Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2017-1000042Mapbox.js versions 1.x prior to 1.6.5 and 2.x prior to 2.1.7 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenaRubyGems · mapbox-rails · fixed in 1.6.5, 2.1.7
- CVE-2017-1000043Mapbox.js versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenaRubyGems · mapbox-rails · fixed in 1.6.6, 2.2.4
- CVE-2017-11173Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests.RubyGems · rack-cors · fixed in 0.4.1
- CVE-2016-1000221Logstash prior to version 2.3.4, Elasticsearch Output plugin would log to file HTTP authorization headers which could contain sensitive infoRubyGems · logstash-core · fixed in 2.3.4
- CVE-2016-10362Prior to Logstash version 5.0.1, Elasticsearch Output plugin when updating connections after sniffing, would log to file HTTP basic auth creRubyGems · logstash-core · fixed in 5.0.1
- CVE-2015-9097The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO RubyGems · mail · fixed in 2.5.5
- CVE-2017-7475Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an applicatioRubyGems · cairo · fixed in 1.15.5
- CVE-2017-9050libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c.RubyGems · nokogiri · fixed in 1.8.1
- CVE-2016-4442The rack-mini-profiler gem before 0.10.1 for Ruby allows remote attackers to obtain sensitive information about allocated strings and objectRubyGems · rack-mini-profiler · fixed in 0.10.1
- CVE-2017-8418RuboCop 0.48.1 and earlier does not use /tmp in safe way, allowing local users to exploit this to tamper with cache files belonging to otherRubyGems · rubocop · fixed in 0.49.0
- CVE-2017-2096smalruby-editor v0.4.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.RubyGems · smalruby, smalruby-editor · fixed in 0.1.11, 0.4.1
- CVE-2017-5029The xsltAddTextString function in transform.c in libxslt 1.1.29, as used in Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, aRubyGems · nokogiri · fixed in 1.7.2
- CVE-2013-7463The aescrypt gem 1.0.0 for Ruby does not randomize the CBC IV for use with the AESCrypt.encrypt and AESCrypt.decrypt functions, which allowsRubyGems · aescrypt
- CVE-2016-10345In Phusion Passenger before 5.1.0, a known /tmp filename was used during passenger-install-nginx-module execution, which could allow local aRubyGems · passenger · fixed in 5.1.0
- CVE-2015-7565Cross-site scripting (XSS) vulnerability in Ember.js 1.8.x through 1.10.x, 1.11.x before 1.11.4, 1.12.x before 1.12.2, 1.13.x before 1.13.12RubyGems · ember-source · fixed in 1.11.4, 1.12.2, 1.13.12 and more
- CVE-2016-7103Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via RubyGems · jquery-ui-rails · fixed in 6.0.0
- CVE-2016-10193The espeak-ruby gem before 1.0.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the RubyGems · espeak-ruby · fixed in 1.0.3
- CVE-2016-10194The festivaltts4r gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the (1) to_speeRubyGems · festivaltts4r
- CVE-2017-5946The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability.RubyGems · rubyzip · fixed in 1.2.1
- CVE-2016-10173Directory traversal vulnerability in the minitar before 0.6 and archive-tar-minitar 0.5.2 gems for Ruby allows remote attackers to write to RubyGems · archive-tar-minitar, minitar · fixed in 0.5.2, 0.6
- CVE-2016-7798The openssl gem for Ruby uses the same initialization vector (IV) in GCM Mode (aes-*-gcm) when the IV is set before the key, which makes it RubyGems · openssl · fixed in 2.0.0
- CVE-2015-8857The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which mRubyGems · uglifier · fixed in 2.7.2
- CVE-2016-5697Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors.RubyGems · ruby-saml · fixed in 1.3.0
- CVE-2016-6582The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging faiRubyGems · doorkeeper · fixed in 4.2.0
- CVE-2016-7954Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondaryRubyGems · bundler · fixed in 2.0.0
- CVE-2015-8968git-fastclone before 1.0.1 permits arbitrary shell command execution from .gitmodules.RubyGems · git-fastclone · fixed in 1.0.1
- CVE-2015-8969git-fastclone before 1.0.5 passes user modifiable strings directly to a shell command.RubyGems · git-fastclone · fixed in 1.0.5
- CVE-2016-4658xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other produRubyGems · nokogiri · fixed in 1.7.1
- CVE-2016-6316Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 migRubyGems · actionview · fixed in 3.2.22.3, 4.2.7.1, 5.0.0.1
- CVE-2016-6317Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record cRubyGems · activerecord · fixed in 4.2.7.1