Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2016-2785Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers toRubyGems · puppet · fixed in 4.4.2
- CVE-2016-3072Multiple SQL injection vulnerabilities in the scoped_search function in app/controllers/katello/api/v2/api_controller.rb in Katello allow reRubyGems · katello · fixed in 2.4.3
- CVE-2016-3693The Safemode gem before 1.2.4 for Ruby, when initialized with a delegate object that is a Rails controller, allows context-dependent attackeRubyGems · safemode · fixed in 1.2.4
- CVE-2015-8806dict.c in libxml2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via an unexpectedRubyGems · nokogiri · fixed in 1.6.8
- CVE-2016-2097Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.2 and 4.x before 4.1.14.2 allows remote attackers to read arRubyGems · actionpack, actionview · fixed in 3.2.22.2, 4.1.14.2
- CVE-2016-2098Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary RubRubyGems · actionpack · fixed in 3.2.22.2, 4.1.14.2, 4.2.5.2
- CVE-2015-7576The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implemeRubyGems · actionpack · fixed in 3.2.22.1, 4.1.14.1
- CVE-2015-7577activerecord/lib/active_record/nested_attributes.rb in Active Record in Ruby on Rails 3.1.x and 3.2.x before 3.2.22.1, 4.0.x and 4.1.x beforRubyGems · activerecord · fixed in 3.2.22.1, 4.1.14.1, 4.2.5.1 and more
- CVE-2015-7578Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackerRubyGems · rails-html-sanitizer · fixed in 1.0.3
- CVE-2015-7579Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem 1.0.2 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inRubyGems · rails-html-sanitizer · fixed in 1.0.3
- CVE-2015-7580Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.xRubyGems · rails-html-sanitizer · fixed in 1.0.3
- CVE-2015-7581actionpack/lib/action_dispatch/routing/route_set.rb in Action Pack in Ruby on Rails 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows rRubyGems · actionpack · fixed in 4.2.5.1
- CVE-2016-0751actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x befRubyGems · actionpack · fixed in 4.2.5.1, 3.2.22.1, 4.1.14.1
- CVE-2016-0752Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, anRubyGems · actionpack, actionview · fixed in 4.1.14.1, 4.2.5.1, 3.2.22.1
- CVE-2016-0753Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level wRubyGems · activemodel · fixed in 4.1.14.1, 4.2.5.1
- CVE-2015-7541The initialize method in the Histogram class in lib/colorscore/histogram.rb in the colorscore gem before 0.0.5 for Ruby allows context-depenRubyGems · colorscore · fixed in 0.0.5
- CVE-2015-7519agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or inRubyGems · passenger · fixed in 4.0.60, 5.0.22
- CVE-2015-5312The xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.3 does not properly prevent entity expansion, which allows contextRubyGems · nokogiri · fixed in 1.6.7.1
- CVE-2015-7499Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitivRubyGems · nokogiri · fixed in 1.6.7.2
- CVE-2015-7314The Precious module in gollum before 4.0.1 allows remote attackers to read arbitrary files by leveraging the lack of a certain temporary-filRubyGems · gollum · fixed in 4.0.1
- CVE-2015-4020RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.4.x before 2.4.8 does not validate the hostname when fetching gems or making API reqRubyGems · rubygems-update · fixed in 2.0.17, 2.2.5, 2.4.8
- CVE-2015-1819The xmlreader in libxml allows remote attackers to cause a denial of service (memory consumption) via crafted XML data, related to an XML EnRubyGems · nokogiri · fixed in 1.6.6.4
- CVE-2015-1840jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and RubyGems · jquery-rails, jquery-ujs · fixed in 3.1.3, 4.0.4, 1.0.4
- CVE-2015-3224request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headerRubyGems · web-console · fixed in 2.1.3
- CVE-2015-3225lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote attaRubyGems · rack · fixed in 1.5.4, 1.6.2, 1.4.6
- CVE-2015-3226Cross-site scripting (XSS) vulnerability in json/encoding.rb in Active Support in Ruby on Rails 3.x and 4.1.x before 4.1.11 and 4.2.x beforeRubyGems · activesupport · fixed in 4.1.11, 4.2.2
- CVE-2015-3227The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is eRubyGems · activesupport · fixed in 4.1.11, 4.2.2, 3.2.22
- CVE-2015-5147Stack-based buffer overflow in the header_anchor function in the HTML renderer in Redcarpet before 3.3.2 allows attackers to cause a denial RubyGems · redcarpet · fixed in 3.3.2
- CVE-2015-2963The thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type value during media-type validation, which allows remotRubyGems · paperclip · fixed in 4.2.2
- CVE-2015-3900RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API reqRubyGems · rubygems-update · fixed in 2.0.16, 2.2.4, 2.4.7