Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
lean-ruport allows local users to obtain sensitive information by listing the process CVE-2014-4998, GHSA-5g7f-p7jg-v6mv | High | 0.5% | 10 Jan, 2018 | RubyGems lean-ruport |
point-cli allows local users to obtain sensitive information by listing the process CVE-2014-4997, GHSA-mc8m-x6hf-cw2g | High | 0.5% | 10 Jan, 2018 | RubyGems point-cli |
VladTheEnterprising allows local users to write to arbitrary files via a symlink attack CVE-2014-4996, GHSA-x4vj-279x-qwf2 | Medium | 0.4% | 10 Jan, 2018 | RubyGems VladTheEnterprising |
VladTheEnterprising allows local users to obtain sensitive information by reading MySQL root password from temporary file CVE-2014-4995, GHSA-86cf-g34f-7462 | High | 0.3% | 10 Jan, 2018 | RubyGems VladTheEnterprising |
Gyazo allows local users to write arbitrary files CVE-2014-4994, GHSA-6x45-86q6-rcmr | Medium | 0.5% | 10 Jan, 2018 | RubyGems gyazo |
backup-agoddard and backup_checksum have Information Exposure vulnerability CVE-2014-4993, GHSA-wr5j-q359-6vr2 | High | 0.5% | 10 Jan, 2018 | RubyGems backup-agoddard RubyGems backup_checksum |
Cap-Strap gem for Ruby places credentials on the useradd command line CVE-2014-4992, GHSA-pcm6-g2qp-9gw8 | High | 0.5% | 10 Jan, 2018 | RubyGems cap-strap |
codders-dataset Process Table Local Plaintext Credential Disclosure CVE-2014-4991, GHSA-w9vv-fvw8-j6q3 | High | 0.5% | 10 Jan, 2018 | RubyGems codders-dataset |
Radiant CMS vulnerable to Cross-site Scripting CVE-2018-5216, GHSA-mvw8-v767-qhjm | Medium | 0.5% | 04 Jan, 2018 | RubyGems radiant |
net-ldap Improper Certificate Validation vulnerability CVE-2017-17718, GHSA-m7p8-9w66-9frm | Medium | 1.3% | 17 Dec, 2017 | RubyGems net-ldap |
Phusion Passenger information disclosure CVE-2017-16355, GHSA-cv3f-px9r-54hm | Medium | 0.4% | 14 Dec, 2017 | RubyGems passenger |
Fluentd Escape Sequence Injection Vulnerability CVE-2017-10906, GHSA-5jrp-w8fr-mrww | Critical | 4.6% | 08 Dec, 2017 | RubyGems fluentd |
Arbitrary file read vulnerability in yard server CVE-2017-17042, GHSA-gj4p-3wh3-2rmf | High | 2.9% | 28 Nov, 2017 | RubyGems yard |
Nokogiri gem, via libxml, is affected by DoS vulnerabilities CVE-2017-16932, GHSA-x2fm-93ww-ggvx | High | 6.5% | 23 Nov, 2017 | RubyGems nokogiri |
redis-store deserializes untrusted data CVE-2017-1000248, GHSA-2w67-526p-gm73 | Critical | 2.0% | 17 Nov, 2017 | RubyGems redis-store |
private_address_check contains Incomplete List of Disallowed Inputs CVE-2017-0909, GHSA-3v3c-r5v2-68ph | Critical | 2.0% | 16 Nov, 2017 | RubyGems private_address_check |
Gemirro Stored XSS in Gemspec "homepage" value CVE-2017-16833, GHSA-x7p2-x2j6-mwhr | Medium | 0.8% | 15 Nov, 2017 | RubyGems gemirro |
Recurly gem Server-Side Request Forgery in Resource#find method CVE-2017-0905, GHSA-x27v-x225-gq8g | Critical | 2.6% | 13 Nov, 2017 | RubyGems recurly |
private_address_check vulnerable to bypass of Resolv.getaddresses method CVE-2017-0904, GHSA-hxhj-hp9m-qwc4 | High | 2.4% | 13 Nov, 2017 | RubyGems private_address_check |
paperclip Server-Side Request Forgery vulnerability CVE-2017-0889, GHSA-5jcf-c5rg-rmm8 | Critical | 3.1% | 13 Nov, 2017 | RubyGems paperclip |
Geminabox contains Cross-site Scripting CVE-2017-16792, GHSA-653m-r33x-39ff | Medium | 1.1% | 13 Nov, 2017 | RubyGems geminabox |
yajl-ruby gem Denial of Service vulnerability CVE-2017-16516, GHSA-wwh7-4jw9-33x6 | High | 3.8% | 03 Nov, 2017 | RubyGems yajl-ruby |
Ox gem crashes due to a crafted input CVE-2017-15928, GHSA-pjj4-w39g-pw54 | High | 1.7% | 27 Oct, 2017 | RubyGems ox |
gollum and gollum-lib allow remote authenticated users to execute arbitrary code CVE-2014-9489, GHSA-q97v-764g-r2rp | High | 2.9% | 17 Oct, 2017 | RubyGems gollum RubyGems gollum-lib |
ccsv Double Free vulnerability CVE-2017-15364, GHSA-5gxp-c379-pj42 | Medium | 1.4% | 15 Oct, 2017 | RubyGems ccsv |
RubyGems vulnerable to Deserialization of Untrusted Data CVE-2017-0903, GHSA-mqwr-4qf2-2hcv | Critical | 15.9% | 11 Oct, 2017 | RubyGems rubygems-update |
http vulnerable to Exposure of Sensitive Information to an Unauthorized Actor CVE-2015-1828, GHSA-6wpv-cj6x-v3jw | Medium | 1.5% | 06 Oct, 2017 | RubyGems http |
Gem in a Box vulnerable to Cross-site Request Forgery CVE-2017-14683, GHSA-qwv2-2x8g-g43g | High | 0.5% | 25 Sep, 2017 | RubyGems geminabox |
Gem in a Box vulnerable to Cross-site Scripting CVE-2017-14506, GHSA-98hq-3qvg-pg78 | Medium | 0.7% | 25 Sep, 2017 | RubyGems geminabox |
ember-source vulnerable to Cross-site Scripting CVE-2015-1866, GHSA-mp78-r56v-45qc | Medium | 1.1% | 20 Sep, 2017 | RubyGems ember-source |
Ruby OpenSSL DoS Vulnerability CVE-2017-14033, GHSA-v6rp-3r3v-hf4p | High | 7.7% | 19 Sep, 2017 | RubyGems openssl |
WEBrick RCE Vulnerability CVE-2017-10784, GHSA-369m-2gv6-mw28 | High | 16.4% | 19 Sep, 2017 | RubyGems webrick |
Spina gem vulnerable to Cross-site request forgery (CSRF) vulnerability CVE-2015-4619, GHSA-2hxv-mx8x-mcj9 | High | 0.9% | 07 Sep, 2017 | RubyGems spina |
Tinfoil Devise-two-factor does not "burn" a successfully validated one-time password (OTP) CVE-2015-7225, GHSA-x489-jjwm-52g7 | Medium | 2.1% | 06 Sep, 2017 | RubyGems devise-two-factor |
RubyGems has Origin Validation Error vulnerability CVE-2017-0902, GHSA-73w7-6w9g-gc8w | High | 4.8% | 31 Aug, 2017 | RubyGems rubygems-update |
RubyGems may allow a maliciously crafted gem to overwrite files CVE-2017-0901, GHSA-pm9x-4392-2c2p | High | 29.4% | 31 Aug, 2017 | RubyGems rubygems-update |
RubyGems Improper Input Validation vulnerability CVE-2017-0900, GHSA-p7f2-rr42-m9xm | High | 8.5% | 31 Aug, 2017 | RubyGems rubygems-update |
RubyGems Code Injection vulnerability CVE-2017-0899, GHSA-7gcp-2gmq-w3xh | Critical | 11.1% | 31 Aug, 2017 | RubyGems rubygems-update |
open-uri-cached Gem for Ruby Unsafe Temporary File Creation Enables Code Execution CVE-2015-3649, GHSA-7m2w-9gw7-c3xp | High | 0.4% | 18 Aug, 2017 | RubyGems open-uri-cached |
rest-client Gem Vulnerable to Session Fixation CVE-2015-1820, GHSA-3fhf-6939-qg8p | Critical | 4.3% | 09 Aug, 2017 | RubyGems rest-client |
Safemode Gem Has Incomplete List of Disallowed Inputs CVE-2017-7540, GHSA-5vx5-9q73-wgp4 | Critical | 1.6% | 21 Jul, 2017 | RubyGems safemode |
Content Injection via TileJSON Name in mapbox.js CVE-2017-1000043, GHSA-q69p-5h74-w36f | Medium | 0.9% | 17 Jul, 2017 | RubyGems mapbox-rails npm mapbox.js |
Content Injection via TileJSON attribute in mapbox.js CVE-2017-1000042, GHSA-qr28-7j6p-9hmv | Medium | 0.9% | 17 Jul, 2017 | RubyGems mapbox-rails npm mapbox.js |
mixlib-archive Path Traversal vulnerability CVE-2017-1000026, GHSA-98wx-cw86-c97x | High | 1.9% | 17 Jul, 2017 | RubyGems mixlib-archive |
Missing Regex anchor in Rack-Cors allows malicious third party site to perform CORS request CVE-2017-11173, GHSA-2j9c-9vmv-7m39 | High | 2.3% | 13 Jul, 2017 | RubyGems rack-cors |
Logstash Logs Sensitive Information CVE-2016-10362, GHSA-3gg4-6hqg-2vjx | Medium | 1.1% | 16 Jun, 2017 | RubyGems logstash-core |
Logstash Logs Sensitive Information CVE-2016-1000221, GHSA-vcmm-ppqx-95ch | High | 1.8% | 16 Jun, 2017 | RubyGems logstash-core |
Mail Gem CRLF Injection vulnerability CVE-2015-9097, GHSA-q86f-fmqf-qrf6 | Medium | 3.4% | 12 Jun, 2017 | RubyGems mail |
cairo is vulnerable to denial of service due to a null pointer dereference CVE-2017-7475, GHSA-5v3f-73gv-x7x5 | Medium | 1.8% | 19 May, 2017 | RubyGems cairo |
Out-of-bounds read in nokogiri CVE-2017-9050, GHSA-8c56-cpmw-89x7 | High | 4.6% | 18 May, 2017 | RubyGems nokogiri |