Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2017-17042lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attacRubyGems · yard · fixed in 0.9.11
- CVE-2017-16932parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.RubyGems · nokogiri · fixed in 1.8.1
- CVE-2017-1000248Redis-store <=v1.3.0 allows unsafe objects to be loaded from redisRubyGems · redis-store · fixed in 1.4.0
- CVE-2017-0909The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete blacklist of common private/local network addRubyGems · private_address_check · fixed in 0.4.1
- CVE-2017-16833Stored cross-site scripting (XSS) vulnerability in Gemirro before 0.16.0 allows attackers to inject arbitrary web script via a crafted javasRubyGems · gemirro · fixed in 0.16.0
- CVE-2017-0889Paperclip ruby gem version 3.1.4 and later suffers from a Server-SIde Request Forgery (SSRF) vulnerability in the Paperclip::UriAdapter clasRubyGems · paperclip · fixed in 5.2.0
- CVE-2017-0904The private_address_check ruby gem before 0.4.0 is vulnerable to a bypass due to use of Ruby's Resolv.getaddresses method, which is OS-depenRubyGems · private_address_check · fixed in 0.4.0
- CVE-2017-0905The Recurly Client Ruby Library before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerablRubyGems · recurly · fixed in 2.3.10, 2.2.5, 2.1.11 and more
- CVE-2017-16792Stored cross-site scripting (XSS) vulnerability in "geminabox" (Gem in a Box) before 0.13.10 allows attackers to inject arbitrary web scriptRubyGems · geminabox · fixed in 0.13.10
- CVE-2017-16516In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the whole ruby process crashes with a SRubyGems · yajl-ruby · fixed in 1.3.1
- CVE-2017-15928In the Ox gem 2.8.0 for Ruby, the process crashes with a segmentation fault when a crafted input is supplied to parse_obj.RubyGems · ox · fixed in 2.8.1
- CVE-2014-9489The gollum-grit_adapter Ruby gem dependency in gollum before 3.1.1 and the gollum-lib gem dependency in gollum-lib before 4.0.1 when the strRubyGems · gollum, gollum-lib · fixed in 3.1.1, 4.0.1
- CVE-2017-15364The foreach function in ext/ccsv.c in Ccsv 1.1.0 allows remote attackers to cause a denial of service (double free and application crash) orRubyGems · ccsv
- CVE-2017-0903RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability.RubyGems · rubygems-update · fixed in 2.6.14
- CVE-2015-1828The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive informatRubyGems · http · fixed in 0.7.3, 0.6.4
- CVE-2017-14506geminabox (aka Gem in a Box) before 0.13.6 has XSS, as demonstrated by uploading a gem file that has a crafted gem.homepage value in its .geRubyGems · geminabox · fixed in 0.13.6
- CVE-2017-14683geminabox (aka Gem in a Box) before 0.13.7 has CSRF, as demonstrated by an unintended gem upload.RubyGems · geminabox · fixed in 0.13.7
- CVE-2015-1866Cross-site scripting (XSS) vulnerability in Ember.js 1.10.x before 1.10.1 and 1.11.x before 1.11.2.RubyGems · ember-source · fixed in 1.10.1, 1.11.2
- CVE-2017-10784The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers tRubyGems · webrick · fixed in 1.4.0
- CVE-2017-14033The decode method in the OpenSSL::ASN1 module in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows attackers to cause a RubyGems · openssl · fixed in 2.0.0
- CVE-2015-4619Cross-site request forgery (CSRF) vulnerability in Spina before commit bfe44f289e336f80b6593032679300c493735e75.RubyGems · spina · fixed in 0.6.29
- CVE-2015-7225Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-timRubyGems · devise-two-factor · fixed in 2.0.0
- CVE-2017-0899RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters.RubyGems · rubygems-update · fixed in 2.6.13
- CVE-2017-0900RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications to cause a denial of service attack against RubyRubyGems · rubygems-update · fixed in 2.6.13
- CVE-2017-0901RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any fRubyGems · rubygems-update · fixed in 2.6.13
- CVE-2017-0902RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client RubyGems · rubygems-update · fixed in 2.6.13
- CVE-2015-3649The open-uri-cached rubygem allows local users to execute arbitrary Ruby code by creating a directory under /tmp containing "openuri-" folloRubyGems · open-uri-cached
- CVE-2015-1820REST client for Ruby (aka rest-client) before 1.8.0 allows remote attackers to conduct session fixation attacks or obtain sensitive cookie iRubyGems · rest-client · fixed in 1.8.0
- CVE-2017-7540rubygem-safemode, as used in Foreman, versions 1.3.2 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax.RubyGems · safemode · fixed in 1.3.2
- CVE-2017-1000026Chef Software's mixlib-archive versions 0.3.0 and older are vulnerable to a directory traversal attack allowing attackers to overwrite arbitRubyGems · mixlib-archive · fixed in 0.4.0