Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2013-4457The Cocaine gem 0.4.0 through 0.5.2 for Ruby allows context-dependent attackers to execute arbitrary commands via a crafted has object, relaRubyGems · cocaine · fixed in 0.5.3
- CVE-2013-4287Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 throughRubyGems · rubygems-update · fixed in 1.8.23.1, 1.8.26, 2.0.8 and more
- CVE-2013-4363Algorithmic complexity vulnerability in Gem::Version::ANCHORED_VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.2, 1.8.2RubyGems · rubygems-update · fixed in 1.8.23.2, 1.8.27, 2.0.10 and more
- CVE-2013-4389Multiple format string vulnerabilities in log_subscriber.rb files in the log subscriber component in Action Mailer in Ruby on Rails 3.x befoRubyGems · actionmailer · fixed in 3.2.15
- CVE-2013-4203The self.run_gpg function in lib/rgpg/gpg_helper.rb in the rgpg gem before 0.2.3 for Ruby allows remote attackers to execute arbitrary commaRubyGems · rgpg · fixed in 0.2.3
- CVE-2012-2125RubyGems before 1.8.23 can redirect HTTPS connections to HTTP, which makes it easier for remote attackers to observe or modify a gem during RubyGems · rubygems-update · fixed in 1.8.23
- CVE-2012-2126RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers to modify a gem during installation via a man-in-thRubyGems · rubygems-update · fixed in 1.8.23
- CVE-2013-4136ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the oRubyGems · passenger · fixed in 4.0.6
- CVE-2013-5647lib/sounder/sound.rb in the sounder gem 1.0.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a fRubyGems · sounder · fixed in 1.0.2
- CVE-2013-4761Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.RubyGems · puppet · fixed in 2.7.23, 3.2.4
- CVE-2013-3567Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attaRubyGems · puppet · fixed in 2.7.22, 3.2.2
- CVE-2013-0175multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, RubyGems · multi_xml · fixed in 0.5.2
- CVE-2013-0233Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does nRubyGems · devise · fixed in 2.2.3, 2.1.3, 2.0.5 and more
- CVE-2013-1933The extract_from_ocr function in lib/docsplit/text_extractor.rb in the Karteek Docsplit (karteek-docsplit) gem 0.5.4 for Ruby allows contextRubyGems · karteek-docsplit
- CVE-2013-1947kelredd-pruview gem 0.3.8 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename aRubyGems · kelredd-pruview
- CVE-2013-1948converter.rb in the md2pdf gem 0.0.1 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in aRubyGems · md2pdf
- CVE-2013-3221The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database columnRubyGems · activerecord · fixed in 4.2.0
- CVE-2012-6134Cross-site request forgery (CSRF) vulnerability in the omniauth-oauth2 gem 1.1.1 and earlier for Ruby allows remote attackers to hijack the RubyGems · omniauth-oauth2 · fixed in 1.1.1
- CVE-2013-0284Ruby agent 3.2.0 through 3.5.2 serializes sensitive data when communicating with servers operated by New Relic, which allows remote attackerRubyGems · newrelic_rpm · fixed in 3.5.3.24
- CVE-2013-0285The nori gem 2.0.x before 2.0.2, 1.1.x before 1.1.4, and 1.0.x before 1.0.3 for Ruby does not properly restrict casts of string values, whicRubyGems · nori · fixed in 2.0.2, 1.1.4, 1.0.3
- CVE-2013-1800The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct obRubyGems · crack · fixed in 0.3.2
- CVE-2013-1801The httparty gem 0.9.0 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conductRubyGems · httparty · fixed in 0.10.0
- CVE-2013-1802The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct RubyGems · extlib · fixed in 0.9.16
- CVE-2013-1898lib/thumbshooter.rb in the Thumbshooter 0.1.5 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters inRubyGems · thumbshooter
- CVE-2013-1911lib/ldoce/word.rb in the ldoce 0.0.2 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in (1) an mRubyGems · ldoce
- CVE-2013-1875command_wrap.rb in the command_wrap Gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL or RubyGems · command_wrap
- CVE-2013-2615lib/entry_controller.rb in the fastreader Gem 1.0.8 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters RubyGems · fastreader
- CVE-2013-2616lib/mini_magick.rb in the MiniMagick Gem 1.3.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a RubyGems · mini_magick · fixed in 3.6.0
- CVE-2013-2617lib/curl.rb in the Curl Gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.RubyGems · curl
- CVE-2013-1655Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vRubyGems · puppet · fixed in 2.7.21, 3.1.1