Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2012-3865Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise befoRubyGems · puppet · fixed in 2.6.17, 2.7.18
- CVE-2012-3866lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for last_run_report.yaml, whRubyGems · puppet · fixed in 2.7.18
- CVE-2012-3867lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properRubyGems · puppet · fixed in 2.6.17, 2.7.18
- CVE-2012-2139Directory traversal vulnerability in lib/mail/network/delivery_methods/file_delivery.rb in the Mail gem before 2.4.4 for Ruby allows remote RubyGems · mail · fixed in 2.4.4
- CVE-2012-2140The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) eRubyGems · mail · fixed in 2.4.3
- CVE-2012-1989telnet.rb in Puppet 2.7.x before 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows local users to overwrite arbiRubyGems · puppet · fixed in 2.7.13
- CVE-2012-2660actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly RubyGems · actionpack · fixed in 3.0.13, 3.1.5, 3.2.4 and more
- CVE-2012-2661The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement theRubyGems · activerecord · fixed in 3.0.13, 3.1.5, 3.2.4
- CVE-2012-2694actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly RubyGems · actionpack · fixed in 3.0.14, 3.1.6, 3.2.6
- CVE-2012-2695The Active Record component in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passiRubyGems · activerecord · fixed in 3.0.14, 3.1.6, 3.2.6 and more
- CVE-2012-2671The Rack::Cache rubygem 0.3.0 through 1.1 caches Set-Cookie and other sensitive headers, which allows attackers to obtain sensitive cookie iRubyGems · rack-cache · fixed in 1.2
- CVE-2012-1053The change_user method in the SUIDManager (lib/puppet/util/suidmanager.rb) in Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and PuppetRubyGems · puppet · fixed in 2.6.14, 2.7.11
- CVE-2012-1906Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses preRubyGems · puppet · fixed in 2.6.15, 2.7.13
- CVE-2012-1987Unspecified vulnerability in Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, anRubyGems · puppet · fixed in 2.6.15, 2.7.13
- CVE-2012-1988Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows rRubyGems · puppet · fixed in 2.6.15, 2.7.13
- CVE-2008-7310Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set thRubyGems · spree · fixed in 0.4.0
- CVE-2008-7311The session cookie store implementation in Spree 0.2.0 uses a hardcoded config.action_controller_session hash value (aka secret key), which RubyGems · spree · fixed in 0.4.0
- CVE-2012-1098Cross-site scripting (XSS) vulnerability in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attaRubyGems · activesupport · fixed in 3.0.12, 3.1.4, 3.2.2
- CVE-2012-1099Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_options_helper.rb in the select helper in Ruby on Rails RubyGems · actionpack · fixed in 3.0.12, 3.1.4, 3.2.2
- CVE-2011-5036Rack before 1.1.3, 1.2.x before 1.2.5, and 1.3.x before 1.3.6 computes hash values for form parameters without restricting the ability to trRubyGems · rack · fixed in 1.1.3, 1.2.5, 1.3.6
- CVE-2011-4319Cross-site scripting (XSS) vulnerability in the i18n translations helper method in Ruby on Rails 3.0.x before 3.0.11 and 3.1.x before 3.1.2,RubyGems · actionpack · fixed in 3.0.11, 3.1.2
- CVE-2011-3869Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to overwrite arbitrary files via a symlink attack on the .k5loRubyGems · puppet · fixed in 2.7.5, 2.6.11
- CVE-2011-3870Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to modify the permissions of arbitrary files via a symlink attRubyGems · puppet · fixed in 2.7.5, 2.6.11
- CVE-2011-3871Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in --edit mode, uses a predictable file name, which allows local usRubyGems · puppet · fixed in 2.7.5, 2.6.11
- CVE-2011-2929The template selection functionality in actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.10 and 3.1.x beforRubyGems · actionpack · fixed in 3.0.10
- CVE-2011-2930Multiple SQL injection vulnerabilities in the quote_table_name method in the ActiveRecord adapters in activerecord/lib/active_record/connectRubyGems · activerecord · fixed in 2.3.13, 3.0.10, 3.1.0.rc5
- CVE-2011-2931Cross-site scripting (XSS) vulnerability in the strip_tags helper in actionpack/lib/action_controller/vendor/html-scanner/html/node.rb in RuRubyGems · actionpack · fixed in 2.3.13, 3.0.10
- CVE-2011-2932Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails 2.x before 2.RubyGems · activesupport · fixed in 2.3.13, 3.0.10
- CVE-2011-3186CRLF injection vulnerability in actionpack/lib/action_controller/response.rb in Ruby on Rails 2.3.x before 2.3.13 allows remote attackers toRubyGems · actionpack · fixed in 2.3.13
- CVE-2011-3187The to_s method in actionpack/lib/action_dispatch/middleware/remote_ip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For headeRubyGems · actionpack · fixed in 2.3.13