Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-32732Denial-of-Service in gRPCRubyGems · grpc · fixed in 1.53.1, 1.54.2
- CVE-2023-1428Denial-of-Service in gRPCRubyGems · grpc · fixed in 1.53.0
- CVE-2023-31606A Regular Expression Denial of Service (ReDoS) issue was discovered in the sanitize_html function of redcloth gem v4.0.0.RubyGems · redcloth · fixed in 4.3.3
- CVE-2023-34102Possible unsafe reflection / partial denial of service in avoRubyGems · avo · fixed in 2.33.3
- CVE-2023-34103Stored XSS (Cross Site Scripting) in html content based fields of avoRubyGems · avo · fixed in 2.33.3
- CVE-2015-20108xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not useRubyGems · ruby-saml · fixed in 1.0.0
- CVE-2023-30145Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the formats parameter.RubyGems · camaleon_cms · fixed in 2.7.4
- CVE-2023-25309Cross Site Scripting (XSS) Vulnerability in Fetlife rollout-ui version 0.5, allows attackers to execute arbitrary code via a crafted url to RubyGems · rollout-ui · fixed in 0.5.3
- CVE-2023-30618Sensitive Terraform Output Values Printed At Info Logging Level In Kitchen-TerraformRubyGems · kitchen-terraform · fixed in 7.0.1
- CVE-2023-30614Improper Neutralization of Script-Related HTML Tags in a Web Page in payRubyGems · pay · fixed in 6.3.2
- CVE-2023-1892Cross-site Scripting (XSS) - Reflected in sidekiq/sidekiqRubyGems · sidekiq · fixed in 7.0.8
- CVE-2020-21514An issue was discovered in Fluent-ui v.1.2.2 allows attackers to gain escalated privileges and execute arbitrary code due to a default passwRubyGems · fluentd-ui
- CVE-2023-28755A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1.RubyGems · uri · fixed in 0.12.1, 0.11.1, 0.10.2 and more
- CVE-2023-28756A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1.RubyGems · time · fixed in 0.2.2, 0.1.1
- CVE-2023-28846Denial of Service in unpoly-railsRubyGems · unpoly-rails · fixed in 2.7.2.2
- CVE-2023-28102Command injection in discordrbRubyGems · discordrb · fixed in 3.4.3
- CVE-2023-27530A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could alRubyGems · rack · fixed in 2.0.9.3, 2.1.4.3, 2.2.6.3 and more
- CVE-2022-36231pdf_info 0.5.3 is vulnerable to Command Execution because the Ruby code uses backticks instead of Open3.RubyGems · pdf_info
- CVE-2022-44566A denial of service vulnerability present in ActiveRecord's PostgreSQL adapter <7.0.4.1 and <6.1.7.1.RubyGems · activerecord · fixed in 6.1.7.1, 7.0.4.1
- CVE-2022-44570A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0.RubyGems · rack · fixed in 2.0.9.2, 2.1.4.2, 2.2.6.2 and more
- CVE-2022-44571There is a denial of service vulnerability in the Content-Disposition parsingcomponent of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1, 3.0.0.1.RubyGems · rack · fixed in 2.0.9.2, 2.1.4.2, 2.2.6.1 and more
- CVE-2022-44572A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an aRubyGems · rack · fixed in 2.0.9.2, 2.1.4.2, 2.2.6.1 and more
- CVE-2023-22792A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1.RubyGems · actionpack · fixed in 5.2.8.15, 6.1.7.1, 7.0.4.1
- CVE-2023-22794A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments.RubyGems · activerecord · fixed in 6.0.6.1, 6.1.7.1, 7.0.4.1
- CVE-2023-22795A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header.RubyGems · actionpack · fixed in 6.1.7.1, 7.0.4.1
- CVE-2023-22796A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1.RubyGems · activesupport · fixed in 6.1.7.1, 7.0.4.1
- CVE-2023-22797An open redirect vulnerability is fixed in Rails 7.0.4.1 with the new protection against open redirects from calling redirect_to with untrusRubyGems · actionpack · fixed in 7.0.4.1
- CVE-2023-22799A ReDoS based DoS vulnerability in the GlobalID <1.0.1 which could allow an attacker supplying a carefully crafted input can cause the regulRubyGems · globalid · fixed in 1.0.1
- CVE-2023-25015Clockwork Web before 0.1.2, when Rails before 5.2 is used, allows CSRF.RubyGems · clockwork_web · fixed in 0.1.2
- CVE-2023-0569Weak Password Requirements in publify/publifyRubyGems · publify_core · fixed in 9.2.10