Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-8166A CSRF forgery vulnerability exists in rails < 5.2.5, rails < 6.0.4 that makes it possible for an attacker to, given a global CSRF token sucRubyGems · actionpack · fixed in 5.2.4.3, 6.0.3.1
- CVE-2020-8163The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument oRubyGems · actionview · fixed in 4.2.11.3
- CVE-2020-8185A denial of service vulnerability exists in Rails <6.0.3.2 that allowed an untrusted user to run any pending migrations on a Rails app runniRubyGems · actionpack · fixed in 6.0.3.2
- CVE-2020-8161A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerability in the Rack::DiRubyGems · rack · fixed in 2.1.3
- CVE-2020-8167A CSRF vulnerability exists in rails <= 6.0.3 rails-ujs module that could allow attackers to send CSRF tokens to wrong domains.RubyGems · actionview · fixed in 5.2.4.3, 6.0.3.1
- CVE-2020-8165A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal userRubyGems · activesupport · fixed in 5.2.4.3, 6.0.3.1
- CVE-2020-8164A deserialization of untrusted data vulnerability exists in rails < 5.2.4.3, rails < 6.0.3.1 which can allow an attacker to supply informatiRubyGems · actionpack · fixed in 5.2.4.3, 6.0.3.1
- CVE-2020-8162A client side enforcement of server side security vulnerability exists in rails < 5.2.4.2 and rails < 6.0.3.1 ActiveStorage's S3 adapter thaRubyGems · activestorage · fixed in 5.2.4.3, 6.0.3.1
- CVE-2020-8184A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it is possibRubyGems · rack · fixed in 2.1.4, 2.2.3
- CVE-2020-4054Cross-site Scripting in SanitizeRubyGems · sanitize · fixed in 5.2.1
- CVE-2020-7671goliath through 1.0.6 allows request smuggling attacks where goliath is used as a backend and a frontend proxy also being vulnerable.RubyGems · goliath
- CVE-2020-7663websocket-extensions ruby module prior to 0.1.5 allows Denial of Service (DoS) via Regex Backtracking.RubyGems · websocket-extensions · fixed in 0.1.5
- CVE-2020-7659reel through 0.6.1 allows Request Smuggling attacks due to incorrect Content-Length and Transfer encoding header parsing.RubyGems · reel
- CVE-2020-11082Cross-Site Scripting in KaminariRubyGems · kaminari · fixed in 1.2.1
- CVE-2020-13482EM-HTTP-Request 1.1.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack againstRubyGems · em-http-request · fixed in 1.1.6
- CVE-2020-11077HTTP Smuggling via Transfer-Encoding Header in PumaRubyGems · puma · fixed in 3.12.6, 4.3.5
- CVE-2020-11076HTTP Smuggling via Transfer-Encoding Header in PumaRubyGems · puma · fixed in 3.12.5, 4.3.4
- CVE-2020-13163em-imap 0.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of RubyGems · em-imap
- CVE-2020-7656jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method.RubyGems · jquery-rails · fixed in 2.2.0
- CVE-2020-8159There is a vulnerability in actionpack_page-caching gem < v1.2.1 that allows an attacker to write arbitrary files to a web server, potentialRubyGems · actionpack-page_caching · fixed in 1.2.1
- CVE-2020-8151There is a possible information disclosure issue in Active Resource <v5.1.1 that could allow an attacker to create specially crafted requestRubyGems · activeresource · fixed in 5.1.1
- CVE-2020-11052Improper Restriction of Excessive Authentication Attempts in SorceryRubyGems · sorcery · fixed in 0.15.0
- CVE-2020-10187Doorkeeper version 5.0.0 and later contains an information disclosure vulnerability that allows an attacker to retrieve the client secret onRubyGems · doorkeeper · fixed in 5.0.3, 5.1.1, 5.2.5 and more
- CVE-2020-11020Authentication and extension bypass in FayeRubyGems · faye · fixed in 1.0.4, 1.1.3, 1.2.5
- CVE-2020-11022jQuery has a potential XSS vulnerabilityRubyGems · jquery-rails · fixed in 4.4.0
- CVE-2020-11023Potential XSS vulnerability in jQueryRubyGems · jquery-rails · fixed in 4.4.0
- CVE-2020-10663The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object CreatRubyGems · json · fixed in 2.3.0
- CVE-2020-5267Possible XSS vulnerability in ActionViewRubyGems · actionview · fixed in 5.2.4.2, 6.0.2.2
- CVE-2020-5257Sort order SQL injection in AdministrateRubyGems · administrate · fixed in 0.13.0
- CVE-2020-5249HTTP Response Splitting (Early Hints) in PumaRubyGems · puma · fixed in 3.12.4, 4.3.3