Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-18848The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string.RubyGems · json-jwt · fixed in 1.11.0
- CVE-2019-18841Chartkick.js 3.1.0 through 3.1.3, as used in the Chartkick gem before 3.3.0 for Ruby, allows prototype pollution.RubyGems · chartkick · fixed in 3.3.0
- CVE-2019-12408It was discovered that the C++ implementation (which underlies the R, Python and Ruby implementations) of Apache Arrow 0.14.0 to 0.14.1 had RubyGems · red-arrow · fixed in 0.15.1
- CVE-2019-12410While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, leftRubyGems · red-arrow · fixed in 0.15.1
- CVE-2013-6461Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limitsRubyGems · nokogiri · fixed in 1.5.11, 1.6.1
- CVE-2013-6460Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documentsRubyGems · nokogiri · fixed in 1.5.11, 1.6.1
- CVE-2019-18409The ruby_parser-legacy (aka legacy) gem 1.0.0 for Ruby allows local privilege escalation because of world-writable files.RubyGems · ruby_parser-legacy
- CVE-2019-15587In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.RubyGems · loofah · fixed in 2.3.1
- CVE-2019-18197In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances.RubyGems · nokogiri · fixed in 1.10.5
- CVE-2017-1002201In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like < > " ' must be escapeRubyGems · haml · fixed in 5.0.0
- CVE-2019-17383The netaddr gem before 2.0.4 for Ruby has misconfigured file permissions, such that a gem install may result in 0777 permissions in the targRubyGems · netaddr · fixed in 2.0.4, 1.5.3
- CVE-2019-16676Plataformatec Simple Form has Incorrect Access Control in file_method? in lib/simple_form/form_builder.rb, because a user-supplied string isRubyGems · simple_form · fixed in 5.0.0
- CVE-2019-16892In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can beRubyGems · rubyzip · fixed in 1.3.0
- CVE-2019-16751An issue was discovered in Devise Token Auth through 1.1.2.RubyGems · devise_token_auth · fixed in 1.1.3
- CVE-2019-16377The makandra consul gem through 1.0.2 for Ruby has Incorrect Access Control.RubyGems · consul · fixed in 1.0.3
- CVE-2019-16145The breadcrumbs contributed module through 0.2.0 for Padrino Framework allows XSS via a caption.RubyGems · padrino-contrib
- CVE-2019-16109An issue was discovered in Plataformatec Devise before 4.7.1.RubyGems · devise · fixed in 4.7.1
- CVE-2019-16060The Airbrake Ruby notifier 4.2.3 for Airbrake mishandles the blacklist_keys configuration option and consequently may disclose passwords to RubyGems · airbrake-ruby · fixed in 4.2.4
- CVE-2018-20975Fat Free CRM before 0.18.1 has XSS in the tags_helper in app/helpers/tags_helper.rb.RubyGems · fat_free_crm · fixed in 0.18.1
- CVE-2019-15224The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third pRubyGems · awesome-bot, bitcoin_vanity +8 · fixed in 1.7.0
- CVE-2019-5477A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` meRubyGems · nokogiri, rexical · fixed in 1.10.4, 1.0.7
- CVE-2019-7615A TLS certificate validation flaw was found in Elastic APM agent for Ruby versions before 2.9.0.RubyGems · elastic-apm · fixed in 2.9.0
- CVE-2019-1020001yard before 0.9.20 allows path traversal.RubyGems · yard · fixed in 0.9.20
- CVE-2018-20857Zendesk Samlr before 2.6.2 allows an XML nodes comment attack such as a name_id node with user@example.com followed by <!---->.RubyGems · samlr · fixed in 2.6.2
- CVE-2019-14282The simple_captcha2 gem 0.2.3 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.RubyGems · simple_captcha2
- CVE-2019-14281The datagrid gem 1.0.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.RubyGems · datagrid
- CVE-2019-10744Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution.RubyGems · lodash-rails · fixed in 4.17.12
- CVE-2019-1010191marginalia < 1.6 is affected by: SQL Injection.RubyGems · marginalia · fixed in 1.6
- CVE-2019-1010266lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption.RubyGems · lodash-rails · fixed in 4.17.11
- CVE-2019-1010306Slanger 0.6.0 is affected by: Remote Code Execution (RCE).RubyGems · slanger · fixed in 0.6.1