Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
RuboCop gem Insecure use of /tmp CVE-2017-8418, GHSA-wmjf-jpjj-9f3j | Low | 0.4% | 02 May, 2017 | RubyGems rubocop |
rack-mini-profiler allows remote attackers to obtain sensitive information about allocated strings and objects CVE-2016-4442, GHSA-j5hj-fhc9-g24m | Medium | 1.6% | 02 May, 2017 | RubyGems rack-mini-profiler |
smalruby and smalruby-editor vulnerable to OS Command Injection CVE-2017-2096, GHSA-f489-655r-x6gr | Critical | 6.2% | 28 Apr, 2017 | RubyGems smalruby RubyGems smalruby-editor |
Nokogiri implementation of libxslt lacks integer overflow checks CVE-2017-5029, GHSA-pf6m-fxpq-fg8v | High | 2.5% | 24 Apr, 2017 | RubyGems nokogiri |
Aescrypt does not sufficiently use random values CVE-2013-7463, GHSA-4c4w-3q45-hp9j | High | 1.1% | 19 Apr, 2017 | RubyGems aescrypt |
Phusion Passenger uses a known /tmp filename CVE-2016-10345, GHSA-cqxw-3p7v-p9gr | High | 0.5% | 18 Apr, 2017 | RubyGems passenger |
ember-source Cross-site Scripting vulnerability CVE-2015-7565, GHSA-m3q7-rj8g-m457 | Medium | 0.8% | 13 Apr, 2017 | RubyGems ember-source |
jQuery-UI vulnerable to Cross-site Scripting in dialog closeText CVE-2016-7103, GHSA-hpcf-8vf9-q4gj | Medium | 29.2% | 15 Mar, 2017 | Maven org.webjars.npm:jquery-ui NuGet jQuery.UI.Combined RubyGems jquery-ui-rails npm jquery-ui |
festivaltts4r allows arbitrary command execution CVE-2016-10194, GHSA-f7f4-5w9j-23p2 | Critical | 2.5% | 03 Mar, 2017 | RubyGems festivaltts4r |
espeak-ruby allows arbitrary command execution CVE-2016-10193, GHSA-4jm3-pfpf-h54p | Critical | 2.4% | 03 Mar, 2017 | RubyGems espeak-ruby |
Directory traversal vulnerability in RubyZip CVE-2017-5946, GHSA-gcqq-w6gr-h9j9 | Critical | 3.4% | 27 Feb, 2017 | RubyGems rubyzip |
archive-tar-minitar and minitar vulnerable to Path Traversal CVE-2016-10173, GHSA-h5g2-38x9-4gv3 | High | 4.7% | 01 Feb, 2017 | RubyGems archive-tar-minitar RubyGems minitar |
OpenSSL gem for Ruby using inadequate encryption strength CVE-2016-7798, GHSA-6h88-qjpv-p32m | High | 3.2% | 30 Jan, 2017 | RubyGems openssl |
Doorkeeper is vulnerable to replay attacks CVE-2016-6582, GHSA-3m6r-39p3-jq25 | Critical | 4.8% | 23 Jan, 2017 | RubyGems doorkeeper |
Ruby-saml allows attackers to perform XML signature wrapping attacks CVE-2016-5697, GHSA-36p7-xjw8-h6f2 | High | 1.2% | 23 Jan, 2017 | RubyGems ruby-saml |
Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js CVE-2015-8857, GHSA-34r7-q49f-h37c | Critical | 3.6% | 23 Jan, 2017 | RubyGems uglifier npm uglify-js |
Bundler allows attacker to inject arbitrary code via secondary Gem source CVE-2016-7954, GHSA-jvgm-pfqv-887x | Critical | 8.8% | 22 Dec, 2016 | RubyGems bundler |
Git-fastclone passes user modifiable strings directly to a shell command CVE-2015-8969, GHSA-mf6w-45cf-qhmp | Critical | 4.8% | 03 Nov, 2016 | RubyGems git-fastclone |
git-fastclone permits arbitrary shell command execution from .gitmodules CVE-2015-8968, GHSA-8gg6-3r63-25m8 | High | 5.2% | 03 Nov, 2016 | RubyGems git-fastclone |
Nokogiri does not forbid namespace nodes in XPointer ranges CVE-2016-4658, GHSA-fr52-4hqw-p27f | Critical | 8.6% | 25 Sep, 2016 | RubyGems nokogiri |
ActiveRecord in Ruby on Rails allows database-query bypass CVE-2016-6317, GHSA-pr3r-4wrp-r2pv | High | 3.9% | 07 Sep, 2016 | RubyGems activerecord |
actionview Cross-site Scripting vulnerability CVE-2016-6316, GHSA-pc3m-v286-2jwj | Medium | 3.4% | 07 Sep, 2016 | RubyGems actionview |
Puppet Improper Access Control CVE-2016-2785, GHSA-pqj5-7r86-64fv | Critical | 2.9% | 10 Jun, 2016 | RubyGems puppet |
Katello SQL Injection vulnerabilities CVE-2016-3072, GHSA-527r-mfmj-prqf | High | 1.8% | 07 Jun, 2016 | RubyGems katello |
safemode gem allows context-dependent attackers to obtain sensitive information via the inspect method CVE-2016-3693, GHSA-c92m-rrrc-q5wf | High | 2.1% | 20 May, 2016 | RubyGems safemode |
Denial of service or RCE from libxml2 and libxslt CVE-2015-8806, GHSA-7hp2-xwpj-95jq | High | 5.0% | 13 Apr, 2016 | RubyGems nokogiri |
actionpack allows remote code execution via application's unrestricted use of render method CVE-2016-2098, GHSA-78rc-8c29-p45g | High | 81.4% | 07 Apr, 2016 | RubyGems actionpack |
actionview contains Path Traversal vulnerability CVE-2016-2097, GHSA-vx9j-46rh-fqr8 | Medium | 4.4% | 07 Apr, 2016 | RubyGems actionpack RubyGems actionview |
activemodel contains Improper Input Validation CVE-2016-0753, GHSA-543v-gj2c-r3ch | Medium | 7.2% | 16 Feb, 2016 | RubyGems activemodel |
Directory traversal vulnerability in Action View in Ruby on Rails CVE-2016-0752, GHSA-xrr4-p6fq-hjg7 | HighExploited | 95.5% | 16 Feb, 2016 | RubyGems actionpack RubyGems actionview |
actionpack is vulnerable to denial of service via a crafted HTTP Accept header CVE-2016-0751, GHSA-ffpv-c4hm-3x6v | High | 9.7% | 16 Feb, 2016 | RubyGems actionpack |
actionpack is vulnerable to denial of service because of a wildcard controller route CVE-2015-7581, GHSA-9h6g-gp95-x3q5 | High | 6.7% | 16 Feb, 2016 | RubyGems actionpack |
rails-html-sanitizer Cross-site Scripting vulnerability CVE-2015-7580, GHSA-ghqm-pgxj-37gq | Medium | 2.2% | 16 Feb, 2016 | RubyGems rails-html-sanitizer |
rails-html-sanitizer Cross-site Scripting vulnerability CVE-2015-7579, GHSA-r9c2-cr39-c8g6 | Medium | 2.6% | 16 Feb, 2016 | RubyGems rails-html-sanitizer |
rails-html-sanitizer Cross-site Scripting vulnerability CVE-2015-7578, GHSA-59c7-4xj2-hgvw | Medium | 2.5% | 16 Feb, 2016 | RubyGems rails-html-sanitizer |
Active Record Improper Access Control CVE-2015-7577, GHSA-xrr6-3pc4-m447 | Medium | 4.3% | 16 Feb, 2016 | RubyGems activerecord |
actionpack is vulnerable to remote bypass authentication CVE-2015-7576, GHSA-p692-7mm3-3fxg | Low | 4.9% | 16 Feb, 2016 | RubyGems actionpack |
colorscore Command Injection vulnerability CVE-2015-7541, GHSA-73qw-ww62-m54x | Critical | 3.5% | 08 Jan, 2016 | RubyGems colorscore |
Phusion Passenger allows remote attackers to spoof headers CVE-2015-7519, GHSA-fxwv-953p-7qpf | Low | 2.4% | 08 Jan, 2016 | RubyGems passenger |
Heap-based buffer overflow in nokogiri CVE-2015-7499, GHSA-jxjr-5h69-qw3w | Medium | 6.4% | 15 Dec, 2015 | RubyGems nokogiri |
Nokogiri subject to DoS via libxml2 vulnerability CVE-2015-5312, GHSA-xjqg-9jvg-fgx2 | High | 4.5% | 15 Dec, 2015 | RubyGems nokogiri |
Gollum Exposure of Sensitive Information CVE-2015-7314, GHSA-m2q3-53fq-7h66 | Medium | 1.9% | 06 Oct, 2015 | RubyGems gollum |
RubyGems Improper Input Validation vulnerability CVE-2015-4020, GHSA-qv62-xfj6-32xm | Medium | 3.5% | 25 Aug, 2015 | RubyGems rubygems-update |
Nokogiri vulnerable to libxml XML Entity Expansion CVE-2015-1819, GHSA-q7wx-62r7-j2x7 | Medium | 6.3% | 14 Aug, 2015 | RubyGems nokogiri |
activesupport vulnerable to Denial of Service via large XML document depth CVE-2015-3227, GHSA-j96r-xvjq-r9pg | Medium | 4.2% | 26 Jul, 2015 | RubyGems activesupport |
activesupport Cross-site Scripting vulnerability CVE-2015-3226, GHSA-vxvp-4xwc-jpp6 | Medium | 2.8% | 26 Jul, 2015 | RubyGems activesupport |
Rack vulnerable to Denial of Service via large parameter depth request CVE-2015-3225, GHSA-rgr4-9jh5-j4j6 | Medium | 7.9% | 26 Jul, 2015 | RubyGems rack |
Web Console (Ruby gem) contains whitelisted_ips bypass CVE-2015-3224, GHSA-67j6-xv27-w6ww | Medium | 48.8% | 26 Jul, 2015 | RubyGems web-console |
jquery-rails and jquery-ujs subject to Exposure of Sensitive Information CVE-2015-1840, GHSA-4whc-pp4x-9pf3 | Medium | 4.5% | 26 Jul, 2015 | RubyGems jquery-rails RubyGems jquery-ujs |
redcarpet Buffer Overflow vulnerability CVE-2015-5147, GHSA-7322-9mx6-5j2m | High | 2.5% | 14 Jul, 2015 | RubyGems redcarpet |