Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2013-1854The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by RubyGems · activerecord · fixed in 2.3.18, 3.1.12, 3.2.13
- CVE-2013-1855The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before RubyGems · actionpack · fixed in 2.3.18, 3.1.12, 3.2.13
- CVE-2013-1856The ActiveSupport::XmlMini_JDOM backend in lib/active_support/xml_mini/jdom.rb in the Active Support component in Ruby on Rails 3.0.x and 3.RubyGems · activesupport · fixed in 3.1.12, 3.2.13
- CVE-2013-1857The sanitize helper in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.RubyGems · actionpack · fixed in 2.3.18, 3.1.12, 3.2.13
- CVE-2011-4969Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to injRubyGems · jquery-rails · fixed in 1.0.16
- CVE-2013-1656Spree Commerce 1.0.x through 1.3.2 allows remote authenticated administrators to instantiate arbitrary Ruby objects and execute arbitrary coRubyGems · spree · fixed in 2.0.0.rc1
- CVE-2013-2506app/models/spree/user.rb in spree_auth_devise in Spree 1.1.x before 1.1.6, 1.2.x, and 1.3.x does not perform mass assignment safely when updRubyGems · spree_auth_devise · fixed in 3.0.5
- CVE-2012-5604The ldap_fluff gem for Ruby, as used in Red Hat CloudForms 1.1, when using Active Directory for authentication, allows remote attackers to bRubyGems · ldap_fluff · fixed in 0.4.0
- CVE-2012-6109lib/rack/multipart.rb in Rack before 1.1.4, 1.2.x before 1.2.6, 1.3.x before 1.3.7, and 1.4.x before 1.4.2 uses an incorrect regular expressRubyGems · rack · fixed in 1.1.4, 1.2.6, 1.3.7 and more
- CVE-2013-0162The diff_pp function in lib/gauntlet_rubyparser.rb in the ruby_parser gem 3.1.1 and earlier for Ruby allows local users to overwrite arbitraRubyGems · ruby_parser · fixed in 3.1.2
- CVE-2013-0183multipart/parser.rb in Rack 1.3.x before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to cause a denial of service (memory consumptiRubyGems · rack · fixed in 1.3.8, 1.4.3
- CVE-2013-0184Unspecified vulnerability in Rack::Auth::AbstractRequest in Rack 1.1.x before 1.1.5, 1.2.x before 1.2.7, 1.3.x before 1.3.9, and 1.4.x beforRubyGems · rack · fixed in 1.1.5, 1.2.7, 1.3.9 and more
- CVE-2013-0256darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows RubyGems · rdoc · fixed in 3.12.1
- CVE-2013-0269The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resourcRubyGems · json · fixed in 1.5.5, 1.6.8, 1.7.7
- CVE-2013-0276ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the attr_protectRubyGems · activerecord · fixed in 2.3.17, 3.1.11, 3.2.12
- CVE-2013-0277ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary cRubyGems · activerecord · fixed in 2.3.17, 3.1.0
- CVE-2013-0262rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended RubyGems · rack · fixed in 1.5.2, 1.4.5
- CVE-2013-0263Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allowsRubyGems · rack · fixed in 1.5.2, 1.4.5, 1.3.10 and more
- CVE-2013-0333lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data toRubyGems · activesupport · fixed in 2.3.16, 3.0.20
- CVE-2013-0155Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handlingRubyGems · activerecord · fixed in 3.0.19, 3.1.10, 3.2.11
- CVE-2013-0156active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.1RubyGems · actionpack · fixed in 2.3.15, 3.0.19, 3.1.10 and more
- CVE-2012-6496SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allowRubyGems · activerecord · fixed in 3.0.18, 3.1.9, 3.2.10 and more
- CVE-2012-6497The Authlogic gem for Ruby on Rails, when used with certain versions before 3.2.10, makes potentially unsafe find_by_id method calls, which RubyGems · authlogic · fixed in 3.3.0
- CVE-2012-3503The installation script in Katello 1.0 and earlier does not properly generate the Application.config.secret_token value, which causes each dRubyGems · katello · fixed in 1.0.6, 1.1.7
- CVE-2012-3463Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_tag_helper.rb in Ruby on Rails 3.x before 3.0.17, 3.1.x RubyGems · actionpack · fixed in 3.0.17, 3.1.8, 3.2.8
- CVE-2012-3464Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 3.0.17RubyGems · activesupport · fixed in 3.0.17, 3.1.8, 3.2.8 and more
- CVE-2012-3465Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/sanitize_helper.rb in the strip_tags helper in Ruby on Rails RubyGems · actionpack · fixed in 3.0.17, 3.1.8, 3.2.8 and more
- CVE-2010-5142chef-server-api/app/controllers/users.rb in the API in Chef before 0.9.0 does not require administrative privileges for the create, destroy,RubyGems · chef · fixed in 0.9.0
- CVE-2012-3424The decode_credentials method in actionpack/lib/action_controller/metal/http_authentication.rb in Ruby on Rails 3.x before 3.0.16, 3.1.x befRubyGems · actionpack · fixed in 3.0.16, 3.1.7, 3.2.7 and more
- CVE-2012-3408lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames withoRubyGems · puppet · fixed in 2.7.18