Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
strong_password Ruby gem malicious version causing Remote Code Execution vulnerability CVE-2019-13354, GHSA-5h5r-ffc4-c455 | Critical | Not scored | 08 Jul, 2019 | RubyGems strong_password |
ruby-openid SSRF via claimed_id request CVE-2019-11027, GHSA-fqfj-cmh6-hj49 | Critical | Not scored | 13 Jun, 2019 | RubyGems ruby-openid |
Bootstrap-sass contains code execution backdoor CVE-2019-10842, GHSA-vqqv-v9m2-48p2 | Critical | Not scored | 04 Apr, 2019 | RubyGems bootstrap-sass |
Use of Insufficiently Random Values in Railties Allows Remote Code Execution CVE-2019-5420, GHSA-m42h-mh85-4qgc | Critical | Not scored | 13 Mar, 2019 | RubyGems railties |
mysql-bunuuid-rails vulnerable to SQL injection CVE-2018-18476, GHSA-6j63-35hj-vmcg | Critical | Not scored | 30 Oct, 2018 | RubyGems mysql-binuuid-rails |
smart_proxy_dynflow gem authentication bypass in Foreman remote execution feature CVE-2018-14643, GHSA-gx5g-xcxj-cx2w | Critical | Not scored | 08 Oct, 2018 | RubyGems smart_proxy_dynflow |
Rubyzip gem contains a Directory Traversal vulnerability in zip file component CVE-2018-1000544, GHSA-vqcq-mrmw-mcmg | Critical | Not scored | 06 Sep, 2018 | RubyGems rubyzip |
Nokogiri does not forbid namespace nodes in XPointer ranges CVE-2016-4658, GHSA-fr52-4hqw-p27f | Critical | Not scored | 21 Aug, 2018 | RubyGems nokogiri |
Git-fastclone passes user modifiable strings directly to a shell command CVE-2015-8969, GHSA-mf6w-45cf-qhmp | Critical | Not scored | 15 Aug, 2018 | RubyGems git-fastclone |
rest-client Gem Vulnerable to Session Fixation CVE-2015-1820, GHSA-3fhf-6939-qg8p | Critical | Not scored | 13 Aug, 2018 | RubyGems rest-client |
active-support impersonates 'activesupport' gem CVE-2018-3779, GHSA-2j55-pcw5-x4h2 | Critical | Not scored | 13 Aug, 2018 | RubyGems active-support |
restforce vulnerable to Improper Input Validation CVE-2018-3777, GHSA-534w-937m-v7x3 | Critical | Not scored | 03 Aug, 2018 | RubyGems restforce |
bson is vulnerable to denial of service due to incorrect regex validation CVE-2015-4412, GHSA-h6rj-8r3c-9gpj | Critical | Not scored | 05 Mar, 2018 | RubyGems bson |
paperclip Server-Side Request Forgery vulnerability CVE-2017-0889, GHSA-5jcf-c5rg-rmm8 | Critical | Not scored | 22 Jan, 2018 | RubyGems paperclip |
Recurly gem Server-Side Request Forgery in Resource#find method CVE-2017-0905, GHSA-x27v-x225-gq8g | Critical | Not scored | 06 Dec, 2017 | RubyGems recurly |
redis-store deserializes untrusted data CVE-2017-1000248, GHSA-2w67-526p-gm73 | Critical | Not scored | 06 Dec, 2017 | RubyGems redis-store |
rails vulnerable to improper authentication CVE-2009-2422, GHSA-rxq3-gm4p-5fj4 | Critical | Not scored | 24 Oct, 2017 | RubyGems rails |
Active Record contains deserialization of arbitrary YAML CVE-2013-0277, GHSA-fhj9-cjjh-27vm | Critical | Not scored | 24 Oct, 2017 | RubyGems activerecord |
Shell Metacharacter Injection in kelredd-pruview CVE-2013-1947, GHSA-78j3-7wpm-qhvp | Critical | Not scored | 24 Oct, 2017 | RubyGems kelredd-pruview |
md2pdf allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename CVE-2013-1948, GHSA-99ch-8mvp-g7m5 | Critical | Not scored | 24 Oct, 2017 | RubyGems md2pdf |
Creme Fraiche contains OS Command Injection CVE-2013-2090, GHSA-m6f7-46hw-grcj | Critical | Not scored | 24 Oct, 2017 | RubyGems cremefraiche |
colorscore Command Injection vulnerability CVE-2015-7541, GHSA-73qw-ww62-m54x | Critical | Not scored | 24 Oct, 2017 | RubyGems colorscore |
espeak-ruby allows arbitrary command execution CVE-2016-10193, GHSA-4jm3-pfpf-h54p | Critical | Not scored | 24 Oct, 2017 | RubyGems espeak-ruby |
festivaltts4r allows arbitrary command execution CVE-2016-10194, GHSA-f7f4-5w9j-23p2 | Critical | Not scored | 24 Oct, 2017 | RubyGems festivaltts4r |
Doorkeeper is vulnerable to replay attacks CVE-2016-6582, GHSA-3m6r-39p3-jq25 | Critical | Not scored | 24 Oct, 2017 | RubyGems doorkeeper |
Directory traversal vulnerability in RubyZip CVE-2017-5946, GHSA-gcqq-w6gr-h9j9 | Critical | Not scored | 24 Oct, 2017 | RubyGems rubyzip |
Safemode Gem Has Incomplete List of Disallowed Inputs CVE-2017-7540, GHSA-5vx5-9q73-wgp4 | Critical | Not scored | 24 Oct, 2017 | RubyGems safemode |
Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js CVE-2015-8857, GHSA-34r7-q49f-h37c | Critical | 3.6% | 23 Jan, 2017 | RubyGems uglifier npm uglify-js |