Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Publify exposes article metadata BIT-publify-2022-1553, CVE-2022-1553, GHSA-5jm7-g527-m694 | Medium | Not scored | 17 May, 2022 | RubyGems publify_core |
Publify Incorrect Authorization BIT-publify-2022-0574, CVE-2022-0574, GHSA-79m3-q3wh-c3qm | Medium | Not scored | 17 May, 2022 | RubyGems publify_core |
Publify vulnerable to code injection BIT-publify-2022-0578, CVE-2022-0578, GHSA-w78q-4w34-jrjx | Medium | Not scored | 17 May, 2022 | RubyGems publify_core |
VladTheEnterprising allows local users to write to arbitrary files via a symlink attack CVE-2014-4996, GHSA-x4vj-279x-qwf2 | Medium | Not scored | 14 May, 2022 | RubyGems VladTheEnterprising |
ldap_fluff authentication bypass CVE-2012-5604, GHSA-9whh-582r-589h | Medium | Not scored | 14 May, 2022 | RubyGems ldap_fluff |
Ember.js Cross-site Scripting vulnerability CVE-2014-0013, GHSA-8xm3-gm7c-5fjx | Medium | Not scored | 14 May, 2022 | RubyGems ember-source |
xapian-core Cross-site Scripting vulnerability CVE-2018-0499, GHSA-7qw4-w7hf-22q3 | Medium | Not scored | 14 May, 2022 | RubyGems xapian-core |
Fat Free CRM Cross-Site Request Forgery vulnerability CVE-2015-1585, GHSA-wx7c-8j35-mpg8 | Medium | Not scored | 14 May, 2022 | RubyGems fat_free_crm |
Spree allows remote attackers to obtain sensitive information CVE-2010-3978, GHSA-hwrx-wc75-mgh7 | Medium | Not scored | 14 May, 2022 | RubyGems spree |
ember-source Cross-site Scripting vulnerability CVE-2014-0014, GHSA-rcx6-7jp6-pqf2 | Medium | Not scored | 14 May, 2022 | RubyGems ember-source |
RubyGems Path Traversal vulnerability CVE-2018-1000079, GHSA-8qxg-mff5-j3wc | Medium | Not scored | 14 May, 2022 | Maven org.jruby:jruby-stdlib RubyGems rubygems-update |
RubyGems Regular Expression Denial of Service vulnerability CVE-2013-4287, GHSA-9j7m-rjqx-48vh | Medium | Not scored | 14 May, 2022 | RubyGems rubygems-update |
katello Cross-site Scripting vulnerability CVE-2018-16887, GHSA-mhhc-r88h-2qrm | Medium | Not scored | 14 May, 2022 | RubyGems katello |
RubyGems Improper Input Validation vulnerability CVE-2018-1000077, GHSA-gv86-43rv-79m2 | Medium | Not scored | 14 May, 2022 | Maven org.jruby:jruby-stdlib RubyGems rubygems-update |
RubyGems Cross-site Scripting vulnerability CVE-2018-1000078, GHSA-87qx-g5wg-mwmj | Medium | Not scored | 14 May, 2022 | Maven org.jruby:jruby-stdlib RubyGems rubygems-update |
Puppet does not properly restrict access to node resources CVE-2011-0528, GHSA-9pvx-fwwh-w289 | Medium | Not scored | 14 May, 2022 | RubyGems puppet |
Puppet uses predictable filenames, allowing arbitrary file overwrite CVE-2011-3871, GHSA-mpmx-gm5v-q789 | Medium | Not scored | 14 May, 2022 | RubyGems puppet |
Puppet arbitrary file overwrite CVE-2011-3869, GHSA-8c56-v25w-f89c | Medium | Not scored | 14 May, 2022 | RubyGems puppet |
Puppet allows local users to modify the permissions of arbitrary files CVE-2011-3870, GHSA-qh3g-27jf-3j54 | Medium | Not scored | 14 May, 2022 | RubyGems puppet |
Puppet uses predictable filenames, allowing arbitrary file overwrite CVE-2012-1906, GHSA-c4mc-49hq-q275 | Medium | Not scored | 14 May, 2022 | RubyGems puppet |
Puppet Arbitrary Command Execution CVE-2012-1988, GHSA-6xxq-j39w-g3f6 | Medium | Not scored | 14 May, 2022 | RubyGems puppet |
Puppet Privilege Escallation CVE-2012-1053, GHSA-77hg-g8cc-5r37 | Medium | Not scored | 14 May, 2022 | RubyGems puppet |
Authlogic Information Exposure vulnerability CVE-2012-6497, GHSA-rx7j-mw4c-76g9 | Medium | Not scored | 14 May, 2022 | RubyGems authlogic |
Phusion Passenger incorrect permission assignment CVE-2018-12615, GHSA-4284-jfhc-f854 | Medium | Not scored | 13 May, 2022 | RubyGems passenger |
Tarball permission preservation in puppet CVE-2017-10689, GHSA-vw22-465p-8j5w | Medium | Not scored | 13 May, 2022 | RubyGems puppet |
Logstash Logs Sensitive Information CVE-2016-10362, GHSA-3gg4-6hqg-2vjx | Medium | Not scored | 13 May, 2022 | RubyGems logstash-core |
katello Improper Privilege Management vulnerability CVE-2017-2662, GHSA-cpv6-pfq6-j2v7 | Medium | Not scored | 13 May, 2022 | RubyGems katello |
katello SQL Injection vulnerability CVE-2018-14623, GHSA-jx5v-788g-qw58 | Medium | Not scored | 13 May, 2022 | RubyGems katello |
Gem in a Box vulnerable to Cross-site Scripting CVE-2017-14506, GHSA-98hq-3qvg-pg78 | Medium | Not scored | 13 May, 2022 | RubyGems geminabox |
Phusion Passenger information disclosure CVE-2017-16355, GHSA-cv3f-px9r-54hm | Medium | Not scored | 13 May, 2022 | RubyGems passenger |
Camaleon CMS vulnerable to Stored Cross-site Scripting CVE-2018-18260, GHSA-7f84-9cqf-g4j9 | Medium | Not scored | 13 May, 2022 | RubyGems camaleon_cms |
Bundler may install gems from a different source than expected CVE-2013-0334, GHSA-49jx-9cmc-xjxm | Medium | Not scored | 05 May, 2022 | RubyGems bundler |
Rack arbitrary code execution via timing attack CVE-2013-0263, GHSA-xc85-32mf-xpv8 | Medium | Not scored | 05 May, 2022 | RubyGems rack |
Rack vulnerable to Denial of Service CVE-2013-0184, GHSA-v882-ccj6-jc48 | Medium | Not scored | 05 May, 2022 | RubyGems rack |
Features file injection vulnerability CVE-2013-4318, GHSA-42gq-h7xj-33r4 | Medium | Not scored | 05 May, 2022 | RubyGems features |
Nokogiri vulnerable to DoS while parsing XML documents CVE-2013-6460, GHSA-62qp-3fxm-9wxf | Medium | Not scored | 05 May, 2022 | RubyGems nokogiri |
Nokogiri vulnerable to DoS while parsing XML entities CVE-2013-6461, GHSA-jmhh-w7xp-wg39 | Medium | Not scored | 05 May, 2022 | RubyGems nokogiri |
Mongrel vulnerable to directory traversal via double-encoded sequences CVE-2007-6612, GHSA-m7r6-43v2-49vf | Medium | Not scored | 01 May, 2022 | RubyGems mongrel |
RubyGems file overwrite vulnerability CVE-2007-0469, GHSA-95vx-q4c2-64gr | Medium | Not scored | 01 May, 2022 | RubyGems rubygems-update |
XSS Vulnerability in Action View tag helpers CVE-2022-27777, GHSA-ch3h-j2vf-95pv | Medium | Not scored | 27 Apr, 2022 | RubyGems actionview |
Cross-site Scripting Vulnerability in Action Pack CVE-2022-22577, GHSA-mm33-5vfq-3mm3 | Medium | Not scored | 27 Apr, 2022 | RubyGems actionpack |
Cross site scripting in actionpack Rubygem CVE-2011-1497, GHSA-q58j-fmvf-9rq6 | Medium | Not scored | 22 Apr, 2022 | RubyGems actionpack |
XML Injection in Xerces Java affects Nokogiri GHSA-xxx9-3xcr-gjj3 | Medium | Not scored | 11 Apr, 2022 | RubyGems nokogiri |
Improper one time password handling in devise-two-factor CVE-2021-43177, GHSA-jm35-h8q2-73mp | Medium | Not scored | 07 Apr, 2022 | RubyGems devise-two-factor |
Buffer Overflow in yajl-ruby CVE-2022-24795, GHSA-jj47-x69x-mxrm | Medium | Not scored | 05 Apr, 2022 | RubyGems yajl-ruby |
Hub Package Arbitrary File Overwrite CVE-2014-0177, GHSA-x5m6-jh4r-34mv | Medium | Not scored | 15 Feb, 2022 | Go github.com/github/hub RubyGems hub |
CSRF forgery protection bypass in solidus_frontend CVE-2021-43846, GHSA-h3fg-h5v3-vf8m | Medium | Not scored | 06 Jan, 2022 | RubyGems solidus_frontend |
Path traversal when MessageBus::Diagnostics is enabled CVE-2021-43840, GHSA-xmgj-5fh3-xjmm | Medium | Not scored | 17 Dec, 2021 | RubyGems message_bus |
actionpack Open Redirect in Host Authorization Middleware BIT-rails-2021-44528, CVE-2021-44528, GHSA-qphc-hf5q-v8fc | Medium | Not scored | 14 Dec, 2021 | RubyGems actionpack |
Local Code Execution through Argument Injection via dash leading git url parameter in Gemfile. CVE-2021-43809, GHSA-fj7f-vq84-fh43 | Medium | Not scored | 08 Dec, 2021 | RubyGems bundler |