Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-13589The paranoid2 gem 1.1.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.RubyGems · paranoid2
- CVE-2019-13574In lib/mini_magick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because Image.oRubyGems · mini_magick · fixed in 4.9.4
- CVE-2019-13146The field_test gem 0.3.0 for Ruby has unvalidated input.RubyGems · field_test · fixed in 0.3.1
- CVE-2019-13354The strong_password gem 0.0.7 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.RubyGems · strong_password · fixed in 0.0.8
- CVE-2019-13118In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/lengRubyGems · nokogiri · fixed in 1.10.5
- CVE-2019-13117In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumberRubyGems · nokogiri · fixed in 1.10.5
- CVE-2019-8321An issue was discovered in RubyGems 2.6 and later through 3.0.2.RubyGems · rubygems-update · fixed in 2.7.9, 3.0.2
- CVE-2019-8322An issue was discovered in RubyGems 2.6 and later through 3.0.2.RubyGems · rubygems-update · fixed in 2.7.9, 3.0.2
- CVE-2019-8323An issue was discovered in RubyGems 2.6 and later through 3.0.2.RubyGems · rubygems-update · fixed in 2.7.9, 3.0.2
- CVE-2019-8325An issue was discovered in RubyGems 2.6 and later through 3.0.2.RubyGems · rubygems-update · fixed in 2.7.9, 3.0.2
- CVE-2019-8324An issue was discovered in RubyGems 2.6 and later through 3.0.2.RubyGems · rubygems-update · fixed in 2.7.9, 3.0.2
- CVE-2019-11027Ruby OpenID (aka ruby-openid) through 2.8.0 has a remotely exploitable flaw.RubyGems · ruby-openid · fixed in 2.9.0
- CVE-2019-12732The Chartkick gem through 3.1.0 for Ruby allows XSS.RubyGems · chartkick · fixed in 3.2.0
- CVE-2019-8320A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2.RubyGems · rubygems-update · fixed in 2.7.9, 3.0.3
- CVE-2015-9284The request phase of the OmniAuth Ruby gem (1.9.1 and earlier) is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on RubyGems · omniauth · fixed in 2.0.0
- CVE-2019-11358jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototypRubyGems · jquery-rails · fixed in 4.3.4
- CVE-2017-11430Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversalRubyGems · omniauth-saml · fixed in 1.10.0
- CVE-2017-11428Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversalRubyGems · ruby-saml · fixed in 1.7.0
- CVE-2019-11068libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon rRubyGems · nokogiri · fixed in 1.10.3
- CVE-2019-10842Arbitrary code execution (via backdoor code) was discovered in bootstrap-sass 3.2.0.3, when downloaded from rubygems.org.RubyGems · bootstrap-sass · fixed in 3.2.0.4
- CVE-2019-5421Plataformatec Devise version 4.5.0 and earlier, using the lockable module contains a CWE-367 vulnerability in The `Devise::Models::Lockable`RubyGems · devise · fixed in 4.6.0
- CVE-2019-5420A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically geneRubyGems · railties · fixed in 5.2.2.1
- CVE-2019-5419There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted aRubyGems · actionview · fixed in 4.2.11.1, 5.2.2.1, 5.1.6.2 and more
- CVE-2019-5418There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accepRubyGems · actionview · fixed in 5.2.2.1, 4.2.11.1, 5.1.6.2 and more
- CVE-2018-6517Prior to version 0.3.0, chloride's use of net-ssh resulted in host fingerprints for previously unknown hosts getting added to the user's knoRubyGems · chloride · fixed in 0.3.0
- CVE-2019-9837Doorkeeper::OpenidConnect (aka the OpenID Connect extension for Doorkeeper) 1.4.x and 1.5.x before 1.5.4 has an open redirect via the redireRubyGems · doorkeeper-openid_connect · fixed in 1.5.4
- CVE-2019-8331In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.RubyGems · bootstrap, bootstrap-sass +1 · fixed in 4.3.1, 3.4.1, 5.3.0
- CVE-2013-2516Vulnerability in FileUtils v0.7, Ruby Gem Fileutils <= v0.7 Command Injection vulnerability in user supplied url variable that is passed to RubyGems · fileutils · fixed in 0.7.1
- CVE-2018-16487A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into RubyGems · lodash-rails · fixed in 4.17.11
- CVE-2018-16887A cross-site scripting (XSS) flaw was found in the katello component of Satellite.RubyGems · katello · fixed in 3.9.0