Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2014-2888lib/sfpagent/bsig.rb in the sfpagent gem before 0.4.15 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacteRubyGems · sfpagent · fixed in 0.4.15
- CVE-2013-2105The Show In Browser (show_in_browser) gem 0.0.3 for Ruby allows local users to inject arbitrary web script or HTML via a symlink attack on /RubyGems · show_in_browser
- CVE-2014-0036The rbovirt gem before 0.0.24 for Ruby uses the rest-client gem with SSL verification disabled, which allows remote attackers to conduct manRubyGems · rbovirt · fixed in 0.0.24
- CVE-2014-2538Cross-site scripting (XSS) vulnerability in lib/rack/ssl.rb in the rack-ssl gem before 1.4.0 for Ruby allows remote attackers to inject arbiRubyGems · rack-ssl · fixed in 1.4.0
- CVE-2013-4413Directory traversal vulnerability in controller/concerns/render_redirect.rb in the Wicked gem before 1.0.1 for Ruby allows remote attackers RubyGems · wicked · fixed in 1.0.1
- CVE-2014-0046Cross-site scripting (XSS) vulnerability in the link-to helper in Ember.js 1.2.x before 1.2.2, 1.3.x before 1.3.2, and 1.4.x before 1.4.0-beRubyGems · ember-source · fixed in 1.2.2, 1.3.2, 1.4.0.beta.6
- CVE-2014-0080SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/cast.rb in Active Record in Ruby on Rails 4.0.xRubyGems · activerecord · fixed in 4.0.3, 4.1.0.beta2
- CVE-2014-0081Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4RubyGems · actionpack, rails · fixed in 3.2.17, 4.0.3
- CVE-2014-0082actionpack/lib/action_view/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during uRubyGems · actionpack · fixed in 3.2.17
- CVE-2011-0528Puppet 2.6.0 through 2.6.3 does not properly restrict access to node resources, which allows remote authenticated Puppet nodes to read or moRubyGems · puppet · fixed in 2.6.4
- CVE-2014-1233The paratrooper-pingdom gem 1.0.0 for Ruby allows local users to obtain the App-Key, username, and password values by listing the curl proceRubyGems · paratrooper-pingdom
- CVE-2014-1234The paratrooper-newrelic gem 1.0.1 for Ruby allows local users to obtain the X-Api-Key value by listing the curl process.RubyGems · paratrooper-newrelic
- CVE-2013-2119Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application staRubyGems · passenger · fixed in 3.0.21, 4.0.5
- CVE-2013-7222config/initializers/secret_token.rb in Fat Free CRM before 0.12.1 has a fixed FatFreeCRM::Application.config.secret_token value, which makesRubyGems · fat_free_crm · fixed in 0.12.1
- CVE-2013-7223Multiple cross-site request forgery (CSRF) vulnerabilities in Fat Free CRM before 0.12.1 allow remote attackers to hijack the authenticationRubyGems · fat_free_crm · fixed in 0.12.1
- CVE-2013-7224Fat Free CRM before 0.12.1 does not restrict JSON serialization, which allows remote attackers to obtain sensitive information via a direct RubyGems · fat_free_crm · fixed in 0.12.1
- CVE-2013-7225Multiple SQL injection vulnerabilities in app/controllers/home_controller.rb in Fat Free CRM before 0.12.1 allow remote authenticated users RubyGems · fat_free_crm · fixed in 0.12.1
- CVE-2013-7249Fat Free CRM before 0.12.1 does not restrict XML serialization, which allows remote attackers to obtain sensitive information via a direct rRubyGems · fat_free_crm · fixed in 0.12.1
- CVE-2013-6459Cross-site scripting (XSS) vulnerability in the will_paginate gem before 3.0.5 for Ruby allows remote attackers to inject arbitrary web scriRubyGems · will_paginate · fixed in 3.0.5
- CVE-2013-7086The message function in lib/webbynode/notify.rb in the Webbynode gem 1.0.5.3 and earlier for Ruby allows context-dependent attackers to execRubyGems · webbynode
- CVE-2013-1812The ruby-openid gem before 2.2.2 for Ruby allows remote OpenID providers to cause a denial of service (CPU consumption) via (1) a large XRDSRubyGems · ruby-openid · fixed in 2.2.2
- CVE-2013-6421The unpack_zip function in archive_unpacker.rb in the sprout gem 0.7.246 for Ruby allows context-dependent attackers to execute arbitrary coRubyGems · sprout
- CVE-2013-4478Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the filenamRubyGems · sup · fixed in 0.13.2.1, 0.14.1.1
- CVE-2013-4479lib/sup/message_chunks.rb in Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell RubyGems · sup · fixed in 0.13.2.1, 0.14.1.1
- CVE-2013-4491Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/translation_helper.rb in the internationalization component iRubyGems · actionpack · fixed in 3.2.16, 4.0.2
- CVE-2013-4492Cross-site scripting (XSS) vulnerability in exceptions.rb in the i18n gem before 0.6.6 for Ruby allows remote attackers to inject arbitrary RubyGems · i18n · fixed in 0.6.6
- CVE-2013-6414actionpack/lib/action_view/lookup_context.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers RubyGems · actionpack · fixed in 3.2.16, 4.0.2
- CVE-2013-6415Cross-site scripting (XSS) vulnerability in the number_to_currency helper in actionpack/lib/action_view/helpers/number_helper.rb in Ruby on RubyGems · actionpack · fixed in 3.2.16, 4.0.2
- CVE-2013-6416Cross-site scripting (XSS) vulnerability in the simple_format helper in actionpack/lib/action_view/helpers/text_helper.rb in Ruby on Rails 4RubyGems · actionpack · fixed in 4.0.2
- CVE-2013-6417actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences inRubyGems · actionpack · fixed in 3.2.16, 4.0.2