Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2018-0499A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 1.4.6 exists due to incomplete HTRubyGems · xapian-core · fixed in 1.4.6
- CVE-2018-3760There is an information leak vulnerability in Sprockets.RubyGems · sprockets · fixed in 3.7.2, 4.0.0.beta8, 2.12.5
- CVE-2018-1000539Nov json-jwt version >= 0.5.0 && < 1.9.4 contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability in Decryption ofRubyGems · json-jwt · fixed in 1.9.4
- CVE-2018-1000544rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write aRubyGems · rubyzip · fixed in 1.2.2
- CVE-2018-1000201ruby-ffi version 1.9.23 and earlier has a DLL loading issue which can be hijacked on Windows OS, when a Symbol is used as DLL name instead oRubyGems · ffi · fixed in 1.9.24
- CVE-2018-12615An issue was discovered in switchGroup() in agent/ExecHelper/ExecHelperMain.cpp in Phusion Passenger before 5.3.2.RubyGems · passenger · fixed in 5.3.2
- CVE-2018-12026During the spawning of a malicious Passenger-managed application, SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows such applicatioRubyGems · passenger · fixed in 5.3.2
- CVE-2018-12027An Insecure Permissions vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 causes information disclosure in the following RubyGems · passenger · fixed in 5.3.2
- CVE-2018-12028An Incorrect Access Control vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows a Passenger-managed malicious applicRubyGems · passenger · fixed in 5.3.2
- CVE-2018-12029A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-stanRubyGems · passenger · fixed in 5.3.2
- CVE-2018-3759private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the sockRubyGems · private_address_check · fixed in 0.5.0
- CVE-2018-3721lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and merRubyGems · lodash-rails · fixed in 4.17.5
- CVE-2018-11627Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception.RubyGems · sinatra · fixed in 2.0.2
- CVE-2017-18258The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafRubyGems · nokogiri · fixed in 1.8.2
- CVE-2018-3740A specially crafted HTML fragment can cause Sanitize gem for Ruby to allow non-whitelisted attributes to be used on a whitelisted HTML elemeRubyGems · sanitize · fixed in 4.6.3
- CVE-2018-3741There is a possible XSS vulnerability in all rails-html-sanitizer gem versions below 1.0.4 for Ruby.RubyGems · rails-html-sanitizer · fixed in 1.0.4
- CVE-2018-8048In the Loofah gem through 2.2.0 for Ruby, non-whitelisted HTML attributes may occur in sanitized output by republishing a crafted HTML fragmRubyGems · loofah, nokogiri · fixed in 2.2.1, 1.8.3
- CVE-2018-1000073RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 seriesRubyGems · rubygems-update · fixed in 2.7.6
- CVE-2018-1000074RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 seriesRubyGems · rubygems-update · fixed in 2.7.6
- CVE-2018-1000075RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 seriesRubyGems · rubygems-update · fixed in 2.7.6
- CVE-2018-1000076RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 seriesRubyGems · rubygems-update · fixed in 2.7.6
- CVE-2018-1000077RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 seriesRubyGems · rubygems-update · fixed in 2.7.6
- CVE-2018-1000078RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 seriesRubyGems · rubygems-update · fixed in 2.7.6
- CVE-2018-1000079RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 seriesRubyGems · rubygems-update · fixed in 2.7.6
- CVE-2018-1000088Doorkeeper version 2.1.0 through 4.2.5 contains a Cross Site Scripting (XSS) vulnerability in web view's OAuth app form, user authorization RubyGems · doorkeeper · fixed in 4.2.6
- CVE-2017-2667Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly set the verify_ssl flag for apipie-bindings that disable itRubyGems · hammer_cli_foreman · fixed in 0.10.0
- CVE-2018-1000119Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can RubyGems · rack-protection · fixed in 1.5.5, 2.0.0
- CVE-2017-16229In the Ox gem 2.8.1 for Ruby, the process crashes with a stack-based buffer over-read in the read_from_str function in sax_buf.c when a crafRubyGems · ox · fixed in 2.8.2
- CVE-2018-7261There are multiple Persistent XSS vulnerabilities in Radiant CMS 1.1.4.RubyGems · radiant
- CVE-2018-7212An issue was discovered in rack-protection/lib/rack/protection/path_traversal.rb in Sinatra 2.x before 2.0.1 on Windows.RubyGems · sinatra · fixed in 2.0.1