Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2011-2197The cross-site scripting (XSS) prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does noRubyGems · actionpack, activesupport · fixed in 2.3.12, 3.0.8
- CVE-2011-0995The sqlite3-ruby gem in the rubygem-sqlite3 package before 1.2.4-0.5.1 in SUSE Linux Enterprise (SLE) 11 SP1 uses weak permissions for unspeRubyGems · sqlite3-ruby · fixed in 1.2.4
- CVE-2011-0449actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is used, does not prRubyGems · actionpack · fixed in 3.0.4
- CVE-2011-0448Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit function specify integer values, which makes it easier for remoRubyGems · activerecord · fixed in 3.0.4
- CVE-2011-0446Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascrRubyGems · actionpack, actionview · fixed in 2.3.11, 3.0.4
- CVE-2011-0447Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-RequesRubyGems · actionpack · fixed in 2.3.11, 3.0.4
- CVE-2011-0739The deliver function in the sendmail delivery agent (lib/mail/network/delivery_methods/sendmail.rb) in Ruby Mail gem 2.2.14 and earlier alloRubyGems · mail · fixed in 2.2.15
- CVE-2010-3978Spree 0.11.x before 0.11.2 and 0.30.x before 0.30.0 exchanges data using JavaScript Object Notation (JSON) without a mechanism for validatinRubyGems · spree · fixed in 0.11.2, 0.30.0
- CVE-2010-3933Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changRubyGems · activerecord · fixed in 2.3.10, 3.0.1
- CVE-2010-0156Puppet 0.24.x before 0.24.9 and 0.25.x before 0.25.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/daRubyGems · puppet · fixed in 0.24.9, 0.25.2
- CVE-2009-4492WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel 248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev writeRubyGems · webrick · fixed in 1.4.0
- CVE-2008-7248Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote atRubyGems · actionpack · fixed in 2.1.3, 2.2.2
- CVE-2009-4214Cross-site scripting (XSS) vulnerability in the strip_tags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attRubyGems · rails · fixed in 2.2.2, 2.3.5
- CVE-2009-3287lib/thin/connection.rb in Thin web server before 1.2.4 relies on the X-Forwarded-For header to determine the IP address of the client, whichRubyGems · thin · fixed in 1.2.4
- CVE-2009-3009Cross-site scripting (XSS) vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject arbitrRubyGems · actionpack, activesupport · fixed in 2.2.3, 2.3.4
- CVE-2009-3086A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, leaks information about the complexity of message-digest sRubyGems · actionpack, activesupport · fixed in 2.2.3, 2.3.4
- CVE-2009-2422The example code for the digest authentication functionality (http_authentication.rb) in Ruby on Rails before 2.3.3 defines an authenticate_RubyGems · rails · fixed in 2.3.3
- CVE-2008-4310httputils.rb in WEBrick in Ruby 1.8.1 and 1.8.5, as used in Red Hat Enterprise Linux 4 and 5, allows remote attackers to cause a denial of sRubyGems · webrick · fixed in 1.3.1
- CVE-2008-5189CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP responsRubyGems · rails · fixed in 2.0.5
- CVE-2008-4094Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) :lRubyGems · activerecord · fixed in 2.1.1
- CVE-2007-6612Directory traversal vulnerability in DirHandler (lib/mongrel/handlers.rb) in Mongrel 1.0.4 and 1.1.x before 1.1.3 allows remote attackers toRubyGems · mongrel · fixed in 1.0.5, 1.1.3
- CVE-2007-6183Format string vulnerability in the mdiag_initialize function in gtk/src/rbgtkmessagedialog.c in Ruby-GNOME 2 (aka Ruby/Gnome2) 0.16.0, and SRubyGems · gtk2 · fixed in 0.17.0
- CVE-2007-6077The session fixation protection mechanism in cgi_process.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookie_only attribute froRubyGems · rails · fixed in 1.2.6
- CVE-2007-5379Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary fiRubyGems · rails · fixed in 1.2.4
- CVE-2007-5380Session fixation vulnerability in Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers to hijack web sessions via unspecifRubyGems · rails · fixed in 1.2.4
- CVE-2007-3227Cross-site scripting (XSS) vulnerability in the to_json (ActiveRecord::Base#to_json) function in Ruby on Rails before edge 9606 allows remotRubyGems · rails · fixed in 1.2.5
- CVE-2007-0469The extract_files function in installer.rb in RubyGems before 0.9.1 does not check whether files exist before overwriting them, which allowsRubyGems · rubygems-update · fixed in 0.9.1
- CVE-2006-4111Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with "severe" or "serious" impact via a File Upload request with an RubyGems · rails · fixed in 1.1.6
- CVE-2006-4112Unspecified vulnerability in the "dependency resolution mechanism" in Ruby on Rails 1.1.0 through 1.1.5 allows remote attackers to execute aRubyGems · rails · fixed in 1.1.6
- CVE-2006-2582The editing form in RWiki 2.1.0pre1 through 2.1.0 allows remote attackers to execute arbitrary Ruby code via unknown attack vectors.RubyGems · rwiki · fixed in 2.1.1