Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Nokogiri Implements libxml2 version vulnerable to use-after-free CVE-2021-3518, GHSA-v4f8-2847-rwm7 | High | Not scored | 24 May, 2022 | RubyGems nokogiri |
Metasploit Framework user exposes Metasploit to same deserialization issue that is exploited by that module CVE-2020-7385, GHSA-xgww-h98f-24qf | High | Not scored | 24 May, 2022 | RubyGems metasploit-framework |
WEBRick vulnerable to HTTP Request/Response Smuggling BIT-ruby-2020-25613, BIT-ruby-min-2020-25613, CVE-2020-25613, GHSA-gwfg-cqmg-cf8f | High | Not scored | 24 May, 2022 | RubyGems webrick |
Nokogiri implementation of libxslt vulnerable to heap corruption CVE-2019-5815, GHSA-vmfx-gcfq-wvm2 | High | Not scored | 24 May, 2022 | RubyGems nokogiri |
Nokogiri affected by libxslt Use of Uninitialized Resource/Use After Free vulnerability CVE-2019-18197, GHSA-242x-7cm6-4w8j | High | Not scored | 24 May, 2022 | RubyGems nokogiri |
Elastic APM agent for Ruby vulnerable to Improper Certificate Validation CVE-2019-7615, GHSA-35j2-p8fh-x966 | High | Not scored | 24 May, 2022 | RubyGems elastic-apm |
libxslt Type Confusion vulnerability that affects Nokogiri CVE-2019-13118, GHSA-cf46-6xxh-pc75 | High | Not scored | 24 May, 2022 | RubyGems nokogiri |
Nokogiri Improperly Handles Unexpected Data Type CVE-2022-29181, GHSA-xh29-r2w5-wx8m | High | Not scored | 23 May, 2022 | RubyGems nokogiri |
Insecure PRNG use in random_password_generator CVE-2019-25061, GHSA-ggfx-h9xj-5v9c | High | Not scored | 19 May, 2022 | RubyGems random_password_generator |
Integer Overflow or Wraparound in libxml2 affects Nokogiri CVE-2022-50999, GHSA-cgx6-hpwq-fhv5 | High | Not scored | 18 May, 2022 | RubyGems nokogiri |
Publify vulnerable to DoS attack CVE-2014-3211, GHSA-vq74-9583-hrm4 | High | Not scored | 17 May, 2022 | RubyGems publify_core |
Karteek Docsplit vulnerable to OS Command Injection CVE-2013-1933, GHSA-4fvg-pwv7-v54g | High | Not scored | 17 May, 2022 | RubyGems karteek-docsplit |
codders-dataset Process Table Local Plaintext Credential Disclosure CVE-2014-4991, GHSA-w9vv-fvw8-j6q3 | High | Not scored | 14 May, 2022 | RubyGems codders-dataset |
backup-agoddard and backup_checksum have Information Exposure vulnerability CVE-2014-4993, GHSA-wr5j-q359-6vr2 | High | Not scored | 14 May, 2022 | RubyGems backup-agoddard RubyGems backup_checksum |
VladTheEnterprising allows local users to obtain sensitive information by reading MySQL root password from temporary file CVE-2014-4995, GHSA-86cf-g34f-7462 | High | Not scored | 14 May, 2022 | RubyGems VladTheEnterprising |
point-cli allows local users to obtain sensitive information by listing the process CVE-2014-4997, GHSA-mc8m-x6hf-cw2g | High | Not scored | 14 May, 2022 | RubyGems point-cli |
kajam allows local users to obtain sensitive information by listing the process CVE-2014-4999, GHSA-4ph7-5c44-pppv | High | Not scored | 14 May, 2022 | RubyGems kajam |
lean-ruport allows local users to obtain sensitive information by listing the process CVE-2014-4998, GHSA-5g7f-p7jg-v6mv | High | Not scored | 14 May, 2022 | RubyGems lean-ruport |
Echor Ruby Gem credentials can be stolen via process table monitoring CVE-2014-1835, GHSA-j4gx-p3x5-m987 | High | Not scored | 14 May, 2022 | RubyGems echor |
Echor contains Command Injection CVE-2014-1834, GHSA-8936-cgj4-phr2 | High | Not scored | 14 May, 2022 | RubyGems echor |
Nokogiri gem, via libxml, is affected by DoS vulnerabilities CVE-2017-15412, GHSA-r58r-74gx-6wx3 | High | Not scored | 14 May, 2022 | RubyGems nokogiri |
WEBrick RCE Vulnerability CVE-2017-10784, GHSA-369m-2gv6-mw28 | High | Not scored | 14 May, 2022 | RubyGems webrick |
Ruby OpenSSL DoS Vulnerability CVE-2017-14033, GHSA-v6rp-3r3v-hf4p | High | Not scored | 14 May, 2022 | RubyGems openssl |
i18n Vulnerable to Denial of Service Attack CVE-2014-10077, GHSA-34hf-g744-jw64 | High | Not scored | 14 May, 2022 | RubyGems i18n |
Fileutils Command Injection vulnerability CVE-2013-2516, GHSA-9x97-x2p9-hvpf | High | Not scored | 14 May, 2022 | RubyGems fileutils |
Phusion Passenger Race Condition Allows Privilege Escalation CVE-2018-12029, GHSA-jjcj-fgfm-9g9r | High | Not scored | 14 May, 2022 | RubyGems passenger |
Katello SQL Injection vulnerabilities CVE-2016-3072, GHSA-527r-mfmj-prqf | High | Not scored | 14 May, 2022 | RubyGems katello |
RubyGems vulnerable to DNS hijack attack CVE-2015-3900, GHSA-wp3j-rvfp-624h | High | Not scored | 14 May, 2022 | RubyGems rubygems-update |
RubyGems Improper Input Validation vulnerability CVE-2017-0900, GHSA-p7f2-rr42-m9xm | High | Not scored | 14 May, 2022 | RubyGems rubygems-update |
RubyGems Deserialization of Untrusted Data vulnerability CVE-2018-1000074, GHSA-qj2w-mw2r-pv39 | High | Not scored | 14 May, 2022 | Maven org.jruby:jruby-stdlib RubyGems rubygems-update |
Elasticsearch Logstash allows remote attackers to execute arbitrary commands CVE-2014-4326, GHSA-8qhq-rq4j-8prj | High | Not scored | 14 May, 2022 | RubyGems logstash |
Logstash Logs Sensitive Information CVE-2016-1000221, GHSA-vcmm-ppqx-95ch | High | Not scored | 14 May, 2022 | RubyGems logstash-core |
Asciidoctor Infinite Loop vulnerability CVE-2018-18385, GHSA-qc9p-mjxm-j2wj | High | Not scored | 13 May, 2022 | RubyGems asciidoctor |
Insecure Permissions in Phusion Passenger CVE-2018-12027, GHSA-whfx-877c-5p28 | High | Not scored | 13 May, 2022 | RubyGems passenger |
Incorrect Access Control in Phusion Passenger CVE-2018-12028, GHSA-jjhj-8gx7-x836 | High | Not scored | 13 May, 2022 | RubyGems passenger |
RubyGems Infinite Loop vulnerability CVE-2018-1000075, GHSA-74pv-v9gh-h25p | High | Not scored | 13 May, 2022 | Maven org.jruby:jruby-stdlib RubyGems rubygems-update |
RubyGems may allow a maliciously crafted gem to overwrite files CVE-2017-0901, GHSA-pm9x-4392-2c2p | High | Not scored | 13 May, 2022 | RubyGems rubygems-update |
RubyGems has Origin Validation Error vulnerability CVE-2017-0902, GHSA-73w7-6w9g-gc8w | High | Not scored | 13 May, 2022 | RubyGems rubygems-update |
hammer_cli_foreman Improper Certificate Validation vulnerability CVE-2017-2667, GHSA-77h8-xr85-3x5q | High | Not scored | 13 May, 2022 | RubyGems hammer_cli_foreman |
Gem in a Box vulnerable to Cross-site Request Forgery CVE-2017-14683, GHSA-qwv2-2x8g-g43g | High | Not scored | 13 May, 2022 | RubyGems geminabox |
RubyGems Link Following vulnerability CVE-2018-1000073, GHSA-gx69-6cp4-hxrj | High | Not scored | 13 May, 2022 | Maven org.jruby:jruby-stdlib RubyGems rubygems-update |
open-uri-cached Gem for Ruby Unsafe Temporary File Creation Enables Code Execution CVE-2015-3649, GHSA-7m2w-9gw7-c3xp | High | Not scored | 13 May, 2022 | RubyGems open-uri-cached |
mixlib-archive Path Traversal vulnerability CVE-2017-1000026, GHSA-98wx-cw86-c97x | High | Not scored | 13 May, 2022 | RubyGems mixlib-archive |
Nokogiri gem, via libxml, is affected by DoS vulnerabilities CVE-2017-16932, GHSA-x2fm-93ww-ggvx | High | Not scored | 13 May, 2022 | RubyGems nokogiri |
omniauth-facebook Improper Authentication vulnerability CVE-2013-4593, GHSA-33vg-hpx5-pfxg | High | Not scored | 05 May, 2022 | RubyGems omniauth-facebook |
sinatra does not validate expanded path matches CVE-2022-29970, GHSA-qp49-3pvw-x4m5 | High | Not scored | 03 May, 2022 | RubyGems sinatra |
WEBrick Denial of Service Vulnerability CVE-2008-4310, GHSA-wfrc-r6c6-7j9r | High | Not scored | 02 May, 2022 | RubyGems webrick |
Nokogiri is vulnerable to XML External Entity (XXE) attack CVE-2012-6685, GHSA-6wj9-77wq-jq7p | High | Not scored | 23 Apr, 2022 | RubyGems nokogiri |
RubyGems passenger gem allows remote attackers to delete files CVE-2012-6135, GHSA-8mw8-j583-vqfg | High | Not scored | 23 Apr, 2022 | RubyGems passenger |
SQL injection in blazer CVE-2022-29498, GHSA-qf9q-q4hh-qph3 | High | Not scored | 22 Apr, 2022 | RubyGems blazer |