Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-50448In ActiveAdmin (aka Active Admin) before 2.12.0, a concurrency issue allows a malicious actor to access potentially private data (that belonRubyGems · activeadmin · fixed in 2.12.0
- CVE-2023-51774The json-jwt (aka JSON::JWT) gem 1.16.3 for Ruby sometimes allows bypass of identity checks via a sign/encryption confusion attack.RubyGems · json-jwt · fixed in 1.16.6, 1.15.3.1
- CVE-2023-51763csv_builder.rb in ActiveAdmin (aka Active Admin) before 3.2.0 allows CSV injection.RubyGems · activeadmin · fixed in 3.2.0
- CVE-2023-50727Resque vulnerable to reflected XSS in Queue EndpointRubyGems · resque · fixed in 2.6.0
- CVE-2023-50725Resque vulnerable to reflected XSS in resque-web failed and queues listsRubyGems · resque · fixed in 2.2.1
- CVE-2023-50724Resque vulnerable to reflected cross site scripting through pathname RubyGems · resque · fixed in 2.1.0
- CVE-2009-4123The jruby-openssl gem before 0.6 for JRuby mishandles SSL certificate validation.RubyGems · jruby-openssl · fixed in 0.6
- CVE-2013-2513The flash_tool gem through 0.6.0 for Ruby allows command execution via shell metacharacters in the name of a downloaded file.RubyGems · flash_tool
- CVE-2015-2179The xaviershay-dm-rails gem 0.10.3.8 for Ruby allows local users to discover MySQL credentials by listing a process and its arguments.RubyGems · xaviershay-dm-rails
- CVE-2015-8314The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persisRubyGems · devise · fixed in 3.5.4
- CVE-2023-26154Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; alRubyGems · pubnub · fixed in 5.3.0
- CVE-2023-49090CarrierWave has a content-type allowlist bypass vulnerability, possibly leading to XSSRubyGems · carrierwave · fixed in 3.0.5, 2.2.5
- CVE-2023-5349Draw while calling getdrawinfo()RubyGems · rmagick · fixed in 5.3.0
- CVE-2023-5214CVE-2023-5214 - Privilege Escalation in Puppet Bolt RubyGems · bolt · fixed in 3.27.4
- CVE-2023-36465Decidim has broken access control in templatesRubyGems · decidim, decidim-templates · fixed in 0.26.8, 0.27.4
- CVE-2023-26153Versions of the package geokit-rails before 2.5.0 are vulnerable to Command Injection due to unsafe deserialisation of YAML within the 'geo_RubyGems · geokit-rails · fixed in 2.5.0
- CVE-2023-26141Versions of the package sidekiq before 7.1.3 are vulnerable to Denial of Service (DoS) due to insufficient checks in the dashboard-charts.jsRubyGems · sidekiq · fixed in 7.1.3, 6.5.10
- CVE-2023-4785Denial of Service in gRPC CoreRubyGems · grpc · fixed in 1.56.2, 1.55.3, 1.54.3 and more
- CVE-2023-40175Inconsistent Interpretation of HTTP Requests in pumaRubyGems · puma · fixed in 5.6.7, 6.3.1
- CVE-2023-33953Denial-of-Service in gRPCRubyGems · grpc · fixed in 1.53.2, 1.54.3, 1.55.2 and more
- CVE-2023-38697 protocol-http1 HTTP Request/Response Smuggling vulnerabilityRubyGems · protocol-http1 · fixed in 0.15.1
- CVE-2023-38337rswag before 2.10.1 allows remote attackers to read arbitrary JSON and YAML files via directory traversal, because rswag-api can expose a fiRubyGems · rswag · fixed in 2.10.1
- CVE-2023-34089Decidim Cross-site Scripting vulnerability in the processes filterRubyGems · decidim, decidim-core · fixed in 0.26.7, 0.27.3
- CVE-2023-34090Decidim vulnerable to sensitive data disclosureRubyGems · decidim, decidim-meetings · fixed in 0.27.3
- CVE-2023-32693Decidim Cross-site Scripting vulnerability in the external link redirectionsRubyGems · decidim, decidim-core · fixed in 0.26.7, 0.27.3
- CVE-2023-36823Sanitize vulnerable to Cross-site Scripting via insufficient neutralization of `style` element contentRubyGems · sanitize · fixed in 6.0.2
- CVE-2023-36617A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby.RubyGems · uri · fixed in 0.10.3, 0.12.2, 0.11.2 and more
- CVE-2023-3445Cross-site Scripting (XSS) - Stored in spinacms/spinaRubyGems · spina · fixed in 2.15.1
- CVE-2023-34246Doorkeeper Improper Authentication vulnerabilityRubyGems · doorkeeper · fixed in 5.6.6
- CVE-2023-32731Information leak in gRPCRubyGems · grpc · fixed in 1.53.1, 1.54.2