Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-43846CSRF forgery protection bypass for Spree::OrdersController#populateRubyGems · solidus_frontend · fixed in 2.11.14, 3.0.5, 3.1.5
- CVE-2021-43840Path traversal in message_busRubyGems · message_bus · fixed in 3.3.7
- CVE-2021-43809Local Code Execution through Argument Injection via dash leading git url parameter in GemfileRubyGems · bundler · fixed in 2.2.33
- CVE-2021-28680The devise_masquerade gem before 1.3 allows certain attacks when a password's salt is unknown.RubyGems · devise_masquerade · fixed in 1.3.1
- CVE-2021-43805ReDos vulnerability on guest checkout email validationRubyGems · solidus_core · fixed in 2.11.13, 3.0.4, 3.1.4
- CVE-2021-27023A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a difRubyGems · puppet · fixed in 7.12.1, 6.25.1
- CVE-2021-27025A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service conditRubyGems · puppet · fixed in 7.12.1, 6.25.1
- CVE-2021-41274Authentication Bypass by CSRF WeaknessRubyGems · solidus_auth_devise · fixed in 2.5.4
- CVE-2021-41275Authentication Bypass by CSRF WeaknessRubyGems · spree_auth_devise · fixed in 4.4.1, 4.2.1, 4.1.1 and more
- CVE-2021-41263Secure/signed cookies share secrets between sites in rails_multisiteRubyGems · rails_multisite · fixed in 4.0.0
- CVE-2021-25975Publify - Stored Cross-Site Scripting (XSS) due to Unrestricted File UploadRubyGems · publify_core · fixed in 9.2.5
- CVE-2021-25974Publify - Stored Cross-Site Scripting (XSS) in EditorRubyGems · publify_core · fixed in 9.2.5
- CVE-2021-25973Publify - Improper Authorization Leads to Guest Signup Restriction BypassRubyGems · publify_core · fixed in 9.2.5
- CVE-2021-41186ReDoS vulnerability in parser_apache2RubyGems · fluentd · fixed in 1.14.2
- CVE-2021-41182XSS in the `altField` option of the Datepicker widgetRubyGems · jquery-ui-rails · fixed in 7.0.0
- CVE-2021-41183XSS in `*Text` options of the Datepicker widgetRubyGems · jquery-ui-rails · fixed in 7.0.0
- CVE-2021-41184XSS in the `of` option of the `.position()` utilRubyGems · jquery-ui-rails · fixed in 7.0.0
- CVE-2021-25972Camaleon CMS - Server-Side Request Forgery (SSRF) in Media Upload FeatureRubyGems · camaleon_cms · fixed in 2.6.0.1
- CVE-2021-25971Camaleon CMS - SVG File Upload Creates DoS for Media Upload FeatureRubyGems · camaleon_cms · fixed in 2.6.0.1
- CVE-2021-25970Camaleon CMS - Insufficient Session Expiration after Password ChangeRubyGems · camaleon_cms · fixed in 2.6.0.1
- CVE-2021-25969Camaleon CMS - Stored Cross-Site Scripting (XSS) in CommentsRubyGems · camaleon_cms · fixed in 2.6.0.1
- CVE-2011-1497A cross-site scripting vulnerability flaw was found in the auto_link function in Rails before version 3.0.6.RubyGems · actionpack · fixed in 3.0.6
- CVE-2021-22942A possible open redirect vulnerability in the Host Authorization middleware in Action Pack >= 6.0.0 that could allow attackers to redirect uRubyGems · actionpack · fixed in 6.0.4.1, 6.1.4.1
- CVE-2021-41136Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in pumaRubyGems · puma · fixed in 5.5.1, 4.3.9
- CVE-2021-39880A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE/EE all versions starting from 11.9 before 14.0.9, all veRubyGems · apollo_upload_server · fixed in 2.1.0
- CVE-2021-41098Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRubyRubyGems · nokogiri · fixed in 1.12.5
- CVE-2021-23435Open RedirectRubyGems · clearance · fixed in 2.5.0
- CVE-2021-39197Cross-Site Request Forgery in better_errorsRubyGems · better_errors · fixed in 2.8.0
- CVE-2021-30560Use after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a RubyGems · nokogiri · fixed in 1.13.2
- CVE-2021-31799In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a RubyGems · rdoc · fixed in 6.1.2.1, 6.2.1.1, 6.3.1