Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
omniauth-weibo-oauth2 included a code-execution backdoor inserted by a third party CVE-2019-17268, GHSA-vr22-43gj-rx3f | Critical | Not scored | 24 May, 2022 | RubyGems omniauth-weibo-oauth2 |
papercrop does not properly handle crop input CVE-2015-2784, GHSA-m44r-gv6q-9j9r | Critical | Not scored | 24 May, 2022 | RubyGems papercrop |
Publify vulnerable to cross site scripting BIT-publify-2022-1811, CVE-2022-1811, GHSA-3hwx-c6cp-q972 | Critical | Not scored | 24 May, 2022 | RubyGems publify_core |
Katello uses hard coded credential CVE-2012-3503, GHSA-5xv2-q475-rwrh | Critical | Not scored | 17 May, 2022 | RubyGems katello |
karo Metacharacter Handling Remote Command Execution CVE-2014-10075, GHSA-qfwq-chf4-jvwg | Critical | Not scored | 14 May, 2022 | RubyGems karo |
Phusion Passenger SpawningKit Contains Arbitrary Read/Write Vulnerability CVE-2018-12026, GHSA-7cv3-gvmc-8mq5 | Critical | Not scored | 14 May, 2022 | RubyGems passenger |
RubyGems Improper Verification of Cryptographic Signature vulnerability CVE-2018-1000076, GHSA-mc6j-h948-v2p6 | Critical | Not scored | 14 May, 2022 | Maven org.jruby:jruby-stdlib RubyGems rubygems-update |
Bundler allows attacker to inject arbitrary code via secondary Gem source CVE-2016-7954, GHSA-jvgm-pfqv-887x | Critical | Not scored | 14 May, 2022 | RubyGems bundler |
Active Record component in Ruby on Rails has a data-type injection vulnerability CVE-2013-3221, GHSA-f57c-hx33-hvh8 | Critical | Not scored | 14 May, 2022 | RubyGems activerecord |
Ruby Openssl Allows Incorrect Value Comparison CVE-2018-16395, GHSA-mmrq-6999-72v8 | Critical | Not scored | 13 May, 2022 | RubyGems openssl |
RubyGems vulnerable to Deserialization of Untrusted Data CVE-2017-0903, GHSA-mqwr-4qf2-2hcv | Critical | Not scored | 13 May, 2022 | RubyGems rubygems-update |
RubyGems Code Injection vulnerability CVE-2017-0899, GHSA-7gcp-2gmq-w3xh | Critical | Not scored | 13 May, 2022 | RubyGems rubygems-update |
Nokogiri vulnerable to libxslt protection mechanism bypass CVE-2019-11068, GHSA-qxcg-xjjg-66mj | Critical | Not scored | 13 May, 2022 | RubyGems nokogiri |
smalruby and smalruby-editor vulnerable to OS Command Injection CVE-2017-2096, GHSA-f489-655r-x6gr | Critical | Not scored | 13 May, 2022 | RubyGems smalruby RubyGems smalruby-editor |
Fluentd Escape Sequence Injection Vulnerability CVE-2017-10906, GHSA-5jrp-w8fr-mrww | Critical | Not scored | 13 May, 2022 | RubyGems fluentd |
Puppet Improper Access Control CVE-2016-2785, GHSA-pqj5-7r86-64fv | Critical | Not scored | 13 May, 2022 | RubyGems puppet |
PDFKit Improper Input Validation vulnerability CVE-2013-1607, GHSA-39v7-xpq4-8884 | Critical | Not scored | 05 May, 2022 | RubyGems pdfkit |
RubyGem openshift-origin-controller is vulnerable to command injection CVE-2013-2095, GHSA-77xq-7c6p-6xp6 | Critical | Not scored | 05 May, 2022 | RubyGems openshift-origin-controller |
CSV-Safe improperly filters special characters potentially leading to CSV injection CVE-2022-28481, GHSA-f55g-x8qq-2569 | Critical | Not scored | 03 May, 2022 | RubyGems csv-safe |
Server side request forgery in gibbon CVE-2022-27311, GHSA-vx9g-377x-xwxq | Critical | Not scored | 26 Apr, 2022 | RubyGems gibbon |
Command injection in ruby-git BIT-git-2022-25648, CVE-2022-25648, GHSA-69p6-wvmq-27gg, SNYK-RUBY-GIT-2421270 | Critical | Not scored | 20 Apr, 2022 | RubyGems git |
Command Injection vulnerability in asciidoctor-include-ext CVE-2022-24803, GHSA-v222-6mr4-qj29 | Critical | Not scored | 31 Mar, 2022 | RubyGems asciidoctor-include-ext |
Puma vulnerable to HTTP Request Smuggling CVE-2022-24790, GHSA-h99w-9q5r-gjq9 | Critical | Not scored | 30 Mar, 2022 | RubyGems puma |
Possible code injection vulnerability in Rails / Active Storage CVE-2022-21831, GHSA-w749-p3v6-hccq | Critical | Not scored | 08 Mar, 2022 | RubyGems activestorage |
Remote shell execution vulnerability in image_processing CVE-2022-24720, GHSA-cxf7-qrc5-9446 | Critical | Not scored | 01 Mar, 2022 | RubyGems image_processing |
Buffer overrun in CGI.escape_html CVE-2021-41816, GHSA-5cqm-crxm-6qpv | Critical | Not scored | 14 Dec, 2021 | RubyGems cgi |
Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness CVE-2021-41275, GHSA-26xx-m4q2-xhq8 | Critical | Not scored | 18 Nov, 2021 | RubyGems spree_auth_devise |
Authentication Bypass by CSRF Weakness GHSA-5629-8855-gf4g | Critical | Not scored | 18 Nov, 2021 | RubyGems solidus_core |
Authentication Bypass by CSRF Weakness CVE-2021-41274, GHSA-xm34-v85h-9pg2 | Critical | Not scored | 18 Nov, 2021 | RubyGems solidus_auth_devise |
OS Command Injection in ftpd CVE-2013-2512, GHSA-7vxr-6cxg-j3x8 | Critical | Not scored | 12 Oct, 2021 | RubyGems ftpd |
Remote code execution in ruby-jss CVE-2021-33575, GHSA-vmfh-c547-v45h | Critical | Not scored | 06 Oct, 2021 | RubyGems ruby-jss |
Dragonfly contains remote code execution vulnerability CVE-2021-33564, GHSA-j858-xp5v-f8xx | Critical | Not scored | 02 Jun, 2021 | RubyGems dragonfly |
Unintended read access in kramdown gem CVE-2020-14001, GHSA-mqm2-cgpr-p4m6 | Critical | Not scored | 07 Aug, 2020 | RubyGems kramdown |
SQL Injection in Geocoder CVE-2020-7981, GHSA-864j-6qpp-cmrr | Critical | Not scored | 10 Jun, 2020 | RubyGems geocoder |
ActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore CVE-2020-8165, GHSA-2p68-f74v-9wc6 | Critical | Not scored | 26 May, 2020 | RubyGems activesupport |
Arbitrary file write in actionpack-page_caching gem CVE-2020-8159, GHSA-mg5p-95m9-rmfp | Critical | Not scored | 13 May, 2020 | RubyGems actionpack-page_caching |
BibTeX-Ruby vulnerable to OS command injection CVE-2019-10780, GHSA-c5r5-7pfh-6qg6, SNYK-RUBY-BIBTEXRUBY-542602 | Critical | Not scored | 14 Feb, 2020 | RubyGems bibtex-ruby |
Prototype Pollution in handlebars CVE-2019-19919, GHSA-w457-6q6x-cgp9 | Critical | 7.1% | 20 Dec, 2019 | RubyGems bootstrap-wysihtml5-rails npm handlebars |
netaddr before 1.5.3 and 2.0.4 has Incorrect Default Permissions CVE-2019-17383, GHSA-49pj-69vf-c689 | Critical | Not scored | 14 Oct, 2019 | RubyGems netaddr |
Improper Input Validation in simple_form CVE-2019-16676, GHSA-r74q-gxcg-73hx | Critical | Not scored | 30 Sep, 2019 | RubyGems simple_form |
Consul gem insufficient authentication check - Multiple powers in one controller are not always checked correctly CVE-2019-16377, GHSA-8jhx-9gf4-hhf5 | Critical | Not scored | 27 Sep, 2019 | RubyGems consul |
Airbrake keys not being filtered CVE-2019-16060, GHSA-2p82-v77v-mppr | Critical | Not scored | 11 Sep, 2019 | RubyGems airbrake-ruby |
rest-client Gem Contains Malicious Code CVE-2019-15224, GHSA-333g-rpr4-7hxq | Critical | Not scored | 20 Aug, 2019 | RubyGems awesome-bot RubyGems bitcoin_vanity RubyGems blockchain_wallet RubyGems capistrano-colors +6 more |
Nokogiri Command Injection Vulnerability CVE-2019-5477, GHSA-cr5j-953j-xw5p | Critical | Not scored | 19 Aug, 2019 | RubyGems nokogiri RubyGems rexical |
datagrid contains code Injection backdoor CVE-2019-14281, GHSA-rqp5-pg7w-832p | Critical | Not scored | 31 Jul, 2019 | RubyGems datagrid |
Code backdoor in simple_captcha2 CVE-2019-14282, GHSA-wg6j-r28m-7293 | Critical | Not scored | 31 Jul, 2019 | RubyGems simple_captcha2 |
SQL Injection in marginalia CVE-2019-1010191, GHSA-hrj5-qp7x-rpg6 | Critical | Not scored | 26 Jul, 2019 | RubyGems marginalia |
paranoid2 gem Code backdoor CVE-2019-13589, GHSA-4g4c-8gqh-m4vm | Critical | Not scored | 16 Jul, 2019 | RubyGems paranoid2 |
Slanger Arbitrary command execution CVE-2019-1010306, GHSA-rg32-m3hf-772v | Critical | Not scored | 16 Jul, 2019 | RubyGems slanger |
Prototype Pollution in lodash CVE-2019-10744, GHSA-jf85-cpcp-j695, SNYK-JS-LODASH-450202 | Critical | 5.0% | 10 Jul, 2019 | RubyGems lodash-rails npm lodash npm lodash-amd npm lodash-es +1 more |