Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
paperclip Cross-site Scripting vulnerability CVE-2015-2963, GHSA-6jvm-3j5h-79f6 | Medium | 2.1% | 10 Jul, 2015 | RubyGems paperclip |
RubyGems vulnerable to DNS hijack attack CVE-2015-3900, GHSA-wp3j-rvfp-624h | High | 8.9% | 24 Jun, 2015 | RubyGems rubygems-update |
rest-client allows local users to obtain sensitive information by reading the log CVE-2015-3448, GHSA-mx9f-w8qq-q5jf | Low | 0.4% | 29 Apr, 2015 | RubyGems rest-client |
Puppet Labs Facter allows local users to obtain sensitive Amazon EC2 IAM instance metadata CVE-2015-1426, GHSA-j436-h7hm-rx46 | Low | 0.4% | 23 Feb, 2015 | RubyGems facter |
Fat Free CRM Cross-Site Request Forgery vulnerability CVE-2015-1585, GHSA-wx7c-8j35-mpg8 | Medium | 1.1% | 19 Feb, 2015 | RubyGems fat_free_crm |
Insecure use of temporary files in Phusion passenger CVE-2014-1832, GHSA-qw8w-2xcp-xg59 | Low | 0.4% | 19 Feb, 2015 | RubyGems passenger |
Insecure use of temporary files in passenger CVE-2014-1831, GHSA-c7j7-p5jq-26ff | Low | 0.4% | 19 Feb, 2015 | RubyGems passenger |
sentry-raven allows remote attackers to cause a denial of service via a large exponent value in a scientific number CVE-2014-9490, GHSA-c9c5-9fpr-m882 | Medium | 2.4% | 20 Jan, 2015 | RubyGems sentry-raven |
RedCloth Cross-site Scripting vulnerability CVE-2012-6684, GHSA-r23g-3qw4-gfh2 | Medium | 2.3% | 08 Jan, 2015 | RubyGems RedCloth |
Doorkeeper vulnerable to Cross-site Request Forgery CVE-2014-8144, GHSA-685w-vc84-wxcx | Medium | 0.7% | 31 Dec, 2014 | RubyGems doorkeeper |
jquery-ui Tooltip widget vulnerable to XSS CVE-2012-6662, GHSA-qqxp-xp9v-vvx6 | Medium | 7.5% | 24 Nov, 2014 | Maven org.webjars.npm:jquery-ui NuGet jQuery.UI.Combined RubyGems jquery-ui-rails npm jquery-ui |
Cross-site Scripting in jquery-ui CVE-2010-5312, GHSA-wcm2-9c89-wmfm | Medium | 18.4% | 24 Nov, 2014 | Maven org.webjars.npm:jquery-ui NuGet jQuery.UI.Combined RubyGems jquery-ui-rails npm jquery-ui |
Directory traversal vulnerability in actionpack CVE-2014-7829, GHSA-h56m-vwxc-3qpw | Medium | 4.2% | 18 Nov, 2014 | RubyGems actionpack |
facter, hiera, mcollective-client, and puppet affected by untrusted search path vulnerability CVE-2014-3248, GHSA-92v7-pq4h-58j5 | Medium | 0.5% | 16 Nov, 2014 | RubyGems facter RubyGems hiera RubyGems mcollective-client RubyGems puppet |
sprockets vulnerable to Path Traversal CVE-2014-7819, GHSA-33pp-3763-mrfp | Medium | 3.9% | 08 Nov, 2014 | RubyGems sprockets |
actionpack vulnerable to Path Traversal CVE-2014-7818, GHSA-29gr-w57f-rpfw | Medium | 3.5% | 08 Nov, 2014 | RubyGems actionpack |
Bundler may install gems from a different source than expected CVE-2013-0334, GHSA-49jx-9cmc-xjxm | Medium | 4.3% | 31 Oct, 2014 | RubyGems bundler |
Fat Free CRM subject to Cross-site Scripting CVE-2014-5441, GHSA-wcfx-3m6v-4frg | Medium | 1.9% | 12 Sep, 2014 | RubyGems fat_free_crm |
Active Record subject to strong parameters protection bypass CVE-2014-3514, GHSA-9rf5-jm6f-2fmm | High | 2.8% | 20 Aug, 2014 | RubyGems activerecord |
Elasticsearch Logstash allows remote attackers to execute arbitrary commands CVE-2014-4326, GHSA-8qhq-rq4j-8prj | High | 3.3% | 22 Jul, 2014 | RubyGems logstash |
Active Record contains SQL Injection via improper range quoting CVE-2014-3483, GHSA-r8fh-hq2p-7qhq | High | 4.2% | 07 Jul, 2014 | RubyGems activerecord |
SQL Injection in Active Record CVE-2014-3482, GHSA-mhwp-qhpc-h3jm | High | 4.3% | 07 Jul, 2014 | RubyGems activerecord |
Dragonfly Code Injection vulnerability CVE-2013-1756, GHSA-p463-639r-q9g9 | High | 3.7% | 09 Jun, 2014 | RubyGems dragonfly |
Hub Package Arbitrary File Overwrite CVE-2014-0177, GHSA-x5m6-jh4r-34mv | Medium | 0.4% | 27 May, 2014 | Go github.com/github/hub RubyGems hub |
Creme Fraiche contains OS Command Injection CVE-2013-2090, GHSA-m6f7-46hw-grcj | Critical | 4.2% | 27 May, 2014 | RubyGems cremefraiche |
GitLab Grit Gem for Ruby contains a flaw allowing arbitrary commands to be executed CVE-2013-4489, GHSA-95xq-v4m2-fq3r | Medium | 1.4% | 17 May, 2014 | RubyGems gitlab-grit |
omniauth-facebook Cross-Site Request Forgery vulnerability CVE-2013-4562, GHSA-cf36-985g-v73c | Medium | 1.2% | 13 May, 2014 | RubyGems omniauth-facebook |
Code injection in dragonfly gem CVE-2013-5671, GHSA-qrgf-jqqm-x7xv | High | 2.2% | 12 May, 2014 | RubyGems dragonfly RubyGems fog-dragonfly |
Kafo allows local users to obtain passwords and other sensitive information by reading default_values.yaml CVE-2014-0135, GHSA-hxvp-655x-xxqv | Low | 0.3% | 08 May, 2014 | RubyGems kafo |
actionpack Path Traversal vulnerability CVE-2014-0130, GHSA-6x85-j5j2-27jx | HighExploited | 53.7% | 07 May, 2014 | RubyGems actionpack |
Arabic Prawn allows remote attackers to execute arbitrary commands via shell metacharacters CVE-2014-2322, GHSA-hgmw-x865-hf9x | High | 2.2% | 02 May, 2014 | RubyGems Arabic-Prawn |
Exposure of Sensitive Information in bio-basespace-sdk CVE-2013-7111, GHSA-xwr3-fmgj-mmfr | Medium | 1.5% | 29 Apr, 2014 | RubyGems bio-basespace-sdk |
sfpagent Command Injection vulnerability CVE-2014-2888, GHSA-vm28-mrm7-fpjq | High | 2.2% | 23 Apr, 2014 | RubyGems sfpagent |
Script Injection in Show In Browser gem CVE-2013-2105, GHSA-9hx9-w2j6-rw76 | Medium | 0.4% | 22 Apr, 2014 | RubyGems show_in_browser |
rbovirt uses the rest-client gem with SSL verification disabled CVE-2014-0036, GHSA-ww79-8xwv-932x | Medium | 2.0% | 17 Apr, 2014 | RubyGems rbovirt |
rack-ssl Cross-site Scripting vulnerability CVE-2014-2538, GHSA-v3rr-cph9-2g2q | Medium | 2.2% | 25 Mar, 2014 | RubyGems rack-ssl |
Wicked gem contains Path traversal vulnerability CVE-2013-4413, GHSA-rprj-g6xc-p5gq | Medium | 3.0% | 11 Mar, 2014 | RubyGems wicked |
ember-source Cross-site Scripting vulnerability CVE-2014-0046, GHSA-4q53-fqhc-cr46 | Low | 1.5% | 27 Feb, 2014 | RubyGems ember-source |
actionpack Improper Input Validation vulnerability CVE-2014-0082, GHSA-7cgp-c3g7-qvrw | Medium | 6.2% | 20 Feb, 2014 | RubyGems actionpack |
Rails vulnerable to Cross-site Scripting CVE-2014-0081, GHSA-m46p-ggm5-5j83 | Medium | 4.0% | 20 Feb, 2014 | RubyGems actionpack RubyGems rails |
Array data injection vulnerability in activerecord CVE-2014-0080, GHSA-hqf9-rc9j-5fmj | Medium | 1.3% | 20 Feb, 2014 | RubyGems activerecord |
Puppet does not properly restrict access to node resources CVE-2011-0528, GHSA-9pvx-fwwh-w289 | Medium | 1.7% | 17 Feb, 2014 | RubyGems puppet |
Paratrooper-newrelic Exposes of Sensitive Information to an Unauthorized Actor CVE-2014-1234, GHSA-959j-5g9v-3fpq | Low | 0.5% | 10 Jan, 2014 | RubyGems paratrooper-newrelic |
Local API Login Credentials Disclosure in paratrooper-pingdom CVE-2014-1233, GHSA-fqrr-rrwg-69pv | Low | 0.4% | 10 Jan, 2014 | RubyGems paratrooper-pingdom |
Phusion Passenger Denial of Service CVE-2013-2119, GHSA-9qj7-jvg4-qr2x | Medium | 0.4% | 03 Jan, 2014 | RubyGems passenger |
Fat Free CRM vulnerable to Exposure of Sensitive Information CVE-2013-7249, GHSA-f25h-3mj6-4jpg | Medium | 2.6% | 02 Jan, 2014 | RubyGems fat_free_crm |
Fat Free CRM vulnerable to SQL Injection CVE-2013-7225, GHSA-9ggp-5rf4-x7q9 | Medium | 1.9% | 02 Jan, 2014 | RubyGems fat_free_crm |
Fat Free CRM allows remote attackers to obtain sensitive information via a direct request CVE-2013-7224, GHSA-4xq9-vw89-p5cx | Medium | 2.5% | 02 Jan, 2014 | RubyGems fat_free_crm |
Fat Free CRM contains Cross-site Request Forgery vulnerablilities CVE-2013-7223, GHSA-mcvq-7xjq-46x6 | Medium | 1.2% | 02 Jan, 2014 | RubyGems fat_free_crm |
Fat Free CRM has fixed token value CVE-2013-7222, GHSA-g897-cgfc-7q8v | Medium | 2.4% | 02 Jan, 2014 | RubyGems fat_free_crm |