Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2015-3448REST client for Ruby (aka rest-client) before 1.7.3 logs usernames and passwords, which allows local users to obtain sensitive information bRubyGems · rest-client · fixed in 1.7.3
- CVE-2015-1426Puppet Labs Facter 1.6.0 through 2.4.0 allows local users to obtains sensitive Amazon EC2 IAM instance metadata by reading a fact for an AmaRubyGems · facter · fixed in 2.4.1
- CVE-2014-1831Phusion Passenger before 4.0.37 allows local users to write to certain files and directories via a symlink attack on (1) control_process.pidRubyGems · passenger · fixed in 4.0.38
- CVE-2014-1832Phusion Passenger 4.0.37 allows local users to write to certain files and directories via a symlink attack on (1) control_process.pid or a (RubyGems · passenger · fixed in 4.0.38
- CVE-2015-1585Fat Free CRM before 0.13.6 allows remote attackers to conduct cross-site request forgery (CSRF) attacks via a request without the authenticiRubyGems · fat_free_crm · fixed in 0.13.6
- CVE-2014-9490The numtok function in lib/raven/okjson.rb in the raven-ruby gem before 0.12.2 for Ruby allows remote attackers to cause a denial of serviceRubyGems · sentry-raven · fixed in 0.12.2
- CVE-2012-6684Cross-site scripting (XSS) vulnerability in the RedCloth library 4.2.9 for Ruby and earlier allows remote attackers to inject arbitrary web RubyGems · redcloth · fixed in 4.3.0
- CVE-2014-8144Cross-site request forgery (CSRF) vulnerability in doorkeeper before 1.4.1 allows remote attackers to hijack the authentication of unspecifiRubyGems · doorkeeper · fixed in 1.4.1
- CVE-2012-6662Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.1RubyGems · jquery-ui-rails · fixed in 4.0.0
- CVE-2010-5312Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to iRubyGems · jquery-ui-rails · fixed in 4.0.0
- CVE-2014-7829Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, RubyGems · actionpack · fixed in 4.1.8, 3.2.21, 4.0.12 and more
- CVE-2014-3248Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x bRubyGems · facter, hiera +2 · fixed in 1.7.6, 2.0.2, 1.3.4 and more
- CVE-2014-7818Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, RubyGems · actionpack · fixed in 3.2.20, 4.0.11, 4.1.7 and more
- CVE-2014-7819Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.RubyGems · sprockets · fixed in 2.0.5, 2.1.4, 2.2.3 and more
- CVE-2013-0334Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with RubyGems · bundler · fixed in 1.7.0
- CVE-2014-5441Multiple cross-site scripting (XSS) vulnerabilities in app/views/layouts/application.html.haml in Fat Free CRM before 0.13.3 allow remote atRubyGems · fat_free_crm · fixed in 0.13.3
- CVE-2014-3514activerecord/lib/active_record/relation/query_methods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows RubyGems · activerecord · fixed in 4.0.9, 4.1.5
- CVE-2014-4326Elasticsearch Logstash 1.0.14 through 1.4.x before 1.4.2 allows remote attackers to execute arbitrary commands via a crafted event in (1) zaRubyGems · logstash · fixed in 1.4.2
- CVE-2014-3482SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in the PostgreSQL adapter for ActiveRubyGems · activerecord · fixed in 3.2.19
- CVE-2014-3483SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb in the PostgreSQL adapter for ActiveRubyGems · activerecord · fixed in 4.0.7, 4.1.3
- CVE-2013-1756The Dragonfly gem 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby, when used with Ruby on Rails, allows remote attackers to execute arbitrRubyGems · dragonfly · fixed in 0.8.6, 0.9.13
- CVE-2013-2090The set_meta_data function in lib/cremefraiche.rb in the Creme Fraiche gem before 0.6.1 for Ruby allows remote attackers to execute arbitrarRubyGems · cremefraiche · fixed in 0.6.1
- CVE-2014-0177The am function in lib/hub/commands.rb in hub before 1.12.1 allows local users to overwrite arbitrary files via a symlink attack on a temporRubyGems · hub · fixed in 1.12.1
- CVE-2013-4489The Grit gem for Ruby, as used in GitLab 5.2 before 5.4.1 and 6.x before 6.2.3, allows remote authenticated users to execute arbitrary commaRubyGems · gitlab-grit · fixed in 2.6.1
- CVE-2013-4562The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-sRubyGems · omniauth-facebook · fixed in 1.5.0
- CVE-2013-5671lib/dragonfly/imagemagickutils.rb in the fog-dragonfly gem 0.8.2 for Ruby allows remote attackers to execute arbitrary commands via unspecifRubyGems · dragonfly, fog-dragonfly · fixed in 1.0.0
- CVE-2014-0135Kafo before 0.3.17 and 0.4.x before 0.5.2, as used by Foreman, uses world-readable permissions for default_values.yaml, which allows local uRubyGems · kafo · fixed in 0.3.17, 0.5.2
- CVE-2014-0130Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails beforRubyGems · actionpack · fixed in 3.2.18, 4.0.5, 4.1.1
- CVE-2014-2322lib/string_utf_support.rb in the Arabic Prawn 0.0.1 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharactRubyGems · arabic-prawn
- CVE-2013-7111The put_call function in the API client (api/api_client.rb) in the BaseSpace Ruby SDK (aka bio-basespace-sdk) gem 0.1.7 for Ruby uses the APRubyGems · bio-basespace-sdk