Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-5247HTTP Response Splitting in PumaRubyGems · puma · fixed in 3.12.4, 4.3.3
- CVE-2020-8130There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe cRubyGems · rake · fixed in 12.3.3
- CVE-2020-5243Denial of Service in uap-core when processing crafted User-Agent stringsRubyGems · user_agent_parser · fixed in 2.6.0
- CVE-2015-4410The Moped::BSON::ObjecId.legal? method in rubygem-moped before commit dd5a7c14b5d2e466f7875d079af71ad19774609b allows remote attackers to caRubyGems · moped · fixed in 1.5.3, 2.0.5
- CVE-2015-4411The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped allows remote attackers to cause a denial RubyGems · bson · fixed in 3.0.4
- CVE-2020-7942Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromRubyGems · puppet · fixed in 6.13.0, 5.5.19
- CVE-2012-6685Nokogiri before 1.5.4 is vulnerable to XXE attacksRubyGems · nokogiri · fixed in 1.5.4
- CVE-2020-5241XSS/Script injection vulnerability in matestackRubyGems · matestack-ui-core · fixed in 0.7.4
- CVE-2013-1607Ruby PDFKit gem prior to 0.5.3 has a Code Execution VulnerabilityRubyGems · pdfkit · fixed in 0.5.3
- CVE-2019-17268The omniauth-weibo-oauth2 gem 0.4.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.RubyGems · omniauth-weibo-oauth2 · fixed in 0.5.1
- CVE-2020-7981sql.rb in Geocoder before 1.6.1 allows Boolean-based SQL injection when within_bounding_box is used in conjunction with untrusted sw_lat, swRubyGems · geocoder · fixed in 1.6.1
- CVE-2020-5216Limited header injection when using dynamic overrides with user input in RubyGems secure_headersRubyGems · secure_headers · fixed in 6.3.0, 5.2.0, 3.9.0
- CVE-2020-5217Directive injection when using dynamic overrides with user input in RubyGems secure_headersRubyGems · secure_headers · fixed in 6.2.0, 5.1.0, 3.8.0
- CVE-2019-10780BibTeX-ruby before 5.1.0 allows shell command injection due to unsanitized user input being passed directly to the built-in Ruby Kernel.openRubyGems · bibtex-ruby · fixed in 5.1.0
- CVE-2020-7595xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.RubyGems · nokogiri · fixed in 1.10.8
- CVE-2015-2784The papercrop gem before 0.3.0 for Ruby on Rails does not properly handle crop input.RubyGems · papercrop · fixed in 0.3.0
- CVE-2014-3211Publify before 8.0.1 is vulnerable to a Denial of Service attackRubyGems · publify_core · fixed in 8.0.1
- CVE-2013-4318File injection vulnerability in Ruby gem Features 0.3.0 allows remote attackers to inject malicious html in the /tmp directory.RubyGems · features
- CVE-2019-19919Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution.RubyGems · bootstrap-wysihtml5-rails
- CVE-2019-16782Possible Information Leak / Session Hijack Vulnerability in RackRubyGems · rack · fixed in 1.6.12, 2.0.8
- CVE-2019-16779In RubyGem excon, interrupted Persistent Connections May Leak Response DataRubyGems · excon · fixed in 0.71.0
- CVE-2013-4593RubyGem omniauth-facebook has an access token security vulnerabilityRubyGems · omniauth-facebook · fixed in 1.5.1
- CVE-2019-5815Type confusion in xsltNumberFormatGetMultipleLevel prior to libxslt 1.1.33 could allow attackers to potentially exploit heap corruption via RubyGems · nokogiri · fixed in 1.10.5
- CVE-2013-2095rubygem-openshift-origin-controller: API can be used to create applications via cartridge_cache.rb URI.prase() to perform command injectionRubyGems · openshift-origin-controller
- CVE-2019-16770Potential DOS attack in PumaRubyGems · puma · fixed in 3.12.2, 4.3.1
- CVE-2019-14825A cleartext password storage issue was discovered in Katello, versions 3.x.x.x before katello 3.12.0.9.RubyGems · katello · fixed in 3.12.2
- CVE-2014-0084Ruby gem openshift-origin-node before 2014-02-14 does not contain a cronjob timeout which could result in a denial of service in cron.daily RubyGems · openshift-origin-node
- CVE-2014-0083The Ruby net-ldap gem before 0.11 uses a weak salt when generating SSHA passwords.RubyGems · net-ldap · fixed in 0.16.2
- CVE-2012-6135RubyGems passenger 4.0.0 betas 1 and 2 allows remote attackers to delete arbitrary files during the startup process.RubyGems · passenger · fixed in 4.0.0.rc4
- CVE-2019-18978An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem before 1.0.4 for Ruby.RubyGems · rack-cors · fixed in 1.0.4