Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Spree Improper Input Validation vulnerability CVE-2013-1656, GHSA-jxx8-v83v-rhw3 | Medium | Not scored | 24 Oct, 2017 | RubyGems spree |
Denial of service in ruby-openid CVE-2013-1812, GHSA-6c8p-qphv-668v | Medium | Not scored | 24 Oct, 2017 | RubyGems ruby-openid |
Active Record Improper Input Validation CVE-2013-1854, GHSA-3crr-9vmg-864v | Medium | Not scored | 24 Oct, 2017 | RubyGems activerecord |
actionpack Cross-site Scripting vulnerability CVE-2013-1855, GHSA-q759-hwvc-m3jg | Medium | Not scored | 24 Oct, 2017 | RubyGems actionpack |
activesupport Improper Input Validation vulnerability CVE-2013-1856, GHSA-9c2j-593q-3g82 | Medium | Not scored | 24 Oct, 2017 | RubyGems activesupport |
actionpack Cross-site Scripting vulnerability CVE-2013-1857, GHSA-j838-vfpq-fmf2 | Medium | Not scored | 24 Oct, 2017 | RubyGems actionpack |
ldoce Gem Arbitrary Command Execution CVE-2013-1911, GHSA-g266-3crh-h7gj | Medium | Not scored | 24 Oct, 2017 | RubyGems ldoce |
Script Injection in Show In Browser gem CVE-2013-2105, GHSA-9hx9-w2j6-rw76 | Medium | Not scored | 24 Oct, 2017 | RubyGems show_in_browser |
Phusion Passenger Denial of Service CVE-2013-2119, GHSA-9qj7-jvg4-qr2x | Medium | Not scored | 24 Oct, 2017 | RubyGems passenger |
insecure temporary directory usage in passenger CVE-2013-4136, GHSA-w6rc-q387-vpgq | Medium | Not scored | 24 Oct, 2017 | RubyGems passenger |
actionmailer email address processing causes Denial of service CVE-2013-4389, GHSA-rg5m-3fqp-6px8 | Medium | Not scored | 24 Oct, 2017 | RubyGems actionmailer |
Wicked gem contains Path traversal vulnerability CVE-2013-4413, GHSA-rprj-g6xc-p5gq | Medium | Not scored | 24 Oct, 2017 | RubyGems wicked |
Cocaine Gem OS Command Injection vulnerability CVE-2013-4457, GHSA-c43v-hrmg-56r4 | Medium | Not scored | 24 Oct, 2017 | RubyGems cocaine |
actionpack vulnerable to Cross-site Scripting CVE-2013-4491, GHSA-699m-mcjm-9cw8 | Medium | Not scored | 24 Oct, 2017 | RubyGems actionpack |
i18n gem Cross-site Scripting vulnerability CVE-2013-4492, GHSA-r5hc-9xx5-97rw | Medium | Not scored | 24 Oct, 2017 | RubyGems i18n |
omniauth-facebook Cross-Site Request Forgery vulnerability CVE-2013-4562, GHSA-cf36-985g-v73c | Medium | Not scored | 24 Oct, 2017 | RubyGems omniauth-facebook |
Puppet allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service CVE-2013-4761, GHSA-cj43-9h3w-v976 | Medium | Not scored | 24 Oct, 2017 | RubyGems puppet |
actionpack Improper Input Validation vulnerability CVE-2013-6414, GHSA-mpxf-gcw2-pw5q | Medium | Not scored | 24 Oct, 2017 | RubyGems actionpack |
actionpack vulnerable to Cross-site Scripting CVE-2013-6415, GHSA-6h5q-96hp-9jgm | Medium | Not scored | 24 Oct, 2017 | RubyGems actionpack |
actionpack Cross-site Scripting vulnerability CVE-2013-6416, GHSA-w37c-q653-qg95 | Medium | Not scored | 24 Oct, 2017 | RubyGems actionpack |
actionpack allows bypass of database-query restrictions CVE-2013-6417, GHSA-wpw7-wxjm-cw8r | Medium | Not scored | 24 Oct, 2017 | RubyGems actionpack |
will_paginate Cross-site Scripting vulnerability CVE-2013-6459, GHSA-8r6h-7x9g-xmw9 | Medium | Not scored | 24 Oct, 2017 | RubyGems will_paginate |
Exposure of Sensitive Information in bio-basespace-sdk CVE-2013-7111, GHSA-xwr3-fmgj-mmfr | Medium | Not scored | 24 Oct, 2017 | RubyGems bio-basespace-sdk |
rbovirt uses the rest-client gem with SSL verification disabled CVE-2014-0036, GHSA-ww79-8xwv-932x | Medium | Not scored | 24 Oct, 2017 | RubyGems rbovirt |
Array data injection vulnerability in activerecord CVE-2014-0080, GHSA-hqf9-rc9j-5fmj | Medium | Not scored | 24 Oct, 2017 | RubyGems activerecord |
Rails vulnerable to Cross-site Scripting CVE-2014-0081, GHSA-m46p-ggm5-5j83 | Medium | Not scored | 24 Oct, 2017 | RubyGems actionpack RubyGems rails |
actionpack Improper Input Validation vulnerability CVE-2014-0082, GHSA-7cgp-c3g7-qvrw | Medium | Not scored | 24 Oct, 2017 | RubyGems actionpack |
rack-ssl Cross-site Scripting vulnerability CVE-2014-2538, GHSA-v3rr-cph9-2g2q | Medium | Not scored | 24 Oct, 2017 | RubyGems rack-ssl |
facter, hiera, mcollective-client, and puppet affected by untrusted search path vulnerability CVE-2014-3248, GHSA-92v7-pq4h-58j5 | Medium | Not scored | 24 Oct, 2017 | RubyGems facter RubyGems hiera RubyGems mcollective-client RubyGems puppet |
actionpack vulnerable to Path Traversal CVE-2014-7818, GHSA-29gr-w57f-rpfw | Medium | Not scored | 24 Oct, 2017 | RubyGems actionpack |
sprockets vulnerable to Path Traversal CVE-2014-7819, GHSA-33pp-3763-mrfp | Medium | Not scored | 24 Oct, 2017 | RubyGems sprockets |
Directory traversal vulnerability in actionpack CVE-2014-7829, GHSA-h56m-vwxc-3qpw | Medium | Not scored | 24 Oct, 2017 | RubyGems actionpack |
sentry-raven allows remote attackers to cause a denial of service via a large exponent value in a scientific number CVE-2014-9490, GHSA-c9c5-9fpr-m882 | Medium | Not scored | 24 Oct, 2017 | RubyGems sentry-raven |
jquery-rails and jquery-ujs subject to Exposure of Sensitive Information CVE-2015-1840, GHSA-4whc-pp4x-9pf3 | Medium | Not scored | 24 Oct, 2017 | RubyGems jquery-rails RubyGems jquery-ujs |
paperclip Cross-site Scripting vulnerability CVE-2015-2963, GHSA-6jvm-3j5h-79f6 | Medium | Not scored | 24 Oct, 2017 | RubyGems paperclip |
Web Console (Ruby gem) contains whitelisted_ips bypass CVE-2015-3224, GHSA-67j6-xv27-w6ww | Medium | Not scored | 24 Oct, 2017 | RubyGems web-console |
Rack vulnerable to Denial of Service via large parameter depth request CVE-2015-3225, GHSA-rgr4-9jh5-j4j6 | Medium | Not scored | 24 Oct, 2017 | RubyGems rack |
activesupport Cross-site Scripting vulnerability CVE-2015-3226, GHSA-vxvp-4xwc-jpp6 | Medium | Not scored | 24 Oct, 2017 | RubyGems activesupport |
activesupport vulnerable to Denial of Service via large XML document depth CVE-2015-3227, GHSA-j96r-xvjq-r9pg | Medium | Not scored | 24 Oct, 2017 | RubyGems activesupport |
Active Record Improper Access Control CVE-2015-7577, GHSA-xrr6-3pc4-m447 | Medium | Not scored | 24 Oct, 2017 | RubyGems activerecord |
rails-html-sanitizer Cross-site Scripting vulnerability CVE-2015-7578, GHSA-59c7-4xj2-hgvw | Medium | Not scored | 24 Oct, 2017 | RubyGems rails-html-sanitizer |
rails-html-sanitizer Cross-site Scripting vulnerability CVE-2015-7579, GHSA-r9c2-cr39-c8g6 | Medium | Not scored | 24 Oct, 2017 | RubyGems rails-html-sanitizer |
rails-html-sanitizer Cross-site Scripting vulnerability CVE-2015-7580, GHSA-ghqm-pgxj-37gq | Medium | Not scored | 24 Oct, 2017 | RubyGems rails-html-sanitizer |
Mail Gem CRLF Injection vulnerability CVE-2015-9097, GHSA-q86f-fmqf-qrf6 | Medium | Not scored | 24 Oct, 2017 | RubyGems mail |
activemodel contains Improper Input Validation CVE-2016-0753, GHSA-543v-gj2c-r3ch | Medium | Not scored | 24 Oct, 2017 | RubyGems activemodel |
actionview contains Path Traversal vulnerability CVE-2016-2097, GHSA-vx9j-46rh-fqr8 | Medium | Not scored | 24 Oct, 2017 | RubyGems actionpack RubyGems actionview |
rack-mini-profiler allows remote attackers to obtain sensitive information about allocated strings and objects CVE-2016-4442, GHSA-j5hj-fhc9-g24m | Medium | Not scored | 24 Oct, 2017 | RubyGems rack-mini-profiler |
actionview Cross-site Scripting vulnerability CVE-2016-6316, GHSA-pc3m-v286-2jwj | Medium | Not scored | 24 Oct, 2017 | RubyGems actionview |
Content Injection via TileJSON Name in mapbox.js CVE-2017-1000043, GHSA-q69p-5h74-w36f | Medium | 0.9% | 17 Jul, 2017 | RubyGems mapbox-rails npm mapbox.js |
Content Injection via TileJSON attribute in mapbox.js CVE-2017-1000042, GHSA-qr28-7j6p-9hmv | Medium | 0.9% | 17 Jul, 2017 | RubyGems mapbox-rails npm mapbox.js |