Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-22881The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability.RubyGems · actionpack · fixed in 6.0.3.5, 6.1.2.1
- CVE-2021-22880The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulneraRubyGems · activerecord · fixed in 5.2.4.5, 6.0.3.5, 6.1.2.1
- CVE-2021-21305Code Injection vulnerability in CarrierWaveRubyGems · carrierwave · fixed in 1.3.2, 2.1.1
- CVE-2021-21288Server-side request forgery in CarrierWaveRubyGems · carrierwave · fixed in 1.3.2, 2.1.1
- CVE-2021-21289Command Injection Vulnerability in MechanizeRubyGems · mechanize · fixed in 2.7.7
- CVE-2013-2512The ftpd gem 0.2.1 for Ruby allows remote attackers to execute arbitrary OS commands via shell metacharacters in a LIST or NLST command arguRubyGems · ftpd · fixed in 0.2.2
- CVE-2020-36190RailsAdmin (aka rails_admin) before 1.4.3 and 2.x before 2.0.2 allows XSS via nested forms.RubyGems · rails_admin · fixed in 1.4.3, 2.0.2
- CVE-2020-26298Injection in RedcarpetRubyGems · redcarpet · fixed in 3.5.1
- CVE-2020-8264In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to sRubyGems · actionpack · fixed in 6.0.3.4
- CVE-2020-26247XXE in NokogiriRubyGems · nokogiri · fixed in 1.11.0
- CVE-2020-26254omniauth-apple allows attacker to fake their email address during authenticationRubyGems · omniauth-apple · fixed in 1.0.1
- CVE-2020-13353When importing repos via URL, one time use git credentials were persisted beyond the expected time window in Gitaly 1.79.0 or above.RubyGems · gitaly · fixed in 13.3.9, 13.4.5, 13.5.2
- CVE-2020-26223Authorization bypass in SpreeRubyGems · spree_api · fixed in 3.7.13, 4.0.5, 4.1.12
- CVE-2020-26222Remote code execution in dependabot-coreRubyGems · dependabot-common, dependabot-omnibus · fixed in 0.125.1
- CVE-2020-15240Regression in JWT Signature ValidationRubyGems · omniauth-auth0 · fixed in 2.4.1
- CVE-2020-15269Expired token reuse in SpreeRubyGems · spree · fixed in 3.7.11, 4.0.4, 4.1.11
- CVE-2020-25613An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1.RubyGems · webrick · fixed in 1.6.1, 1.5.1, 1.4.4
- CVE-2020-15237Timing attack in ShrineRubyGems · shrine · fixed in 3.3.0
- CVE-2016-11086lib/oauth/consumer.rb in the oauth-ruby gem through 0.5.4 for Ruby does not verify server X.509 certificates if a certificate bundle cannot RubyGems · oauth · fixed in 0.5.5
- CVE-2020-25739An issue was discovered in the gon gem before gon-6.4.0 for Ruby.RubyGems · gon · fixed in 6.4.0
- CVE-2020-15169XSS in Action ViewRubyGems · actionview · fixed in 5.2.4.4, 6.0.3.3
- CVE-2019-3881Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations undeRubyGems · bundler · fixed in 2.1.0
- CVE-2020-16254The Chartkick gem through 3.3.2 for Ruby allows Cascading Style Sheets (CSS) Injection (without attribute).RubyGems · chartkick · fixed in 3.4.0
- CVE-2020-16253The PgHero gem through 2.6.0 for Ruby allows CSRF.RubyGems · pghero · fixed in 2.7.0
- CVE-2020-16252The Field Test gem 0.2.0 through 0.3.2 for Ruby allows CSRF.RubyGems · field_test · fixed in 0.4.0
- CVE-2020-15109Ability to change order address without triggering address validations in solidusRubyGems · solidus_api, solidus_frontend · fixed in 2.8.6, 2.9.6, 2.10.2
- CVE-2020-15133Missing TLS certificate verification in Faye WebsocketRubyGems · faye-websocket · fixed in 0.11.0
- CVE-2020-15134Missing TLS certificate verification in FayeRubyGems · faye · fixed in 1.4.0
- CVE-2020-14001The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read acceRubyGems · kramdown · fixed in 2.3.0
- CVE-2020-8203Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.RubyGems · lodash-rails · fixed in 4.17.19