Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Race Condition leading to logging errors CVE-2024-22047, GHSA-hjp3-5g2q-7jww | Low | Not scored | 01 May, 2023 | RubyGems audited |
Sensitive Terraform Output Values Printed At Info Logging Level In Kitchen-Terraform CVE-2023-30618, GHSA-65g2-x53q-cmf6 | Low | Not scored | 24 Apr, 2023 | RubyGems kitchen-terraform |
govuk_tech_docs vulnerable to unescaped HTML on search results page CVE-2024-22048, GHSA-x2xw-hw8g-6773 | Low | Not scored | 11 Apr, 2023 | RubyGems govuk_tech_docs |
Possible Denial of Service Vulnerability in Rack's header parsing CVE-2023-27539, GHSA-c6qg-cjj8-47qp | Low | Not scored | 15 Mar, 2023 | RubyGems rack |
Denial of Service Vulnerability in Rack Content-Disposition parsing CVE-2022-44571, GHSA-93pm-5p5f-3ghx | Low | Not scored | 18 Jan, 2023 | RubyGems rack |
ReDoS based DoS vulnerability in Action Dispatch CVE-2023-22792, GHSA-p84v-45xj-wwqj | Low | Not scored | 18 Jan, 2023 | RubyGems actionpack |
ReDoS based DoS vulnerability in Active Support's underscore CVE-2023-22796, GHSA-j6gc-792m-qgm2 | Low | Not scored | 18 Jan, 2023 | RubyGems activesupport |
ReDoS based DoS vulnerability in Action Dispatch CVE-2023-22795, GHSA-8xww-x3g3-6jcv | Low | Not scored | 18 Jan, 2023 | RubyGems actionpack |
Denial of service via multipart parsing in Rack CVE-2022-44572, GHSA-rqv2-275x-2jq5 | Low | Not scored | 18 Jan, 2023 | RubyGems rack |
ReDoS based DoS vulnerability in GlobalID CVE-2023-22799, GHSA-23c2-gwp5-pxw9 | Low | Not scored | 18 Jan, 2023 | RubyGems globalid |
Unsanitized input leading to code injection in Dalli CVE-2022-4064, GHSA-3xg8-cc8f-9wv2 | Low | Not scored | 19 Nov, 2022 | RubyGems dalli |
fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration) BIT-fluentd-2022-39379, CVE-2022-39379, GHSA-fppq-mj76-fpj2 | Low | Not scored | 02 Nov, 2022 | RubyGems fluentd |
SQLite3 addresses vulnerability in packaged version of libsqlite GHSA-mgvv-5mxp-xq67 | Low | Not scored | 03 Oct, 2022 | RubyGems sqlite3 |
Octokit gem published with world-writable files CVE-2022-31072, GHSA-g28x-pgr3-qqx6 | Low | Not scored | 15 Jun, 2022 | RubyGems octokit |
Octopoller gem published with world-writable files CVE-2022-31071, GHSA-26qj-cr27-r5c4 | Low | Not scored | 15 Jun, 2022 | RubyGems octopoller |
CSRF allows attacker to finalize/unfinalize order adjustments in solidus_backend CVE-2022-31000, GHSA-8639-qx56-r428 | Low | Not scored | 01 Jun, 2022 | RubyGems solidus_backend |
Gitaly Insufficient Session Expiration vulnerability CVE-2020-13353, GHSA-mmmm-chjf-jmvw | Low | Not scored | 24 May, 2022 | RubyGems gitaly |
Katello cleartext password storage issue CVE-2019-14825, GHSA-m4wh-848j-9w2r | Low | Not scored | 24 May, 2022 | RubyGems katello |
Kafo allows local users to obtain passwords and other sensitive information by reading default_values.yaml CVE-2014-0135, GHSA-hxvp-655x-xxqv | Low | Not scored | 17 May, 2022 | RubyGems kafo |
Puppet Labs Facter allows local users to obtain sensitive Amazon EC2 IAM instance metadata CVE-2015-1426, GHSA-j436-h7hm-rx46 | Low | Not scored | 14 May, 2022 | RubyGems facter |
Puppet Denial of Service and Arbitrary File Write CVE-2012-1987, GHSA-v58w-6xc2-w799 | Low | Not scored | 14 May, 2022 | RubyGems puppet |
ruby_parser allows local users to overwrite arbitrary files via symlink attack on temporary file with predictable name CVE-2013-0162, GHSA-8mvw-22r7-w6fq | Low | Not scored | 05 May, 2022 | RubyGems ruby_parser |
Puppet arbitrary files overwrite via a symlink attack CVE-2010-0156, GHSA-vrh7-99jh-3fmm | Low | Not scored | 02 May, 2022 | RubyGems puppet |
Puma with proxy which forwards LF characters as line endings could allow HTTP request smuggling CVE-2021-41136, GHSA-48w2-rm65-62xx | Low | Not scored | 12 Oct, 2021 | RubyGems puma |
personnummer/ruby vulnerable to Improper Input Validation GHSA-vp9c-fpxx-744v | Low | Not scored | 23 Sep, 2020 | RubyGems personnummer |
Insecure use of temporary files in Phusion passenger CVE-2014-1832, GHSA-qw8w-2xcp-xg59 | Low | Not scored | 10 Oct, 2018 | RubyGems passenger |
Insecure use of temporary files in passenger CVE-2014-1831, GHSA-c7j7-p5jq-26ff | Low | Not scored | 10 Oct, 2018 | RubyGems passenger |
Phusion Passenger allows remote attackers to spoof headers CVE-2015-7519, GHSA-fxwv-953p-7qpf | Low | Not scored | 10 Oct, 2018 | RubyGems passenger |
ember-source Cross-site Scripting vulnerability CVE-2014-0046, GHSA-4q53-fqhc-cr46 | Low | Not scored | 28 Aug, 2018 | RubyGems ember-source |
RuboCop gem Insecure use of /tmp CVE-2017-8418, GHSA-wmjf-jpjj-9f3j | Low | Not scored | 15 Nov, 2017 | RubyGems rubocop |
sqlite3-ruby uses weak permissions for unspecified files, which allows local users to gain privileges CVE-2011-0995, GHSA-6x46-7rrv-m4h8 | Low | Not scored | 24 Oct, 2017 | RubyGems sqlite3-ruby |
Puppet allows local users to overwrite arbitrary files via a symlink attack CVE-2012-1989, GHSA-c5qq-g673-5p49 | Low | Not scored | 24 Oct, 2017 | RubyGems puppet |
Puppet supports use of IP addresses in certnames without warning of potential risks CVE-2012-3408, GHSA-vxf6-w9mp-95hm | Low | Not scored | 24 Oct, 2017 | RubyGems puppet |
Puppet vulnerable to Path Traversal CVE-2012-3865, GHSA-g89m-3wjw-h857 | Low | Not scored | 24 Oct, 2017 | RubyGems puppet |
Puppet allows local users to obtain sensitive configuration information CVE-2012-3866, GHSA-8jxj-9r5f-w3m2 | Low | Not scored | 24 Oct, 2017 | RubyGems puppet |
Local API Login Credentials Disclosure in paratrooper-pingdom CVE-2014-1233, GHSA-fqrr-rrwg-69pv | Low | Not scored | 24 Oct, 2017 | RubyGems paratrooper-pingdom |
Paratrooper-newrelic Exposes of Sensitive Information to an Unauthorized Actor CVE-2014-1234, GHSA-959j-5g9v-3fpq | Low | Not scored | 24 Oct, 2017 | RubyGems paratrooper-newrelic |
rest-client allows local users to obtain sensitive information by reading the log CVE-2015-3448, GHSA-mx9f-w8qq-q5jf | Low | Not scored | 24 Oct, 2017 | RubyGems rest-client |
actionpack is vulnerable to remote bypass authentication CVE-2015-7576, GHSA-p692-7mm3-3fxg | Low | Not scored | 24 Oct, 2017 | RubyGems actionpack |