Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-37454The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers toRubyGems · sha3 · fixed in 1.0.5
- CVE-2022-3171Memory handling vulnerability in ProtocolBuffers Java core and liteRubyGems · google-protobuf · fixed in 3.21.7, 3.20.3, 3.19.6 and more
- CVE-2022-39281Remote Denial of Service via Tasks endpoint in fat_free_crmRubyGems · fat_free_crm · fixed in 0.20.1
- CVE-2022-39224Arbitrary shell execution when extracting or listing files contained in a malicious rpm.RubyGems · arr-pm · fixed in 0.0.12
- CVE-2022-25765Command InjectionRubyGems · pdfkit · fixed in 0.8.7.2
- CVE-2020-36599lib/omniauth/failure_endpoint.rb in OmniAuth before 1.9.2 (and before 2.0) does not escape the message_key value.RubyGems · omniauth · fixed in 1.9.2, 2.0.0
- CVE-2022-35956update_by_case before 0.1.3 vulnerable to sql injectionRubyGems · update_by_case · fixed in 0.1.3
- CVE-2016-3098Cross-site request forgery (CSRF) vulnerability in administrate 0.1.4 and earlier allows remote attackers to hijack the user's OAuth autorizRubyGems · administrate · fixed in 0.1.5
- CVE-2022-31163TZInfo relative path traversal vulnerability allows loading of arbitrary filesRubyGems · tzinfo · fixed in 0.3.61, 1.2.10
- CVE-2022-31160jQuery UI contains potential XSS vulnerability when refreshing a checkboxradio with an HTML-like initial text labelRubyGems · jquery-ui-rails · fixed in 8.0.0
- CVE-2020-35305Cross site scripting (XSS) in gollum 5.0 to 5.1.2 via the filename parameter to the 'New Page' dialog.RubyGems · gollum · fixed in 5.1.2
- CVE-2022-31115Unsafe YAML deserialization in opensearch-rubyRubyGems · opensearch-ruby · fixed in 2.0.2
- CVE-2014-0156Awesome spawn contains OS command injection vulnerability, which allows execution of additional commands passed to Awesome spawn as argumentRubyGems · awesome_spawn · fixed in 1.2.0
- CVE-2013-4170In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML.RubyGems · ember-source · fixed in 1.0.0.rc1.1, 1.0.0.rc2.1, 1.0.0.rc3.1 and more
- CVE-2021-3779Ruby-MySQL Gem Client File ReadRubyGems · ruby-mysql · fixed in 2.10.0
- CVE-2022-32209# Possible XSS Vulnerability in Rails::Html::SanitizerThere is a possible XSS vulnerability with certain configurations of Rails::Html::SaniRubyGems · rails-html-sanitizer · fixed in 1.4.3
- CVE-2022-33127The function that calls the diff tool in Diffy 3.4.1 does not properly handle double quotes in a filename when run in a windows environment.RubyGems · diffy · fixed in 3.4.1
- CVE-2022-31071Octopoller gem published with world-writable filesRubyGems · octopoller · fixed in 0.3.0
- CVE-2022-31072Octokit gem published with world-writable filesRubyGems · octokit · fixed in 4.25.0
- CVE-2022-31033Authorization header leak in rubygem MechanizeRubyGems · mechanize · fixed in 2.8.5
- CVE-2022-32511jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable.RubyGems · jmespath · fixed in 1.6.1
- CVE-2022-31026Use of Uninitialized Variable in trilogyRubyGems · trilogy · fixed in 2.1.1
- CVE-2021-33473An argument injection vulnerability in Dragonfly Ruby Gem v1.3.0 allows attackers to read and write arbitrary files when the verify_url optiRubyGems · dragonfly · fixed in 1.4.0
- CVE-2022-31000CSRF allows attacker to finalize/unfinalize order adjustments in solidus_backendRubyGems · solidus_backend · fixed in 2.11.16, 3.0.6, 3.1.6
- CVE-2022-21831A code injection vulnerability exists in the Active Storage >= v5.2.0 that could allow an attacker to execute code via image_processing arguRubyGems · activestorage · fixed in 5.2.6.3, 6.0.4.7, 6.1.4.7 and more
- CVE-2022-22577An XSS Vulnerability in Action Pack >= 5.2.0 and < 5.2.0 that could allow an attacker to bypass CSP for non HTML like responses.RubyGems · actionpack · fixed in 5.2.7.1, 6.0.4.8, 6.1.5.1 and more
- CVE-2022-27777A XSS Vulnerability in Action View tag helpers >= 5.2.0 and < 5.2.0 which would allow an attacker to inject content if able to control inputRubyGems · actionview · fixed in 5.2.7.1, 6.0.4.8, 6.1.5.1 and more
- CVE-2022-1811Unrestricted Upload of File with Dangerous Type in publify/publifyRubyGems · publify_core · fixed in 9.2.9
- CVE-2022-1810Authorization Bypass Through User-Controlled Key in publify/publifyRubyGems · publify_core · fixed in 9.2.9
- CVE-2022-29181Improper Handling of Unexpected Data Type in NokogiriRubyGems · nokogiri · fixed in 1.13.6