Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2016-10735In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability thanRubyGems · bootstrap, bootstrap-sass · fixed in 4.0.0-beta.2, 3.4.0
- CVE-2018-20676In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.RubyGems · bootstrap, bootstrap-sass · fixed in 3.4.0
- CVE-2018-20677In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.RubyGems · bootstrap, bootstrap-sass · fixed in 3.4.0
- CVE-2018-1000855easymon version 1.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in Endpoint where monitoring is mounted that can result RubyGems · easymon · fixed in 1.4.1
- CVE-2018-1000842FatFreeCRM version <=0.14.1, >=0.15.0 <=0.15.1, >=0.16.0 <=0.16.3, >=0.17.0 <=0.17.2, ==0.18.0 contains a Cross Site Scripting (XSS) vulneraRubyGems · fat_free_crm · fixed in 0.14.2, 0.15.2, 0.16.4 and more
- CVE-2018-14623A SQL injection flaw was found in katello's errata-related API.RubyGems · katello
- CVE-2018-16476A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to dRubyGems · activejob · fixed in 4.2.11, 5.0.7.1, 5.1.6.1 and more
- CVE-2018-16477A bypass vulnerability in Active Storage >= 5.2.0 for Google Cloud Storage and Disk services allow an attacker to modify the `content-disposRubyGems · activestorage · fixed in 5.2.1.1
- CVE-2018-16395An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3RubyGems · openssl · fixed in 2.0.9, 2.1.2
- CVE-2018-16470There is a possible DoS vulnerability in the multipart parser in Rack before 2.0.6.RubyGems · rack · fixed in 2.0.6
- CVE-2018-16471There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11.RubyGems · rack · fixed in 2.0.6, 1.6.11
- CVE-2014-10077Hash#slice in lib/i18n/core_ext/hash.rb in the i18n gem before 0.8.0 for Ruby allows remote attackers to cause a denial of service (applicatRubyGems · i18n · fixed in 0.8.0
- CVE-2018-16468In the Loofah gem for Ruby, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.RubyGems · loofah · fixed in 2.2.3
- CVE-2018-18476mysql-binuuid-rails 1.1.0 and earlier allows SQL Injection because it removes default string escaping for affected database columns.RubyGems · mysql-binuuid-rails · fixed in 1.1.1
- CVE-2018-18385Asciidoctor in versions < 1.5.8 allows remote attackers to cause a denial of service (infinite loop).RubyGems · asciidoctor · fixed in 1.5.8
- CVE-2018-18260In the 2.4 version of Camaleon CMS, Stored XSS has been discovered.RubyGems · camaleon_cms
- CVE-2014-10075The karo gem 2.3.8 for Ruby allows Remote command injection via the host field.RubyGems · karo
- CVE-2018-17567Jekyll through 3.6.2, 3.7.x through 3.7.3, and 3.8.x through 3.8.3 allows attackers to access arbitrary files by specifying a symlink in theRubyGems · jekyll · fixed in 3.6.3, 3.7.4, 3.8.4
- CVE-2018-14643An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman.RubyGems · smart_proxy_dynflow · fixed in 0.2.1, 0.1.11
- CVE-2017-15412Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to poteRubyGems · nokogiri · fixed in 1.8.2
- CVE-2017-2662A flaw was found in Foreman's katello plugin version 3.4.5.RubyGems · katello · fixed in 3.17.0.rc1
- CVE-2018-3779active-support ruby gem 5.2.0 could allow a remote attacker to execute arbitrary code on the system, caused by containing a malicious backdoRubyGems · active-support
- CVE-2018-3777Insufficient URI encoding in restforce before 3.0.0 allows attacker to inject arbitrary parameters into Salesforce API requests.RubyGems · restforce · fixed in 3.0.0
- CVE-2018-14404A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invaliRubyGems · nokogiri · fixed in 1.8.5
- CVE-2018-1000211Doorkeeper version 4.2.0 and later contains a Incorrect Access Control vulnerability in Token revocation API's authorized method that can reRubyGems · doorkeeper · fixed in 4.4.0
- CVE-2018-14040In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.RubyGems · bootstrap, bootstrap-sass · fixed in 4.1.2, 3.4.0
- CVE-2018-14041In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy.RubyGems · bootstrap · fixed in 4.1.2
- CVE-2018-14042In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.RubyGems · bootstrap, bootstrap-sass · fixed in 4.1.2, 3.4.0
- CVE-2016-10522rails_admin ruby gem <v1.1.1 is vulnerable to cross-site request forgery (CSRF) attacks.RubyGems · rails_admin · fixed in 1.1.1
- CVE-2018-3769ruby-grape ruby gem suffers from a cross-site scripting (XSS) vulnerability via "format" parameter.RubyGems · grape · fixed in 1.1.0