Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-25061The random_password_generator (aka RandomPasswordGenerator) gem through 1.0.0 for Ruby uses Kernel#rand to generate passwords, which, due toRubyGems · random_password_generator
- CVE-2022-1553Leaking password protected articles content due to improper access control in publify/publifyRubyGems · publify_core · fixed in 9.2.8
- CVE-2022-0578Code Injection in publify/publifyRubyGems · publify_core · fixed in 9.2.8
- CVE-2022-0574Improper Access Control in publify/publifyRubyGems · publify_core · fixed in 9.2.8
- CVE-2022-29970Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.RubyGems · sinatra · fixed in 2.2.0
- CVE-2022-28481CSV-Safe gem < 3.0.0 doesn't filter out special characters which could trigger CSV Injection.RubyGems · csv-safe · fixed in 3.0.0
- CVE-2022-27311Gibbon v3.4.4 and below allows attackers to execute a Server-Side Request Forgery (SSRF) via a crafted URL.RubyGems · gibbon · fixed in 3.4.4
- CVE-2022-29498Blazer before 2.6.0 allows SQL Injection.RubyGems · blazer · fixed in 2.6.0
- CVE-2022-25648Command InjectionRubyGems · git · fixed in 1.11.0
- CVE-2021-43177As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-PasswRubyGems · devise-two-factor · fixed in 4.0.2
- CVE-2022-24836Inefficient Regular Expression Complexity in NokogiriRubyGems · nokogiri · fixed in 1.13.4
- CVE-2022-24795Buffer Overflow and Integer Overflow in yajl-rubyRubyGems · yajl-ruby · fixed in 1.4.3
- CVE-2022-21223Command InjectionRubyGems · cocoapods-downloader · fixed in 1.6.2
- CVE-2022-24440Command InjectionRubyGems · cocoapods-downloader · fixed in 1.6.0, 1.6.3
- CVE-2022-24803Command Injection vulnerability in asciidoctor-include-extRubyGems · asciidoctor-include-ext · fixed in 0.4.0
- CVE-2022-24790HTTP Request Smuggling in pumaRubyGems · puma · fixed in 5.6.4, 4.3.12
- CVE-2022-0759A flaw was found in all versions of kubeclient up to (but not including) v4.9.3, the Ruby client for Kubernetes REST API, in the way it parsRubyGems · kubeclient · fixed in 4.9.3
- CVE-2018-25032zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.RubyGems · nokogiri · fixed in 1.13.4
- CVE-2021-3589An authorization flaw was found in Foreman Ansible.RubyGems · foreman_ansible · fixed in 2.0.0
- CVE-2022-24722Cross-site Scripting in view_componentRubyGems · view_component · fixed in 2.31.2, 2.49.1
- CVE-2022-24720Improper Input Validation in image_processingRubyGems · image_processing · fixed in 1.12.2
- CVE-2022-23634Information Exposure when using Puma with RailsRubyGems · puma · fixed in 5.6.2, 4.3.11
- CVE-2022-23633Exposure of sensitive information in Action PackRubyGems · actionpack · fixed in 5.2.6.2, 6.0.4.6, 6.1.4.6 and more
- CVE-2022-0524Business Logic Errors in publify/publifyRubyGems · publify_core · fixed in 9.2.7
- CVE-2021-41816CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforRubyGems · cgi · fixed in 0.3.1, 0.2.1, 0.1.0.1
- CVE-2022-23837In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no limit on the number of days when requesting stats for the graph.RubyGems · sidekiq · fixed in 6.4.0, 5.2.10
- CVE-2021-22569Denial of Service of protobuf-java parsing procedureRubyGems · google-protobuf · fixed in 3.19.2
- CVE-2021-44528A open redirect vulnerability exists in Action Pack >= 6.0.0 that could allow an attacker to craft a "X-Forwarded-Host" headers in combinatiRubyGems · actionpack · fixed in 6.0.4.2, 6.1.4.2
- CVE-2021-41817Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string.RubyGems · date · fixed in 3.2.1, 3.1.2, 3.0.2 and more
- CVE-2021-41819CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names.RubyGems · cgi · fixed in 0.3.1, 0.2.1, 0.1.0.1