Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Ensure that doorkeeper_token is valid when authenticating requests in API v2 calls CVE-2020-15269, GHSA-f8cm-364f-q9qh | High | Not scored | 20 Oct, 2020 | RubyGems spree |
Moped Rubygem Data Injection Vulnerability CVE-2015-4410, GHSA-f93j-hmcr-jcwh | High | Not scored | 19 Aug, 2020 | RubyGems moped |
PgHero gem allows CSRF CVE-2020-16253, GHSA-v6fx-752r-ccp2 | High | Not scored | 05 Aug, 2020 | RubyGems pghero |
Missing TLS certificate verification in faye-websocket CVE-2020-15133, GHSA-2v5c-755p-p4gv | High | Not scored | 31 Jul, 2020 | RubyGems faye-websocket |
Missing TLS certificate verification CVE-2020-15134, GHSA-3q49-h8f9-9fr9 | High | Not scored | 31 Jul, 2020 | RubyGems faye |
Unsafe object creation in json RubyGem CVE-2020-10663, GHSA-jphg-qwrw-7w9g | High | Not scored | 27 Jul, 2020 | RubyGems json |
Prototype Pollution in lodash CVE-2020-8203, GHSA-p6mc-m468-83gw | High | 5.2% | 15 Jul, 2020 | RubyGems lodash-rails npm lodash npm lodash-es npm lodash.pick +4 more |
Remote code execution via user-provided local names in ActionView BIT-rails-2020-8163, CVE-2020-8163, GHSA-cr3x-7m39-c6jq | High | Not scored | 07 Jul, 2020 | RubyGems actionview |
Directory traversal in Rack::Directory app bundled with Rack CVE-2020-8161, GHSA-5f9h-9pjv-v6j7 | High | Not scored | 06 Jul, 2020 | RubyGems rack |
Rack allows Percent-encoded cookies to overwrite existing prefixed cookie names CVE-2020-8184, GHSA-j6w9-fv6q-3q52 | High | Not scored | 24 Jun, 2020 | RubyGems rack |
Cross-site Scripting in Sanitize CVE-2020-4054, GHSA-p4x4-rw2p-8j8m | High | Not scored | 16 Jun, 2020 | RubyGems sanitize |
Regular Expression Denial of Service in websocket-extensions (RubyGem) CVE-2020-7663, GHSA-g6wq-qcwm-j5g2, SNYK-RUBY-WEBSOCKETEXTENSIONS-570830 | High | Not scored | 05 Jun, 2020 | RubyGems websocket-extensions |
Circumvention of file size limits in ActiveStorage CVE-2020-8162, GHSA-m42x-37p3-fv5w | High | Not scored | 26 May, 2020 | RubyGems activestorage |
Possible Strong Parameters Bypass in ActionPack CVE-2020-8164, GHSA-8727-m6gj-mc37 | High | Not scored | 26 May, 2020 | RubyGems actionpack |
HTTP Smuggling via Transfer-Encoding Header in Puma CVE-2020-11076, GHSA-x7jg-6pwg-fx5h | High | Not scored | 22 May, 2020 | RubyGems puma |
Information disclosure issue in Active Resource CVE-2020-8151, GHSA-46j2-xjgp-jrfm | High | Not scored | 21 May, 2020 | RubyGems activeresource |
Improper Restriction of Excessive Authentication Attempts in Sorcery CVE-2020-11052, GHSA-jc8m-cxhj-668x | High | Not scored | 07 May, 2020 | RubyGems sorcery |
Exposure of Sensitive Information to an Unauthorized Actor in Doorkeeper CVE-2020-10187, GHSA-j7vx-8mqj-cqp9 | High | Not scored | 07 May, 2020 | RubyGems doorkeeper |
Authentication and extension bypass in Faye CVE-2020-11020, GHSA-qpg4-4w7w-2mq5 | High | Not scored | 29 Apr, 2020 | RubyGems faye |
BSON rubygem contains potential denial of service CVE-2015-4411, GHSA-qh4w-7pw3-p4rp | High | Not scored | 29 Apr, 2020 | RubyGems bson |
Sort order SQL injection in Administrate CVE-2020-5257, GHSA-2p5p-m353-833w | High | Not scored | 13 Mar, 2020 | RubyGems administrate |
Denial of Service in uap-core when processing crafted User-Agent strings GHSA-pcqq-5962-hvcw | High | Not scored | 10 Mar, 2020 | RubyGems user_agent_parser |
libxml as used in Nokogiri has an infinite loop in a certain end-of-file situation CVE-2020-7595, GHSA-7553-jr98-vx47 | High | Not scored | 24 Feb, 2020 | RubyGems nokogiri |
Denial of Service in uap-core when processing crafted User-Agent strings CVE-2020-5243, GHSA-cmcx-xhr8-3w9p | High | 2.3% | 20 Feb, 2020 | RubyGems user_agent_parser npm uap-core |
XSS/Script injection vulnerability in matestack CVE-2020-5241, GHSA-3jqw-vv45-mjhh | High | Not scored | 12 Feb, 2020 | RubyGems matestack-ui-core |
JSON-jwt Gem lacked element count during splitting of JWE string CVE-2019-18848, GHSA-cff7-6h4q-q5pj | High | Not scored | 14 Nov, 2019 | RubyGems json-jwt |
Prototype Pollution in chartkick CVE-2019-18841, GHSA-5pm8-492c-92p5 | High | 1.4% | 11 Nov, 2019 | RubyGems chartkick npm chartkick |
Missing Initialization of Resource in Apache Arrow CVE-2019-12408, GHSA-8cw2-jv5c-c825, PYSEC-2019-195 | High | 3.3% | 08 Nov, 2019 | PyPI pyarrow RubyGems red-arrow |
Missing Initialization of Resource in Apache Arrow CVE-2019-12410, GHSA-cjw4-2w9r-r8mv, PYSEC-2019-196 | High | 4.6% | 08 Nov, 2019 | PyPI pyarrow RubyGems red-arrow |
Ruby_parser-legacy Incorrect Permission Assignment for Critical Resource CVE-2019-18409, GHSA-hhwc-8g49-j8jx | High | Not scored | 25 Oct, 2019 | RubyGems ruby_parser-legacy |
Malicious URL drafting attack against iodines static file server may allow path traversal CVE-2024-22050, GHSA-85rf-xh54-whp3 | High | Not scored | 07 Oct, 2019 | RubyGems iodine |
samlr XML nodes comment attack CVE-2018-20857, GHSA-qpxp-5j56-gg3x | High | Not scored | 31 Jul, 2019 | RubyGems samlr |
OS Command Injection in MiniMagick CVE-2019-13574, GHSA-r7j3-vvh2-xrpj | High | Not scored | 18 Jul, 2019 | RubyGems mini_magick |
OmniAuth-SAML authentication bypass via incorrect XML canonicalization and DOM traversal CVE-2017-11430, GHSA-94hm-8q65-rmxm | High | Not scored | 05 Jul, 2019 | RubyGems omniauth-saml |
Ruby-SAML Improper Authentication vulnerability CVE-2017-11428, GHSA-x2fr-v8wf-8wwv | High | Not scored | 05 Jul, 2019 | RubyGems ruby-saml |
Path Traversal vulnerability that affects yard CVE-2019-1020001, GHSA-xfhh-rx56-rxcr | High | Not scored | 02 Jul, 2019 | RubyGems yard |
RubyGems Escape sequence injection in errors CVE-2019-8325, GHSA-4wm8-fjv7-j774 | High | Not scored | 20 Jun, 2019 | RubyGems rubygems-update |
RubyGems Delete directory using symlink when decompressing tar CVE-2019-8320, GHSA-5x32-c9mf-49cc | High | Not scored | 20 Jun, 2019 | RubyGems rubygems-update |
Code injection in RubyGems CVE-2019-8324, GHSA-76wm-422q-92mq | High | Not scored | 20 Jun, 2019 | RubyGems rubygems-update |
RubyGems Escape sequence injection vulnerability in verbose CVE-2019-8321, GHSA-fr32-gr5c-xq5c | High | Not scored | 20 Jun, 2019 | RubyGems rubygems-update |
RubyGems Escape sequence injection vulnerability in gem owner CVE-2019-8322, GHSA-mh37-8c3g-3fgc | High | Not scored | 20 Jun, 2019 | RubyGems rubygems-update |
RubyGems Escape sequence injection vulnerability in api response handling CVE-2019-8323, GHSA-3h4r-pjv6-cph9 | High | Not scored | 20 Jun, 2019 | RubyGems rubygems-update |
OmniAuth Ruby gem Cross-site Request Forgery in request phase CVE-2015-9284, GHSA-ww4x-rwq6-qpgf | High | Not scored | 29 May, 2019 | RubyGems omniauth |
Improper Certificate Validation in chloride CVE-2018-6517, GHSA-573x-jhqh-jg36 | High | Not scored | 25 Mar, 2019 | RubyGems chloride |
Path Traversal in Action View CVE-2019-5418, GHSA-86g5-2wh3-gc9j | HighExploited | 98.5% | 13 Mar, 2019 | RubyGems actionview |
Denial of Service Vulnerability in Action View CVE-2019-5419, GHSA-m63j-wh5w-c252 | High | Not scored | 13 Mar, 2019 | RubyGems actionview |
Prototype Pollution in lodash CVE-2018-16487, GHSA-4xc9-xhrj-v574 | High | 1.5% | 01 Feb, 2019 | RubyGems lodash-rails npm lodash |
Nokogiri NULL Pointer Dereference CVE-2018-14404, GHSA-6qvp-r6r3-9p7h | High | Not scored | 17 Jan, 2019 | RubyGems nokogiri |
Improper Access Control in activejob CVE-2018-16476, GHSA-q2qw-rmrh-vv42 | High | Not scored | 05 Dec, 2018 | RubyGems activejob |
Rack vulnerable to Denial of Service CVE-2018-16470, GHSA-hg78-4f6x-99wq | High | Not scored | 15 Nov, 2018 | RubyGems rack |