Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-8796Insufficient Default OTP Shared Secret LengthRubyGems · devise-two-factor · fixed in 6.0.0
- CVE-2024-39910Cross-site scripting (XSS) in the decidim admin panel with QuillJS WYSWYG editorRubyGems · decidim · fixed in 0.27.7
- CVE-2024-32034Cross-site scripting (XSS) in the decidim admin activity logRubyGems · decidim-admin · fixed in 0.27.7, 0.28.2
- CVE-2024-45409The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selectorRubyGems · ruby-saml · fixed in 1.12.3, 1.17.0
- CVE-2024-43791RequestStore has Incorrect Default PermissionsRubyGems · request_store · fixed in 1.4.0
- CVE-2024-43398REXML denial of service vulnerabilityRubyGems · rexml · fixed in 3.3.6
- CVE-2024-43380fugit parse and parse_nat stall on lengthy inputRubyGems · fugit · fixed in 1.11.1
- CVE-2024-42360Command Injection in sequenceserverRubyGems · sequenceserver · fixed in 3.1.2
- CVE-2024-41946REXML DoS vulnerabilityRubyGems · rexml · fixed in 3.3.3
- CVE-2024-41123REXML DoS vulnerabilityRubyGems · rexml · fixed in 3.3.3
- CVE-2024-7106Spina CMS media_folders cross-site request forgeryRubyGems · spina
- CVE-2024-39908Denial of service in REXMLRubyGems · rexml · fixed in 3.3.2
- CVE-2024-32469Decidim has cross-site scripting (XSS) in the paginationRubyGems · decidim · fixed in 0.27.6, 0.28.1
- CVE-2024-27095Decidim cross-site scripting (XSS) in the admin panelRubyGems · decidim-admin · fixed in 0.27.6, 0.28.1
- CVE-2024-27090Decidim vulnerable to data disclosure through the embed featureRubyGems · decidim · fixed in 0.27.6
- CVE-2024-39308RailsAdmin Cross-site Scripting vulnerability in the list viewRubyGems · rails_admin · fixed in 3.1.3
- CVE-2024-39316Rack ReDoS Vulnerability in HTTP Accept Headers ParsingRubyGems · rack · fixed in 3.1.5
- CVE-2024-32464ActionText ContentAttachment can Contain Unsanitized HTMLRubyGems · actiontext · fixed in 7.1.3.4, 7.2.0.beta2
- CVE-2024-28103Action Pack is missing security headers on non-HTML responsesRubyGems · actionpack · fixed in 6.1.7.8, 7.0.8.4, 7.1.3.4 and more
- CVE-2024-37031The Active Admin (aka activeadmin) framework before 3.2.2 for Ruby on Rails allows stored XSS in certain situations where users can create eRubyGems · activeadmin · fixed in 3.2.2, 4.0.0.beta7
- CVE-2024-35231rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameterRubyGems · rack-contrib · fixed in 2.5.0
- CVE-2024-32978Kaminari Insecure File Permissions VulnerabilityRubyGems · kaminari · fixed in 0.16.2
- CVE-2024-35176REXML contains a denial of service vulnerabilityRubyGems · rexml · fixed in 3.2.7
- CVE-2024-27281An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0.RubyGems · rdoc · fixed in 6.3.4.1, 6.4.1.1, 6.5.1.1 and more
- CVE-2024-27280A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4.RubyGems · stringio · fixed in 3.0.1.1
- CVE-2024-34341The Trix Editor Contains an Arbitrary Code Execution VulnerabilityRubyGems · actiontext · fixed in 7.0.8.3, 7.1.3.3
- CVE-2024-32970Cross-site Scripting (XSS) possible with maliciously formed HTML attribute names and values in PhlexRubyGems · phlex · fixed in 1.9.3, 1.10.2
- CVE-2024-32887Reflected XSS in sidekiqRubyGems · sidekiq · fixed in 7.2.4
- CVE-2024-32463phlex makes Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `<a>` tagsRubyGems · phlex · fixed in 1.10.1, 1.9.2, 1.8.3 and more
- CVE-2024-29034CarrierWave's Content-Type allowlist bypass vulnerability which possibly leads to XSS remainedRubyGems · carrierwave · fixed in 3.0.7, 2.2.6