Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-23627Sanitize vulnerable to Cross-site Scripting via Improper neutralization of `noscript` elementRubyGems · sanitize · fixed in 6.0.1
- CVE-2022-4891Sisimai string.rb to_plain redosRubyGems · sisimai · fixed in 4.25.14p12
- CVE-2022-46648ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a reposRubyGems · git · fixed in 1.13.0
- CVE-2022-47318ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a reposRubyGems · git · fixed in 1.13.0
- CVE-2015-10053prodigasistemas curupira passwords_controller.rb sql injectionRubyGems · curupira · fixed in 0.1.4
- CVE-2022-1812Integer Overflow or Wraparound in publify/publifyRubyGems · publify_core · fixed in 9.2.10
- CVE-2022-2815Insecure Storage of Sensitive Information in publify/publifyRubyGems · publify_core · fixed in 9.2.10
- CVE-2023-0299Improper Input Validation in publify/publifyRubyGems · publify_core · fixed in 9.2.10
- CVE-2020-36644jamesmartin Inline SVG URL Parameter helpers.rb cross site scriptingRubyGems · inline_svg · fixed in 1.7.2
- CVE-2023-22626PgHero before 3.1.0 allows Information Disclosure via EXPLAIN because query results may be present in an error message.RubyGems · pghero · fixed in 3.1.0
- CVE-2017-20159rf Keynote rumble.rb cross site scriptingRubyGems · keynote · fixed in 1.0.0
- CVE-2019-25088ytti Oxidized Web conf_search.haml cross site scriptingRubyGems · oxidized-web
- CVE-2020-36624ahorner text-helpers translation.rb reverse tabnabbingRubyGems · text_helpers · fixed in 1.2.0
- CVE-2021-4250cgriego active_attr Regex boolean_typecaster.rb call denial of serviceRubyGems · active_attr · fixed in 0.15.4
- CVE-2022-23520rails-html-sanitizer contains an incomplete fix for an XSS vulnerabilityRubyGems · rails-html-sanitizer · fixed in 1.4.4
- CVE-2022-23519Possible XSS vulnerability with certain configurations of rails-html-sanitizerRubyGems · rails-html-sanitizer · fixed in 1.4.4
- CVE-2022-23518Improper neutralization of data URIs allows XSS in rails-html-sanitizerRubyGems · rails-html-sanitizer · fixed in 1.4.4
- CVE-2022-23517Inefficient Regular Expression Complexity in rails-html-sanitizerRubyGems · rails-html-sanitizer · fixed in 1.4.4
- CVE-2022-23516Uncontrolled Recursion in LoofahRubyGems · loofah · fixed in 2.19.1
- CVE-2022-23515Improper neutralization of data URIs may allow XSS in LoofahRubyGems · loofah · fixed in 2.19.1
- CVE-2022-23514Inefficient Regular Expression Complexity in LoofahRubyGems · loofah · fixed in 2.19.1
- CVE-2022-44303Resque Scheduler version 1.27.4 is vulnerable to Cross-site scripting (XSS).RubyGems · resque-scheduler · fixed in 4.10.2
- CVE-2022-23476Unchecked return value from xmlTextReaderExpand in NokogiriRubyGems · nokogiri · fixed in 1.13.10
- CVE-2022-30122A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing component of Rack.RubyGems · rack · fixed in 2.0.9.1, 2.1.4.1, 2.2.3.1
- CVE-2022-30123A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell escape in the Lint aRubyGems · rack · fixed in 2.0.9.1, 2.1.4.1, 2.2.3.1
- CVE-2022-32224A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.1, <6.0.5.1 and <5.2RubyGems · activerecord · fixed in 7.0.3.1, 6.1.6.1, 6.0.5.1 and more
- CVE-2022-45442Sinatra vulnerable to Reflected File Download attackRubyGems · sinatra · fixed in 3.0.4, 2.2.3
- CVE-2022-4064Dalli Meta Protocol request_formatter.rb self.meta_set injectionRubyGems · dalli · fixed in 3.2.3
- CVE-2021-33621The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting.RubyGems · cgi · fixed in 0.3.5, 0.2.2, 0.1.0.2
- CVE-2022-39379Fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration)RubyGems · fluentd · fixed in 1.15.3