Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2014-0013Ember.js 1.0.x before 1.0.1, 1.1.x before 1.1.3, 1.2.x before 1.2.1, 1.3.x before 1.3.1, and 1.4.x before 1.4.0-beta.2 allows remote attackeRubyGems · ember-source · fixed in 1.0.1, 1.1.3, 1.2.1 and more
- CVE-2014-0014Ember.js 1.0.x before 1.0.1, 1.1.x before 1.1.3, 1.2.x before 1.2.1, 1.3.x before 1.3.1, and 1.4.x before 1.4.0-beta.2 allows remote attackeRubyGems · ember-source · fixed in 1.0.1, 1.1.3, 1.2.1 and more
- CVE-2017-10689In previous versions of Puppet Agent it was possible to install a module with world writable permissions.RubyGems · puppet · fixed in 4.10.10, 5.3.4
- CVE-2015-4412BSON injection vulnerability in the legal? function in BSON (bson-ruby) gem before 3.0.4 for Ruby allows remote attackers to cause a denial RubyGems · bson · fixed in 1.12.3, 3.0.4
- CVE-2014-1834The perform_request function in /lib/echor/backplane.rb in echor 0.1.6 Ruby Gem allows local users to inject arbitrary code by adding a semiRubyGems · echor
- CVE-2014-1835The perform_request function in /lib/echor/backplane.rb in echor 0.1.6 Ruby Gem allows local users to steal the login credentials by watchinRubyGems · echor
- CVE-2017-18076In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value is improperly protected because POST (in addition to GET) parameters aRubyGems · omniauth · fixed in 1.3.2
- CVE-2017-12097An exploitable cross site scripting (XSS) vulnerability exists in the filter functionality of the delayed_job_web rails gem version 1.4.RubyGems · delayed_job_web · fixed in 1.4.2
- CVE-2017-12098An exploitable cross site scripting (XSS) vulnerability exists in the add filter functionality of the rails_admin rails gem version 1.2.0.RubyGems · rails_admin · fixed in 1.3.0
- CVE-2012-6708jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks.RubyGems · jquery-rails · fixed in 2.2.0
- CVE-2015-9251jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType oRubyGems · jquery-rails · fixed in 4.2.0
- CVE-2016-10707jQuery 3.0.0-rc.1 is vulnerable to Denial of Service (DoS) due to removing a logic that lowercased attribute names.RubyGems · jquery-rails · fixed in 3.0.0
- CVE-2014-4991(1) lib/dataset/database/mysql.rb and (2) lib/dataset/database/postgresql.rb in the codders-dataset gem 1.3.2.1 for Ruby place credentials oRubyGems · codders-dataset
- CVE-2014-4992lib/cap-strap/helpers.rb in the cap-strap gem 0.1.5 for Ruby places credentials on the useradd command line, which allows local users to obtRubyGems · cap-strap
- CVE-2014-4993(1) lib/backup/cli/utility.rb in the backup-agoddard gem 3.0.28 and (2) lib/backup/cli/utility.rb in the backup_checksum gem 3.0.23 for RubyRubyGems · backup-agoddard, backup_checksum
- CVE-2014-4994lib/gyazo/client.rb in the gyazo gem 1.0.0 for Ruby allows local users to write to arbitrary files via a symlink attack on a temporary file,RubyGems · gyazo · fixed in 2.0.0
- CVE-2014-4995Race condition in lib/vlad/dba/mysql.rb in the VladTheEnterprising gem 0.2 for Ruby allows local users to obtain sensitive information by reRubyGems · vladtheenterprising
- CVE-2014-4996lib/vlad/dba/mysql.rb in the VladTheEnterprising gem 0.2 for Ruby allows local users to write to arbitrary files via a symlink attack on /tmRubyGems · vladtheenterprising
- CVE-2014-4997lib/commands/setup.rb in the point-cli gem 0.0.1 for Ruby places credentials on the curl command line, which allows local users to obtain seRubyGems · point-cli
- CVE-2014-4998test/tc_database.rb in the lean-ruport gem 0.3.8 for Ruby places the mysql user password on the mysqldump command line, which allows local uRubyGems · lean-ruport
- CVE-2014-4999vendor/plugins/dataset/lib/dataset/database/mysql.rb in the kajam gem 1.0.3.rc2 for Ruby places the mysql user password on the (1) mysqldumpRubyGems · kajam
- CVE-2014-5000The login function in lib/lawn.rb in the lawn-login gem 0.0.7 for Ruby places credentials on the curl command line, which allows local usersRubyGems · lawn-login
- CVE-2014-5001lib/ksymfony1.rb in the kcapifony gem 2.1.6 for Ruby places database user passwords on the (1) mysqldump, (2) pg_dump, (3) mysql, and (4) psRubyGems · kcapifony
- CVE-2014-5002The lynx gem before 1.0.0 for Ruby places the configured password on command lines, which allows local users to obtain sensitive informationRubyGems · lynx · fixed in 1.0.0
- CVE-2014-5003chef/travis-cookbooks/ci_environment/perlbrew/recipes/default.rb in the ciborg gem 3.0.0 for Ruby allows local users to write to arbitrary fRubyGems · ciborg
- CVE-2014-5004lib/brbackup.rb in the brbackup gem 0.1.1 for Ruby places the database password on the mysql command line, which allows local users to obtaiRubyGems · brbackup
- CVE-2018-5216Radiant CMS 1.1.4 has XSS via crafted Markdown input in the part_body_content parameter to an admin/pages/*/edit resource.RubyGems · radiant
- CVE-2017-17718The Net::LDAP (aka net-ldap) gem before 0.16.0 for Ruby has Missing SSL Certificate Validation.RubyGems · net-ldap · fixed in 0.16.0
- CVE-2017-16355In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if RubyGems · passenger · fixed in 5.1.11
- CVE-2017-10906Escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40 may allow an attacker to change the terminal UI or execuRubyGems · fluentd · fixed in 0.12.41