQS1ncmg3LTkzNWotaGc2d80WNQ
Cross-site Scripting in Sidekiq
Ecosystems: rubygems
Packages: sidekiq
Source: GitHub Advisory Database
Blast Radius: 26.9
Published: over 2 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWdxdmYtODkyci12am01
Improper Certificate Validation in Puppet
Ecosystems: rubygems
Packages: puppet
Source: GitHub Advisory Database
Blast Radius: 26.6
Published: about 3 years ago
Moderate
GSA_kwCzR0hTQS05M2o1LWc4NDUtOXdxcM0XhQ
Unsafe HTTP Redirect in Puppet Agent and Puppet Server
Ecosystems: rubygems
Packages: puppet
Source: GitHub Advisory Database
Blast Radius: 26.6
Published: over 2 years ago
Moderate
GSA_kwCzR0hTQS1xNGc3LWpyeHYtNjdyOc0XeQ
Silent Configuration Failure in Puppet Agent
Ecosystems: rubygems
Packages: puppet
Source: GitHub Advisory Database
Blast Radius: 26.6
Published: over 2 years ago
Critical
GSA_kwCzR0hTQS01Y3FtLWNyeG0tNnFwds0bSA
Buffer overrun in CGI.escape_html
Ecosystems: rubygems
Packages: cgi
Source: GitHub Advisory Database
Blast Radius: 26.4
Published: over 2 years ago
High
GSA_kwCzR0hTQS04bXc4LWo1ODMtdnFmZ81ADQ
RubyGems passenger gem allows remote attackers to delete files
Ecosystems: rubygems
Packages: passenger
Source: GitHub Advisory Database
Blast Radius: 26.4
Published: about 2 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXE5N3YtNzY0Zy1yMnJw
gollum and gollum-lib allow remote authenticated users to execute arbitrary code
Ecosystems: rubygems
Packages: gollum-lib, gollum
Source: GitHub Advisory Database
Blast Radius: 26.3
Published: over 6 years ago
High
GSA_kwCzR0hTQS05eDk3LXgycDktaHZwZs4AAUMU
Fileutils Command Injection vulnerability
Ecosystems: rubygems
Packages: fileutils
Source: GitHub Advisory Database
Blast Radius: 26.2
Published: almost 2 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXZyOHEtZzVjNy1tNTRt
Nokogiri::XML::Schema trusts input by default, exposing risk of XXE vulnerability
Ecosystems: rubygems
Packages: nokogiri
Source: GitHub Advisory Database
Blast Radius: 26.0
Published: over 3 years ago
High
GSA_kwCzR0hTQS1jbTl3LWM0cmotcjJjZs0vug
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in view_component
Ecosystems: rubygems
Packages: view_component
Source: GitHub Advisory Database
Blast Radius: 26.0
Published: about 2 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXgyZnItdjh3Zi04d3d2
Ruby-SAML Improper Authentication vulnerability
Ecosystems: rubygems
Packages: ruby-saml
Source: GitHub Advisory Database
Blast Radius: 25.9
Published: almost 5 years ago
Critical
GSA_kwCzR0hTQS01NjI5LTg4NTUtZ2Y0Z80XUQ
Authentication Bypass by CSRF Weakness
Ecosystems: rubygems
Packages: solidus_core
Source: GitHub Advisory Database
Blast Radius: 25.8
Published: over 2 years ago
Moderate
GSA_kwCzR0hTQS04bXE0LTlqamgtOXhyY84AA5l2
YARD's default template vulnerable to Cross-site Scripting in generated frames.html
Ecosystems: rubygems
Packages: yard
Source: GitHub Advisory Database
Blast Radius: 25.6
Published: 2 months ago
Critical
GSA_kwCzR0hTQS14bTM0LXY4NWgtOXBnMs0XUA
Authentication Bypass by CSRF Weakness
Ecosystems: rubygems
Packages: solidus_auth_devise
Source: GitHub Advisory Database
Blast Radius: 25.6
Published: over 2 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWpwNXYtNWd4NC1qbWo5
Ability to forge per-form CSRF tokens in Rails
Ecosystems: rubygems
Packages: actionpack
Source: GitHub Advisory Database
Blast Radius: 25.6
Published: almost 4 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTk0aG0tOHE2NS1ybXht
OmniAuth-SAML authentication bypass via incorrect XML canonicalization and DOM traversal
Ecosystems: rubygems
Packages: omniauth-saml
Source: GitHub Advisory Database
Blast Radius: 25.2
Published: almost 5 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTM2cDcteGp3OC1oNmYy
Ruby-saml allows attackers to perform XML signature wrapping attacks
Ecosystems: rubygems
Packages: ruby-saml
Source: GitHub Advisory Database
Blast Radius: 25.2
Published: over 5 years ago
High
GSA_kwCzR0hTQS02OXAzLXhwMzctZjY5Ms015g
Improper Certificate Validation in kubeclient
Ecosystems: rubygems
Packages: kubeclient
Source: GitHub Advisory Database
Blast Radius: 25.2
Published: about 2 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWY4Y20tMzY0Zi1xOXFo
Ensure that doorkeeper_token is valid when authenticating requests in API v2 calls
Ecosystems: rubygems
Packages: spree
Source: GitHub Advisory Database
Blast Radius: 25.2
Published: over 3 years ago
Moderate
GSA_kwCzR0hTQS0zcWMyLXYzaHAtNmN2OM4AA13Y
sidekiq Denial of Service vulnerability
Ecosystems: rubygems
Packages: sidekiq
Source: GitHub Advisory Database
Blast Radius: 25.1
Published: 8 months ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLW0yanItaG1jMy1xbXBy
Authorization bypass in Spree
Ecosystems: rubygems
Packages: spree_api
Source: GitHub Advisory Database
Blast Radius: 25.1
Published: over 3 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTZ3cHYtY2o2eC12M2p3
http vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
Ecosystems: rubygems
Packages: http
Source: GitHub Advisory Database
Blast Radius: 25.0
Published: about 6 years ago
Critical
GSA_kwCzR0hTQS04ODMyLTRtbTUteDJyNs4AA6Aa
discordrb OS Command Injection vulnerability
Ecosystems: rubygems
Packages: discordrb
Source: GitHub Advisory Database
Blast Radius: 24.7
Published: about 2 months ago
High
GSA_kwCzR0hTQS1qamNqLWZnZm0tOWc5cs4AAUCZ
Phusion Passenger Race Condition Allows Privilege Escalation
Ecosystems: rubygems
Packages: passenger
Source: GitHub Advisory Database
Blast Radius: 24.7
Published: almost 2 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXBmOGYtdzI2Ny1tcTJo
The rack-cors rubygem may allow directory traveral
Ecosystems: rubygems
Packages: rack-cors
Source: GitHub Advisory Database
Blast Radius: 24.7
Published: over 4 years ago
Moderate
GSA_kwCzR0hTQS1yOHh4LTh2bTgteDZ3as4AA34N
Resque vulnerable to Reflected Cross Site Scripting through pathnames
Ecosystems: rubygems
Packages: resque
Source: GitHub Advisory Database
Blast Radius: 24.6
Published: 4 months ago
Moderate
GSA_kwCzR0hTQS1nYzNqLXZ2d2YtNHJwOM4AA34M
Resque vulnerable to reflected XSS in resque-web failed and queues lists
Ecosystems: rubygems
Packages: resque
Source: GitHub Advisory Database
Blast Radius: 24.6
Published: 4 months ago
Moderate
GSA_kwCzR0hTQS1yOW1xLW03MngtMjU3Z84AA34L
Resque vulnerable to reflected XSS in Queue Endpoint
Ecosystems: rubygems
Packages: resque
Source: GitHub Advisory Database
Blast Radius: 24.6
Published: 4 months ago
Moderate
GSA_kwCzR0hTQS1mdzNnLTJoM2otcW1tN84AAxPa
Improper neutralization of `noscript` element content may allow XSS in Sanitize
Ecosystems: rubygems
Packages: sanitize
Source: GitHub Advisory Database
Blast Radius: 24.6
Published: over 1 year ago
Critical
GSA_kwCzR0hTQS12cjIyLTQzZ2otcngzZs4AAjgN
omniauth-weibo-oauth2 included a code-execution backdoor inserted by a third party
Ecosystems: rubygems
Packages: omniauth-weibo-oauth2
Source: GitHub Advisory Database
Blast Radius: 24.6
Published: almost 2 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTZoODgtcWpwdi1wMzJt
OpenSSL gem for Ruby using inadequate encryption strength
Ecosystems: rubygems
Packages: openssl
Source: GitHub Advisory Database
Blast Radius: 24.6
Published: over 6 years ago
High
GSA_kwCzR0hTQS12NnJwLTNyM3YtaGY0cM4AAU7l
Ruby OpenSSL DoS Vulnerability
Ecosystems: rubygems
Packages: openssl
Source: GitHub Advisory Database
Blast Radius: 24.6
Published: almost 2 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWNmZjctNmg0cS1xNXBq
JSON-jwt Gem lacked element count during splitting of JWE string
Ecosystems: rubygems
Packages: json-jwt
Source: GitHub Advisory Database
Blast Radius: 24.5
Published: over 4 years ago
Moderate
GSA_kwCzR0hTQS1xNjU1LTNwajgtOWZ4cc4AA7WM
Sidekiq vulnerable to a Reflected XSS in Queues Web Page
Ecosystems: rubygems
Packages: sidekiq
Source: GitHub Advisory Database
Blast Radius: 24.2
Published: 3 days ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXdqeDItN2hxcS04aDdt
rails_admin ruby gem XSS vulnerability
Ecosystems: rubygems
Packages: rails_admin
Source: GitHub Advisory Database
Blast Radius: 24.2
Published: over 3 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXB4cjgtdzNqcS1yY3dq
rails_admin ruby gem XSS
Ecosystems: rubygems
Packages: rails_admin
Source: GitHub Advisory Database
Blast Radius: 24.2
Published: about 6 years ago
Moderate
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWo1aGotZmhjOS1nMjRt
rack-mini-profiler allows remote attackers to obtain sensitive information about allocated strings and objects
Ecosystems: rubygems
Packages: rack-mini-profiler
Source: GitHub Advisory Database
Blast Radius: 23.9
Published: over 6 years ago
High
MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTJwNXAtbTM1My04MzN3
Sort order SQL injection in Administrate
Ecosystems: rubygems
Packages: administrate
Source: GitHub Advisory Database
Blast Radius: 23.8
Published: about 4 years ago
Statistics
Advisories: 18,235
Packages: 8,259
Repositories: 285
Ecosystems: 12
Filter by Package
actionpack 57 nokogiri 42 rubygems-update 25 puppet 23 rack 22 activerecord 21 activesupport 14 publify_core 14 passenger 13 actionview 12 rails 11 puma 11 jquery-rails 10 fat_free_crm 10 jquery 9 rails-html-sanitizer 9 org.webjars.npm:jquery 9 jQuery 8 decidim 7 jquery-ui 7 org.jruby:jruby-stdlib 7 jQuery.UI.Combined 7 org.webjars.npm:jquery-ui 7 jquery-ui-rails 7 ember-source 6 loofah 6 camaleon_cms 6 doorkeeper 6 katello 6 spree 5 commonmarker 5 spree_auth_devise 5 bundler 5 sidekiq 5 avo 4 sanitize 4 carrierwave 4 grpcio 4 grpc 4 webrick 4 sinatra 4 dragonfly 4 activestorage 4 mail 4 devise 4 fluentd 4 private_address_check 3 rdoc 3 rails_admin 3 rack-cors 3 resque 3 cgi 3 decidim-core 3 io.grpc:grpc-protobuf 3 yard 3 rest-client 3 omniauth 3 bootstrap 3 bootstrap 3 git 3 json-jwt 3 ruby-saml 3 rubyzip 3 gollum 3 geminabox 3 openssl 3 chartkick 3 pageflow 2 omniauth-facebook 2 facter 2 logstash-core 2 redcarpet 2 pdfkit 2 git-fastclone 2 paperclip 2 mini_magick 2 twitter-bootstrap-rails 2 ox 2 net-ldap 2 devise-two-factor 2 httparty 2 json 2 bson 2 yajl-ruby 2 safemode 2 ruby-openid 2 bootstrap-sass 2 mapbox-rails 2 mapbox.js 2 secure_headers 2 sprockets 2 phlex 2 faye 2 sup 2 echor 2 uri 2 field_test 2 i18n 2 kramdown 2 spina 2 view_component 2 VladTheEnterprising 2 solidus_frontend 2 radiant 2 cocoapods-downloader 2 pyarrow 2 red-arrow 2 activeadmin 2 google-protobuf 2 com.google.protobuf:protobuf-kotlin 2 com.google.protobuf:protobuf-java 2 qiita-markdown 2 decidim-templates 2 pghero 2 user_agent_parser 2 mechanize 2 administrate 2 solidus_core 2 blazer 1 solidus_auth_devise 1 kaminari 1 rmagick 1 solidus_backend 1 github.com/github/hub 1 hub 1 websocket-extensions 1 railties 1 foreman_ansible 1 gitlab-grit 1 geokit-rails 1 multi_xml 1 keynote 1 twitter-stream 1 pysha3 1 sha3 1 cap-strap 1 ruby-jss 1 rack-mini-profiler 1 hiera 1 mcollective-client 1 wicked 1 actionmailer 1 kelredd-pruview 1 sqlite3-ruby 1 thin 1 matestack-ui-core 1 restforce 1 ruby_parser 1 better_errors 1 mongrel 1 unpoly-rails 1 bindata 1 oxidized-web 1 github.com/pubnub/swift 1 pubnub 1 pubnub 1 pubnub/pubnub 1 pubnub 1 pubnub 1 Pubnub 1 github.com/pubnub/go/v5 1 github.com/pubnub/go/v6 1 github.com/pubnub/go 1 github.com/pubnub/go/v7 1 com.pubnub:pubnub 1 rubocop 1 ruby-mysql 1 gtk2 1 rotp 1 @turbo-boost/commands 1 turbo_boost-commands 1 stringio 1 discordrb 1 diffy 1 recurly 1 md2pdf 1 sounder 1 date 1 octopoller 1 paratrooper-newrelic 1 jmespath 1 trilogy 1 sentry-raven 1 devise_invitable 1 ftpd 1 tweetstream 1 flash_tool 1 lean-ruport 1 openshift-origin-node 1 point-cli 1 govuk_tech_docs 1 audited 1 omniauth-apple 1 spree_api 1 omniauth-auth0 1 shrine 1 message_bus 1 inline_svg 1 pdf_info 1 rswag 1
Filter by Repository
https://github.com/rails/rails 53 https://github.com/sparklemotion/nokogiri 31 https://github.com/rubygems/rubygems 18 https://github.com/rack/rack 17 https://github.com/puppetlabs/puppet 15 https://github.com/publify/publify 13 https://github.com/puma/puma 11 https://github.com/phusion/passenger 10 https://github.com/jquery/jquery 10 https://github.com/fatfreecrm/fat_free_crm 9 https://github.com/rails/rails-html-sanitizer 9 https://github.com/decidim/decidim 8 https://github.com/jquery/jquery-ui 6 https://github.com/doorkeeper-gem/doorkeeper 6 https://github.com/flavorjones/loofah 6 https://github.com/solidusio/solidus_auth_devise 5 https://github.com/solidusio/solidus 5 https://github.com/owen2345/camaleon-cms 4 https://github.com/mikel/mail 4 https://github.com/grpc/grpc 4 https://github.com/markevans/dragonfly 4 https://github.com/Katello/katello 4 https://github.com/fluent/fluentd 4 https://github.com/sinatra/sinatra 4 https://github.com/rgrove/sanitize 4 https://github.com/carrierwaveuploader/carrierwave 4 https://github.com/avo-hq/avo 4 https://github.com/ruby/openssl 4 https://github.com/resque/resque 3 https://github.com/rest-client/rest-client 3 https://github.com/sidekiq/sidekiq 3 https://github.com/rubygems/rubygems.org 3 https://github.com/ruby-git/ruby-git 3 https://github.com/spree/spree 3 https://github.com/rubyzip/rubyzip 3 https://github.com/geminabox/geminabox 3 https://github.com/cyu/rack-cors 3 https://github.com/twbs/bootstrap 3 https://github.com/gjtorikian/commonmarker 3 https://github.com/gollum/gollum 3 https://github.com/lsegal/yard 3 https://github.com/jtdowney/private_address_check 3 https://github.com/faye/faye 2 https://github.com/emberjs/ember.js 2 https://github.com/codevise/pageflow 2 https://github.com/CocoaPods/cocoapods-downloader 2 https://github.com/brianmario/yajl-ruby 2 https://github.com/ankane/pghero 2 https://github.com/ankane/field_test 2 https://github.com/ruby-ldap/ruby-net-ldap 2 https://github.com/ankane/chartkick 2 https://github.com/ruby/rdoc 2 https://github.com/ruby/uri 2 https://github.com/ruby/webrick 2 https://github.com/activeadmin/activeadmin 2 https://github.com/gettalong/kramdown 2 https://github.com/github/cmark-gfm 2 https://github.com/increments/qiita-markdown 2 https://github.com/jnunemaker/httparty 2 https://github.com/protocolbuffers/protobuf 2 https://github.com/plataformatec/devise 2 https://github.com/mongodb/bson-ruby 2 https://github.com/phlex-ruby/phlex 2 https://github.com/mperham/sidekiq 2 https://github.com/openid/ruby-openid 2 https://github.com/omniauth/omniauth 2 https://github.com/ohler55/ox 2 https://github.com/nov/json-jwt 2 https://github.com/vmg/redcarpet 2 https://github.com/sparklemotion/mechanize 2 https://github.com/twitter/secure_headers 2 https://github.com/square/git-fastclone 2 https://github.com/tinfoil/devise-two-factor 2 https://github.com/sup-heliotrope/sup 2 https://github.com/svenfuchs/i18n 2 https://github.com/svenfuchs/safemode 2 https://github.com/thoughtbot/paperclip 2 https://gitlab.com/gitlab-org/cves 2 https://github.com/github/view_component 1 https://github.com/github/trilogy 1 https://github.com/github/hub 1 https://github.com/twbs/bootstrap-sass 1 https://github.com/kaminari/kaminari 1 https://github.com/theforeman/ldap_fluff 1 https://github.com/getsentry/raven-ruby 1 https://github.com/geokit/geokit-rails 1 https://github.com/tzinfo/tzinfo 1 https://github.com/gazay/gon 1 https://github.com/fnando/svg_optimizer 1 https://github.com/ua-parser/uap-core 1 https://github.com/flori/json 1 https://github.com/ua-parser/uap-ruby 1 https://github.com/ffi/ffi 1 https://github.com/faye/websocket-extensions-ruby 1 https://github.com/faye/faye-websocket-ruby 1 https://github.com/unpoly/unpoly-rails 1 https://github.com/ViewComponent/view_component 1 https://github.com/theforeman/foreman_fog_proxmox 1 https://github.com/exiftool-rb/exiftool_vendored.rb 1 https://github.com/excon/excon 1 https://github.com/evan/ccsv 1 https://github.com/thoughtbot/cocaine 1 https://github.com/jnunemaker/crack 1 https://github.com/jmespath/jmespath.rb 1 https://github.com/jirutka/asciidoctor-include-ext 1 https://github.com/jgarber/redcloth 1 https://github.com/jekyll/jekyll 1 https://github.com/janko/image_processing 1 https://github.com/jamesmartin/inline_svg 1 https://github.com/inukshuk/bibtex-ruby 1 https://github.com/jordansissel/ruby-arr-pm 1 https://github.com/josh/rack-ssl 1 https://github.com/imsebao/404team 1 https://github.com/thoughtbot/clearance 1 https://github.com/igrigorik/em-http-request 1 https://github.com/hopsoft/turbo_boost-commands 1 https://github.com/heartcombo/devise 1 https://github.com/thoughtbot/administrate 1 https://github.com/haml/haml 1 https://github.com/halostatue/minitar 1 https://github.com/Gurpartap/aescrypt 1 https://github.com/tigris/open-uri-cached 1 https://github.com/theforeman/smart_proxy_dynflow 1 https://github.com/GNOME/libxml2 1 https://github.com/TrestleAdmin/trestle-auth 1 https://github.com/binarylogic/authlogic 1 https://github.com/BetterErrors/better_errors 1 https://github.com/beenhero/omniauth-weibo-oauth2 1 https://github.com/bdmac/strong_password 1 https://github.com/bbatsov/rubocop 1 https://github.com/basecamp/marginalia 1 https://github.com/basecamp/easymon 1 https://github.com/aws/aws-sdk-ruby 1 https://github.com/zendesk/samlr 1 https://github.com/auth0/omniauth-auth0 1 https://github.com/asteinhauser/fat_free_crm 1 https://github.com/asciidoctor/asciidoctor 1 https://github.com/ankane/pgsync 1 https://github.com/zenspider/ruby_parser-legacy 1 https://github.com/zvory/csv-safe 1 https://github.com/ankane/clockwork_web 1 https://github.com/ankane/chartkick.js 1 https://gitlab.com/2013/11 1 https://github.com/ankane/blazer 1 https://github.com/amro/gibbon 1 https://github.com/alphagov/tech-docs-gem 1 https://github.com/alexreisner/geocoder 1 https://github.com/AlchemyCMS/alchemy_cms 1 https://github.com/airbrake/airbrake-ruby 1 https://github.com/ahorner/text-helpers 1 https://github.com/affix/CVE-2022-36231 1 https://github.com/adamzaninovich/sounder 1 https://github.com/elastic/logstash 1 https://github.com/elastic/apm-agent-ruby 1 https://github.com/ejschmitt/delayed_job_web 1 https://github.com/dspinhirne/netaddr-rb 1 https://github.com/doorkeeper-gem/doorkeeper-openid_connect 1 https://github.com/voloko/twitter-stream 1 https://github.com/dmendel/bindata 1 https://github.com/discourse/rails_multisite 1 https://github.com/discourse/message_bus 1 https://github.com/denkGroot/Spina 1 https://github.com/dejan/espeak-ruby 1 https://github.com/wconrad/ftpd 1 https://github.com/datamapper/extlib 1 https://github.com/webbynode/webbynode 1 https://github.com/ConradIrwin/em-imap 1 https://github.com/collectiveidea/audited 1 https://github.com/whiteleaf7/narou 1 https://github.com/codders/dataset 1 https://github.com/wycats/handlebars.js 1 https://github.com/chef/mixlib-archive 1 https://github.com/cgriego/active_attr 1 https://github.com/XKCP/XKCP 1 https://github.com/camilova/activerecord-update-by-case 1 https://github.com/bvsatyaram/random_password_generator 1 https://github.com/bundler/bundler 1 https://github.com/ytti/oxidized-web 1 https://github.com/sinatra/rack-protection 1 https://github.com/rf-/keynote 1 https://github.com/restforce/restforce 1 https://github.com/sisimai/rb-sisimai 1 https://github.com/resque/resque-scheduler 1 https://github.com/Smashing/smashing 1 https://github.com/redis-store/redis-store 1 https://github.com/recurly/recurly-client-ruby 1 https://github.com/rdoc/rdoc 1 https://github.com/rcook/rgpg 1 https://github.com/rapid7/metasploit-framework 1 https://github.com/rails/web-console 1 https://github.com/rails/sprockets 1 https://github.com/Snorby/snorby 1 https://github.com/socketry/protocol-http1 1 https://github.com/rails/kredis 1 https://github.com/rails/jquery-rails 1 https://github.com/rails/globalid 1 https://github.com/railsdog/spree 1 https://github.com/railsadminteam/rails_admin 1 https://github.com/rails/activeresource 1