Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-28862ROTP 6.2.2 and 6.2.1 has 0666 permissions for the .rb files.RubyGems · rotp · fixed in 6.3.0
- CVE-2024-28181Arbitrary method invocation turbo_boost-commands RubyGems · turbo_boost-commands · fixed in 0.1.3, 0.2.2
- CVE-2024-28121Reflex arbitrary method call in stimulus_reflexRubyGems · stimulus_reflex · fixed in 3.5.0.rc4, 3.4.2
- CVE-2024-28199Cross-site Scripting (XSS) possible with maliciously formed HTML attribute names and values in PhlexRubyGems · phlex · fixed in 1.9.1, 1.8.2, 1.7.1 and more
- CVE-2023-46950Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker to obtain sensitive information via a crafted URL RubyGems · sidekiq-unique-jobs · fixed in 8.0.7, 7.1.33
- CVE-2023-46951Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker to obtain sensitive information via a crafted paylRubyGems · sidekiq-unique-jobs · fixed in 8.0.7, 7.1.33
- CVE-2024-26141Possible DoS Vulnerability with Range Header in RackRubyGems · rack · fixed in 3.0.9.1, 2.2.8.1
- CVE-2024-25126Rack ReDos in content type parsing (2nd degree polynomial)RubyGems · rack · fixed in 3.0.9.1, 2.2.8.1
- CVE-2024-26146Possible Denial of Service Vulnerability in Rack Header ParsingRubyGems · rack · fixed in 3.0.9.1, 2.2.8.1, 2.1.4.4 and more
- CVE-2024-27285YARD's default template vulnerable to Cross-site Scripting in generated frames.htmlRubyGems · yard · fixed in 0.9.36
- CVE-2024-26144Possible Sensitive Session Information Leak in Active StorageRubyGems · activestorage · fixed in 6.1.7.7, 7.0.8.1
- CVE-2024-26143Rails Possible XSS Vulnerability in Action ControllerRubyGems · actionpack, rails · fixed in 7.0.8.1, 7.1.3.1
- CVE-2024-26142Rails possible ReDoS vulnerability in Accept header parsing in Action DispatchRubyGems · actionpack · fixed in 7.1.3.1
- CVE-2024-27456rack-cors (aka Rack CORS Middleware) 2.0.1 has 0666 permissions for the .rb files.RubyGems · rack-cors · fixed in 2.0.2
- CVE-2023-51447Decidim vulnerable to cross-site scripting (XSS) in the dynamic file uploadsRubyGems · decidim, decidim-core · fixed in 0.27.5
- CVE-2023-48220Decidim's devise_invitable gem vulnerable to circumvention of invitation token expiry periodRubyGems · decidim, decidim-admin +2 · fixed in 0.26.9, 0.27.5, 2.0.9
- CVE-2023-47635Decidim vulnerable to possible CSRF attack at questionnaire templates previewRubyGems · decidim-templates · fixed in 0.27.5
- CVE-2023-47634Decidim has race condition in EndorsementsRubyGems · decidim · fixed in 0.26.9, 0.27.5
- CVE-2024-25122 Cross-site Scripting sidekiq-unique-jobs UI server vulnerabilityRubyGems · sidekiq-unique-jobs · fixed in 8.0.7, 7.1.33
- CVE-2024-22411Cross site scripting in Action messages on AvoRubyGems · avo · fixed in 3.3.0, 2.47.0
- CVE-2024-22191Stored cross-site scripting (XSS) in `key_value` field in AvoRubyGems · avo · fixed in 3.2.4, 2.47.0
- CVE-2024-21647HTTP Request/Response Smuggling in pumaRubyGems · puma · fixed in 6.4.2, 5.6.8
- CVE-2024-0241encoded_id-rails Denial of Service VulnerabilityRubyGems · encoded_id-rails · fixed in 1.0.0.beta2
- CVE-2024-22048govuk_tech_docs XSS VulnerabilityRubyGems · govuk_tech_docs · fixed in 3.3.1
- CVE-2024-22047Audited Log Integrity Errors Due to Race ConditionRubyGems · audited · fixed in 5.3.3
- CVE-2024-22051CommonMarker Integer Overflow VulnerabilityRubyGems · commonmarker · fixed in 0.23.4
- CVE-2024-22050Iodine Static File Server Path Traversal VulnerabilityRubyGems · iodine · fixed in 0.7.33, 0.7.34
- CVE-2024-22049httparty Multipart/Form-Data Request Tampering VulnerabilityRubyGems · httparty · fixed in 0.21.0
- CVE-2024-21636view_component Cross-site Scripting vulnerabilityRubyGems · view_component · fixed in 3.9.0, 2.83.0
- CVE-2024-21632omniauth-microsoft_graph vulnerable to account takeover (nOAuth)RubyGems · omniauth-microsoft_graph · fixed in 2.0.0