Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-28966In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.RubyGems · tmpdir · fixed in 0.1.2
- CVE-2021-35440Smashing 1.3.4 is vulnerable to Cross Site Scripting (XSS).RubyGems · smashing · fixed in 1.3.5
- CVE-2021-32740Regular Expression Denial of Service in Addressable templatesRubyGems · addressable · fixed in 2.8.0
- CVE-2021-35514Narou (aka Narou.rb) before 3.8.0 allows Ruby Code Injection via the title name or author name of a novel.RubyGems · narou · fixed in 3.8.0
- CVE-2021-32823Potential Denial-of-Service in bindataRubyGems · bindata · fixed in 2.4.10
- CVE-2021-28833Increments Qiita::Markdown before 0.34.0 allows XSS via a crafted gist link, a different vulnerability than CVE-2021-28796.RubyGems · qiita-markdown · fixed in 0.34.0
- CVE-2021-22902The actionpack ruby gem (a framework for handling and responding to web requests in Rails) before 6.0.3.7, 6.1.3.2 suffers from a possible dRubyGems · actionpack · fixed in 6.0.3.7, 6.1.3.2
- CVE-2021-22903The actionpack ruby gem before 6.1.3.2 suffers from a possible open redirect vulnerability.RubyGems · actionpack · fixed in 6.1.3.2
- CVE-2021-22904The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token AuthentRubyGems · actionpack · fixed in 6.0.3.7, 6.1.3.2, 5.2.6 and more
- CVE-2021-20259A flaw was found in the Foreman project.RubyGems · foreman_fog_proxmox · fixed in 0.13.1
- CVE-2021-33564An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files RubyGems · dragonfly · fixed in 1.4.0
- CVE-2021-22885A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the `redirect_to` or `polymRubyGems · actionpack · fixed in 6.0.3.7, 6.1.3.2, 5.2.6 and more
- CVE-2021-33575The Pixar ruby-jss gem before 1.6.0 allows remote attackers to execute arbitrary code because of the Plist gem's documented behavior of usinRubyGems · ruby-jss · fixed in 1.6.0
- CVE-2021-3517There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11.RubyGems · nokogiri · fixed in 1.11.4
- CVE-2021-3518There's a flaw in libxml2 in versions before 2.9.11.RubyGems · nokogiri · fixed in 1.11.4
- CVE-2021-3537A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing aRubyGems · nokogiri · fixed in 1.11.4
- CVE-2021-29509Keepalive Connections Causing Denial Of Service in pumaRubyGems · puma · fixed in 4.3.8, 5.3.1
- CVE-2020-36327Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the highest gem version number, which RubyGems · bundler · fixed in 2.2.10, 2.2.18
- CVE-2021-31671pgsync before 0.6.7 is affected by Information Disclosure of sensitive information.RubyGems · pgsync · fixed in 0.6.7
- CVE-2020-7385Metasploit Framework 'drb_remote_codeexec' code executionRubyGems · metasploit-framework · fixed in 4.19.0
- CVE-2021-28965The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues.RubyGems · rexml · fixed in 3.2.5
- CVE-2021-29435Cross-Site Request Forgery (CSRF) in trestle-authRubyGems · trestle-auth · fixed in 0.4.2
- CVE-2021-30151Sidekiq through 5.1.3 and 6.x through 6.2.0 allows XSS via the queue name of the live-poll feature when Internet Explorer is used.RubyGems · sidekiq · fixed in 5.2.0, 6.2.1
- CVE-2021-28834Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.RubyGems · kramdown · fixed in 2.3.1
- CVE-2021-28796Increments Qiita::Markdown before 0.33.0 allows XSS in transformers.RubyGems · qiita-markdown · fixed in 0.33.0
- CVE-2019-25025The activerecord-session_store (aka Active Record Session Store) component through 1.1.3 for Ruby on Rails does not use a constant-time apprRubyGems · activerecord-session_store · fixed in 2.0.0
- CVE-2020-24393TweetStream 2.6.1 uses the library eventmachine in an insecure way that does not have TLS hostname validation.RubyGems · tweetstream
- CVE-2020-24392In voloko twitter-stream 0.1.10, missing TLS hostname validation allows an attacker to perform a man-in-the-middle attack against users of tRubyGems · twitter-stream
- CVE-2021-23337Command InjectionRubyGems · lodash-rails · fixed in 4.17.21
- CVE-2020-28500Regular Expression Denial of Service (ReDoS)RubyGems · lodash-rails · fixed in 4.17.21