Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-38037ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file.RubyGems · activesupport · fixed in 6.1.7.5, 7.0.7.1
- CVE-2023-28120There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input.RubyGems · activesupport · fixed in 7.0.4.3, 6.1.7.3
- CVE-2024-56733Password Pusher Allows Session Token Interception Leading to Potential HijackingRubyGems · pwpush
- CVE-2024-54133Possible Content Security Policy bypass in Action DispatchRubyGems · actionpack · fixed in 7.0.8.7, 7.1.5.1, 7.2.2.1 and more
- CVE-2024-53985Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0RubyGems · rails-html-sanitizer · fixed in 1.6.1
- CVE-2024-53987Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0RubyGems · rails-html-sanitizer · fixed in 1.6.1
- CVE-2024-53986Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0RubyGems · rails-html-sanitizer · fixed in 1.6.1
- CVE-2024-53988Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0RubyGems · rails-html-sanitizer · fixed in 1.6.1
- CVE-2024-53989Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0RubyGems · rails-html-sanitizer · fixed in 1.6.1
- CVE-2024-52796Password Pusher's rate limiter can be bypassed by forging proxy headersRubyGems · pwpush · fixed in 1.49.0
- CVE-2024-45594Decidim allows cross-site scripting (XSS) in the online or hybrid meeting embedsRubyGems · decidim-meetings · fixed in 0.28.3
- CVE-2024-43415Decidim-Awesome: SQL injection in AdminAccountabilityRubyGems · decidim-decidim_awesome · fixed in 0.10.3, 0.11.2
- CVE-2024-21510Versions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the X-Forwarded-Host (XRubyGems · sinatra · fixed in 4.1.0
- CVE-2024-49771MPXJ has a Potential Path Traversal VulnerabilityRubyGems · mpxj · fixed in 13.5.1
- CVE-2024-49761REXML ReDoS vulnerabilityRubyGems · rexml · fixed in 3.3.9
- CVE-2024-49376Autolab Has Misconfigured Reset Password PermissionsRubyGems · autolab · fixed in 3.0.1
- CVE-2024-48652Cross Site Scripting vulnerability in camaleon-cms v.2.7.5 allows remote attacker to execute arbitrary code via the content group name fieldRubyGems · camaleon_cms
- CVE-2024-47889Action Mailer has possible ReDoS vulnerability in block_formatRubyGems · actionmailer · fixed in 6.1.7.9, 7.0.8.5, 7.1.4.1 and more
- CVE-2024-47888Action Text has possible ReDoS vulnerability in plain_text_for_blockquote_nodeRubyGems · actiontext · fixed in 6.1.7.9, 7.0.8.5, 7.1.4.1 and more
- CVE-2024-47887Action Controller has possible ReDoS vulnerability in HTTP Token authenticationRubyGems · actionpack · fixed in 6.1.7.9, 7.0.8.5, 7.1.4.1 and more
- CVE-2024-41128Action Dispatch has possible ReDoS vulnerability in query parameter filteringRubyGems · actionpack · fixed in 6.1.7.9, 7.0.8.5, 7.1.4.1 and more
- CVE-2024-47529OpenC3 COSMOS uses clear text storage of password/token (`GHSL-2024-129`)RubyGems · openc3 · fixed in 5.19.0
- CVE-2024-46977OpenC3 COSMOS allows a path traversal via screen controller (`GHSL-2024-127`)RubyGems · openc3 · fixed in 5.19.0
- CVE-2024-43795OpenC3 COSMOS vulnerable to cross-site scripting in Login functionality (`GHSL-2024-128`)RubyGems · openc3 · fixed in 5.19.0
- CVE-2024-41673Decidim has a cross-site scripting vulnerability in the version control pageRubyGems · decidim · fixed in 0.27.8
- CVE-2024-46488sqlite-vec v0.1.1 was discovered to contain a heap buffer overflow via the npy_token_next function.RubyGems · sqlite-vec · fixed in 0.1.3
- CVE-2024-45614Header normalization allows for client to clobber proxy set headers in PumaRubyGems · puma · fixed in 5.6.9, 6.4.3
- CVE-2024-7254Stack overflow in Protocol Buffers Java LiteRubyGems · google-protobuf · fixed in 3.25.5, 4.27.5, 4.28.2
- CVE-2024-46987Arbitrary path traversal in Camaleon CMSRubyGems · camaleon_cms · fixed in 2.8.1
- CVE-2024-46986Arbitrary file write leading to RCE in Camaleon CMSRubyGems · camaleon_cms · fixed in 2.8.1