Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Possible XSS vulnerability with certain configurations of rails-html-sanitizer CVE-2022-23520, GHSA-rrfc-7g8p-99q8 | Medium | Not scored | 13 Dec, 2022 | RubyGems rails-html-sanitizer |
Possible XSS vulnerability with certain configurations of rails-html-sanitizer CVE-2022-23519, GHSA-9h9g-93gc-623h | Medium | Not scored | 13 Dec, 2022 | RubyGems rails-html-sanitizer |
Improper neutralization of data URIs may allow XSS in rails-html-sanitizer CVE-2022-23518, GHSA-mcvf-2q2m-x72m | Medium | Not scored | 13 Dec, 2022 | RubyGems rails-html-sanitizer |
Improper neutralization of data URIs may allow XSS in Loofah CVE-2022-23515, GHSA-228g-948r-83gx | Medium | Not scored | 13 Dec, 2022 | RubyGems loofah |
Update bundled libxml2 to v2.10.3 to resolve multiple CVEs CVE-2022-50998, GHSA-2qc6-mcvw-92cw | Medium | Not scored | 18 Oct, 2022 | RubyGems nokogiri |
Fat Free CRM vulnerable to Remote Denial of Service via Tasks endpoint CVE-2022-39281, GHSA-p75c-5x3h-cxcg | Medium | Not scored | 07 Oct, 2022 | RubyGems fat_free_crm |
protobuf-java has a potential Denial of Service issue CVE-2022-3171, GHSA-h4h5-3hr4-j3g2 | Medium | Not scored | 04 Oct, 2022 | Maven com.google.protobuf:protobuf-java Maven com.google.protobuf:protobuf-javalite Maven com.google.protobuf:protobuf-kotlin Maven com.google.protobuf:protobuf-kotlin-lite +1 more |
Unbounded resource exhaustion in cmark-gfm autolink extension may lead to denial of service GHSA-4qw4-jpp4-8gvp | Medium | Not scored | 21 Sep, 2022 | RubyGems commonmarker |
update_by_case before 0.1.3 can be vulnerable to sql injection CVE-2022-35956, GHSA-33wh-w4m7-c6r8 | Medium | Not scored | 11 Aug, 2022 | RubyGems update_by_case |
administrate vulnerable to Cross-Site Request Forgery CVE-2016-3098, GHSA-cc8c-26rj-v2vx | Medium | Not scored | 06 Aug, 2022 | RubyGems administrate |
jQuery UI vulnerable to XSS when refreshing a checkboxradio with an HTML-like initial text label CVE-2022-31160, GHSA-h6gj-6jjq-h8g9 | Medium | 2.7% | 18 Jul, 2022 | Maven org.webjars.npm:jquery-ui NuGet jQuery.UI.Combined RubyGems jquery-ui-rails npm jquery-ui |
Gollum Cross-site Scripting vulnerability via filename parameter to New Page dialog CVE-2020-35305, GHSA-fj2w-qmjp-3rjm | Medium | Not scored | 16 Jul, 2022 | RubyGems gollum |
Ember.js Potential XSS Exploit When Binding `tagName` to User-Supplied Data CVE-2013-4170, GHSA-5m48-c37x-f792 | Medium | Not scored | 01 Jul, 2022 | RubyGems ember-source |
Externally Controlled Reference to a Resource in Another Sphere in ruby-mysql CVE-2021-3779, GHSA-73pr-g6jj-5hc9 | Medium | Not scored | 29 Jun, 2022 | RubyGems ruby-mysql |
Rails::Html::Sanitizer vulnerable to Cross-site Scripting CVE-2022-32209, GHSA-pg8v-g4xq-hww9 | Medium | Not scored | 25 Jun, 2022 | RubyGems rails-html-sanitizer |
Mechanize before v2.8.5 vulnerable to authorization header leak on port redirect CVE-2022-31033, GHSA-64qm-hrgp-pgr9 | Medium | Not scored | 09 Jun, 2022 | RubyGems mechanize |
Use of Uninitialized Variable in trilogy CVE-2022-31026, GHSA-5g4r-2qhx-vqfm | Medium | Not scored | 06 Jun, 2022 | RubyGems trilogy |
Camaleon CMS Stored Cross-site Scripting vulnerability CVE-2021-25969, GHSA-x78v-4fvj-rg9j | Medium | Not scored | 24 May, 2022 | RubyGems camaleon_cms |
Cross site scripting in publify BIT-publify-2021-25974, CVE-2021-25974, GHSA-wmh9-x28j-c6gr | Medium | Not scored | 24 May, 2022 | RubyGems publify_core |
Cross site scripting in publify BIT-publify-2021-25975, CVE-2021-25975, GHSA-3h7v-wqw7-ff28 | Medium | Not scored | 24 May, 2022 | RubyGems publify_core |
net-ldap has weak salt when generating passwords CVE-2014-0083, GHSA-qwgm-mxm4-3q2c | Medium | Not scored | 24 May, 2022 | RubyGems net-ldap |
Camaleon CMS vulnerable to Uncaught Exception CVE-2021-25971, GHSA-r2w2-h6r8-3r53 | Medium | Not scored | 24 May, 2022 | RubyGems camaleon_cms |
Camaleon CMS vulnerable to Server-Side Request Forgery CVE-2021-25972, GHSA-vx6p-q4gj-x6xx | Medium | Not scored | 24 May, 2022 | RubyGems camaleon_cms |
apollo_upload_server has Denial of Service vulnerability BIT-gitlab-2021-39880, CVE-2021-39880, GHSA-w6pv-c757-6rgr | Medium | Not scored | 24 May, 2022 | RubyGems apollo_upload_server |
Smashing Cross-site Scripting vulnerability CVE-2021-35440, GHSA-254j-mmc5-qhpx | Medium | Not scored | 24 May, 2022 | RubyGems smashing |
Nokogiri Implements libxml2 version vulnerable to null pointer dereferencing CVE-2021-3537, GHSA-286v-pcf5-25rc | Medium | Not scored | 24 May, 2022 | RubyGems nokogiri |
Devise Token Auth vulnerable to Cross-site Scripting CVE-2019-16751, GHSA-mvqr-r76c-wm5f | Medium | Not scored | 24 May, 2022 | RubyGems devise_token_auth |
Uninitialized read in Nokogiri gem CVE-2019-13117, GHSA-4hm9-844j-jmxp | Medium | Not scored | 24 May, 2022 | RubyGems nokogiri |
Publify has Improper Access Controls BIT-publify-2022-1810, CVE-2022-1810, GHSA-c273-c6vg-4pv5 | Medium | Not scored | 24 May, 2022 | RubyGems publify_core |
openshift-origin-node Improper Input Validation vulnerability CVE-2014-0084, GHSA-756m-3qf2-hp58 | Medium | Not scored | 17 May, 2022 | RubyGems openshift-origin-node |
Spree does not properly restrict the use of a hash to provide values for a model's attributes CVE-2008-7310, GHSA-7h48-m3rw-vr27 | Medium | Not scored | 17 May, 2022 | RubyGems spree |
Spree uses a hardcoded hash value CVE-2008-7311, GHSA-g466-57gh-cqfw | Medium | Not scored | 17 May, 2022 | RubyGems spree |
Chef Improper Access Control vulnerability CVE-2010-5142, GHSA-f68m-q26r-64f6 | Medium | Not scored | 17 May, 2022 | RubyGems chef |
spree_auth_devise allows remote authenticated users to assign themselves arbitrary roles CVE-2013-2506, GHSA-jp57-9j37-5476 | Medium | Not scored | 17 May, 2022 | RubyGems spree_auth_devise |
Rack-Cache caches sensitive headers CVE-2012-2671, GHSA-hrp6-w4v2-8737 | Medium | Not scored | 17 May, 2022 | RubyGems rack-cache |
Rack Gem Subject to Denial of Service via Hash Collisions CVE-2011-5036, GHSA-v6j3-7jrw-hq2p | Medium | Not scored | 17 May, 2022 | Maven org.jruby:jruby-parent RubyGems rack |
Sup Code Injection vulnerability CVE-2013-4478, GHSA-5f2p-6vjv-2q2m | Medium | Not scored | 17 May, 2022 | RubyGems sup |
Fat Free CRM has fixed token value CVE-2013-7222, GHSA-g897-cgfc-7q8v | Medium | Not scored | 17 May, 2022 | RubyGems fat_free_crm |
Fat Free CRM contains Cross-site Request Forgery vulnerablilities CVE-2013-7223, GHSA-mcvq-7xjq-46x6 | Medium | Not scored | 17 May, 2022 | RubyGems fat_free_crm |
Fat Free CRM allows remote attackers to obtain sensitive information via a direct request CVE-2013-7224, GHSA-4xq9-vw89-p5cx | Medium | Not scored | 17 May, 2022 | RubyGems fat_free_crm |
Fat Free CRM vulnerable to SQL Injection CVE-2013-7225, GHSA-9ggp-5rf4-x7q9 | Medium | Not scored | 17 May, 2022 | RubyGems fat_free_crm |
Fat Free CRM vulnerable to Exposure of Sensitive Information CVE-2013-7249, GHSA-f25h-3mj6-4jpg | Medium | Not scored | 17 May, 2022 | RubyGems fat_free_crm |
RubyGems HTTPS to HTTP redirect CVE-2012-2125, GHSA-228f-g3h7-3fj3 | Medium | Not scored | 17 May, 2022 | RubyGems rubygems-update |
RubyGems does not verify SSL certificate CVE-2012-2126, GHSA-5mgj-mvv8-46mw | Medium | Not scored | 17 May, 2022 | RubyGems rubygems-update |
GitLab Grit Gem for Ruby contains a flaw allowing arbitrary commands to be executed CVE-2013-4489, GHSA-95xq-v4m2-fq3r | Medium | Not scored | 17 May, 2022 | RubyGems gitlab-grit |
Fat Free CRM subject to Cross-site Scripting CVE-2014-5441, GHSA-wcfx-3m6v-4frg | Medium | Not scored | 17 May, 2022 | RubyGems fat_free_crm |
Sup Code Injection vulnerability CVE-2013-4479, GHSA-hh2x-7mf9-78fr | Medium | Not scored | 17 May, 2022 | RubyGems sup |
ccsv Double Free vulnerability CVE-2017-15364, GHSA-5gxp-c379-pj42 | Medium | Not scored | 17 May, 2022 | RubyGems ccsv |
RubyGems Regular Expression Denial of Service CVE-2013-4363, GHSA-9qvm-2vhf-q649 | Medium | Not scored | 17 May, 2022 | RubyGems rubygems-update |
RubyGems Improper Input Validation vulnerability CVE-2015-4020, GHSA-qv62-xfj6-32xm | Medium | Not scored | 17 May, 2022 | RubyGems rubygems-update |