Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Rack vulnerable to Denial of Service CVE-2013-0184, GHSA-v882-ccj6-jc48 | Medium | 2.4% | 01 Mar, 2013 | RubyGems rack |
Rack rubygems receiving excessively long lines triggers out-of-memory error CVE-2013-0183, GHSA-3pxh-h8hw-mj8w | Medium | 3.8% | 01 Mar, 2013 | RubyGems rack |
ruby_parser allows local users to overwrite arbitrary files via symlink attack on temporary file with predictable name CVE-2013-0162, GHSA-8mvw-22r7-w6fq | Low | 0.4% | 01 Mar, 2013 | RubyGems ruby_parser |
Rack vulnerable to REDoS CVE-2012-6109, GHSA-h77x-m5q8-c29h | Medium | 2.7% | 01 Mar, 2013 | RubyGems rack |
ldap_fluff authentication bypass CVE-2012-5604, GHSA-9whh-582r-589h | Medium | 1.8% | 01 Mar, 2013 | RubyGems ldap_fluff |
Active Record contains deserialization of arbitrary YAML CVE-2013-0277, GHSA-fhj9-cjjh-27vm | Critical | 7.5% | 13 Feb, 2013 | RubyGems activerecord |
ActiveRecord vulnerable to modification of protected model attributes CVE-2013-0276, GHSA-gr44-7grc-37vq | Medium | 3.0% | 13 Feb, 2013 | RubyGems activerecord |
JSON gem has Improper Input Validation vulnerability CVE-2013-0269, GHSA-x457-cw4h-hq5f | High | 13.9% | 13 Feb, 2013 | RubyGems json |
Rack arbitrary code execution via timing attack CVE-2013-0263, GHSA-xc85-32mf-xpv8 | Medium | 5.4% | 08 Feb, 2013 | RubyGems rack |
Rack Vulnerable to Path Traversal CVE-2013-0262, GHSA-85r7-w5mv-c849 | Medium | 2.9% | 08 Feb, 2013 | RubyGems rack |
activesupport in Rails vulnerable to incorrect data conversion CVE-2013-0333, GHSA-xgr2-v94m-rc9g | High | 95.6% | 30 Jan, 2013 | RubyGems activesupport |
actionpack Improper Input Validation vulnerability CVE-2013-0156, GHSA-jmgw-6vjg-jjwg | High | 99.4% | 13 Jan, 2013 | RubyGems actionpack |
Active Record allows bypassing of database-query restrictions CVE-2013-0155, GHSA-gppp-5xc5-wfpx | Medium | 8.2% | 13 Jan, 2013 | RubyGems activerecord |
Authlogic Information Exposure vulnerability CVE-2012-6497, GHSA-rx7j-mw4c-76g9 | Medium | 2.7% | 04 Jan, 2013 | RubyGems authlogic |
Active Record contains SQL Injection CVE-2012-6496, GHSA-gh2w-j7cx-2664 | High | 4.6% | 04 Jan, 2013 | RubyGems activerecord |
Katello uses hard coded credential CVE-2012-3503, GHSA-5xv2-q475-rwrh | Critical | 3.0% | 25 Aug, 2012 | RubyGems katello |
actionpack Cross-site Scripting vulnerability CVE-2012-3465, GHSA-7g65-ghrg-hpf5 | Medium | 2.0% | 10 Aug, 2012 | RubyGems actionpack |
activesupport Cross-site Scripting vulnerability CVE-2012-3464, GHSA-h835-75hw-pj89 | Medium | 2.6% | 10 Aug, 2012 | RubyGems activesupport |
actionpack Cross-site Scripting vulnerability CVE-2012-3463, GHSA-98mf-8f57-64qf | Medium | 1.3% | 10 Aug, 2012 | RubyGems actionpack |
actionpack Improper Authentication vulnerability CVE-2012-3424, GHSA-92w9-2pqw-rhjj | Medium | 1.9% | 08 Aug, 2012 | RubyGems actionpack |
Chef Improper Access Control vulnerability CVE-2010-5142, GHSA-f68m-q26r-64f6 | Medium | 1.6% | 08 Aug, 2012 | RubyGems chef |
Pupper does not properly restrict characters in Common Name field of Certificate Signing Request CVE-2012-3867, GHSA-q44r-f2hm-v76v | Medium | 2.5% | 06 Aug, 2012 | RubyGems puppet |
Puppet allows local users to obtain sensitive configuration information CVE-2012-3866, GHSA-8jxj-9r5f-w3m2 | Low | 0.5% | 06 Aug, 2012 | RubyGems puppet |
Puppet vulnerable to Path Traversal CVE-2012-3865, GHSA-g89m-3wjw-h857 | Low | 1.9% | 06 Aug, 2012 | RubyGems puppet |
Puppet supports use of IP addresses in certnames without warning of potential risks CVE-2012-3408, GHSA-vxf6-w9mp-95hm | Low | 1.6% | 06 Aug, 2012 | RubyGems puppet |
Mail Gem Improper Input Validation vulnerability CVE-2012-2140, GHSA-rp63-jfmw-532w | High | 4.5% | 18 Jul, 2012 | RubyGems mail |
Mail Gem Path Traversal vulnerability CVE-2012-2139, GHSA-cj92-c4fj-w9c5 | Medium | 4.9% | 18 Jul, 2012 | RubyGems mail |
Puppet allows local users to overwrite arbitrary files via a symlink attack CVE-2012-1989, GHSA-c5qq-g673-5p49 | Low | 0.4% | 27 Jun, 2012 | RubyGems puppet |
activerecord vulnerable to SQL Injection CVE-2012-2695, GHSA-76wq-xw4h-f8wj | High | 2.9% | 22 Jun, 2012 | RubyGems activerecord |
actionpack allows remote attackers to bypass database-query restrictions, perform NULL checks via crafted request CVE-2012-2694, GHSA-q34c-48gc-m9g8 | Medium | 3.9% | 22 Jun, 2012 | RubyGems actionpack |
Active Record vulnerable to SQL Injection via nested query parameters CVE-2012-2661, GHSA-fh39-v733-mxfr | Medium | 4.0% | 22 Jun, 2012 | RubyGems activerecord |
Action Pack contains database-query restrictions bypass CVE-2012-2660, GHSA-hgpp-pp89-4fgf | Medium | 4.5% | 22 Jun, 2012 | RubyGems actionpack |
Rack-Cache caches sensitive headers CVE-2012-2671, GHSA-hrp6-w4v2-8737 | High | 2.3% | 17 Jun, 2012 | RubyGems rack-cache |
Puppet Arbitrary Command Execution CVE-2012-1988, GHSA-6xxq-j39w-g3f6 | Medium | 2.6% | 29 May, 2012 | RubyGems puppet |
Puppet Denial of Service and Arbitrary File Write CVE-2012-1987, GHSA-v58w-6xc2-w799 | Low | 2.5% | 29 May, 2012 | RubyGems puppet |
Puppet uses predictable filenames, allowing arbitrary file overwrite CVE-2012-1906, GHSA-c4mc-49hq-q275 | Medium | 0.4% | 29 May, 2012 | RubyGems puppet |
Puppet Privilege Escallation CVE-2012-1053, GHSA-77hg-g8cc-5r37 | Medium | 0.4% | 29 May, 2012 | RubyGems puppet |
Spree uses a hardcoded hash value CVE-2008-7311, GHSA-g466-57gh-cqfw | Medium | 1.2% | 05 Apr, 2012 | RubyGems spree |
Spree does not properly restrict the use of a hash to provide values for a model's attributes CVE-2008-7310, GHSA-7h48-m3rw-vr27 | Medium | 1.2% | 05 Apr, 2012 | RubyGems spree |
Cross-site Scripting in actionpack CVE-2012-1099, GHSA-2xjj-5x6h-8vmf | Medium | 2.4% | 13 Mar, 2012 | RubyGems actionpack |
activesupport Cross-site Scripting vulnerability CVE-2012-1098, GHSA-qv8p-v9qw-wc7g | Medium | 2.6% | 13 Mar, 2012 | RubyGems activesupport |
Rack Gem Subject to Denial of Service via Hash Collisions CVE-2011-5036, GHSA-v6j3-7jrw-hq2p | Medium | 3.9% | 30 Dec, 2011 | Maven org.jruby:jruby-parent RubyGems rack |
Cross-site Scripting vulnerability in i18n translations helper method CVE-2011-4319, GHSA-xxr8-833v-c7wc | Medium | 1.6% | 28 Nov, 2011 | RubyGems actionpack |
Puppet uses predictable filenames, allowing arbitrary file overwrite CVE-2011-3871, GHSA-mpmx-gm5v-q789 | Medium | 0.3% | 27 Oct, 2011 | RubyGems puppet |
Puppet allows local users to modify the permissions of arbitrary files CVE-2011-3870, GHSA-qh3g-27jf-3j54 | Medium | 0.4% | 27 Oct, 2011 | RubyGems puppet |
Puppet arbitrary file overwrite CVE-2011-3869, GHSA-8c56-v25w-f89c | Medium | 0.3% | 27 Oct, 2011 | RubyGems puppet |
actionpack Improper Input Validation vulnerability CVE-2011-3187, GHSA-3vfw-7rcp-3xgm | Medium | 6.7% | 29 Aug, 2011 | RubyGems actionpack |
actionpack CRLF injection vulnerability CVE-2011-3186, GHSA-fcqf-h4h4-695m | Medium | 1.7% | 29 Aug, 2011 | RubyGems actionpack |
activesupport Cross-site Scripting vulnerability CVE-2011-2932, GHSA-9fh3-vh3h-q4g3 | Medium | 2.5% | 29 Aug, 2011 | RubyGems activesupport |
actionpack Cross-site Scripting vulnerability CVE-2011-2931, GHSA-v5jg-558j-q67c | Medium | 2.5% | 29 Aug, 2011 | RubyGems actionpack |