Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Jekyll allows attackers to access arbitrary files by specifying a symlink CVE-2018-17567, GHSA-4xjh-m3qx-49wc | High | Not scored | 28 Sep, 2018 | RubyGems jekyll |
Denial of service or RCE from libxml2 and libxslt CVE-2015-8806, GHSA-7hp2-xwpj-95jq | High | Not scored | 17 Sep, 2018 | RubyGems nokogiri |
Ruby-ffi has a DLL loading issue CVE-2018-1000201, GHSA-2gw2-8q9w-cw8p | High | Not scored | 31 Aug, 2018 | RubyGems ffi |
Spina gem vulnerable to Cross-site request forgery (CSRF) vulnerability CVE-2015-4619, GHSA-2hxv-mx8x-mcj9 | High | Not scored | 28 Aug, 2018 | RubyGems spina |
Nokogiri subject to DoS via libxml2 vulnerability CVE-2015-5312, GHSA-xjqg-9jvg-fgx2 | High | Not scored | 21 Aug, 2018 | RubyGems nokogiri |
Ruby-saml allows attackers to perform XML signature wrapping attacks CVE-2016-5697, GHSA-36p7-xjw8-h6f2 | High | Not scored | 21 Aug, 2018 | RubyGems ruby-saml |
Phusion Passenger uses a known /tmp filename CVE-2016-10345, GHSA-cqxw-3p7v-p9gr | High | Not scored | 21 Aug, 2018 | RubyGems passenger |
redcarpet Buffer Overflow vulnerability CVE-2015-5147, GHSA-7322-9mx6-5j2m | High | Not scored | 15 Aug, 2018 | RubyGems redcarpet |
git-fastclone permits arbitrary shell command execution from .gitmodules CVE-2015-8968, GHSA-8gg6-3r63-25m8 | High | Not scored | 15 Aug, 2018 | RubyGems git-fastclone |
Doorkeeper subject to Incorrect Permission Assignment CVE-2018-1000211, GHSA-694m-jhr9-pf77 | High | Not scored | 13 Aug, 2018 | RubyGems doorkeeper |
Cross-site request forgery in rails_admin CVE-2016-10522, GHSA-pxqr-8v54-m2hj | High | Not scored | 08 Aug, 2018 | RubyGems rails_admin |
Nokogiri implementation of libxslt lacks integer overflow checks CVE-2017-5029, GHSA-pf6m-fxpq-fg8v | High | Not scored | 31 Jul, 2018 | RubyGems nokogiri |
Missing Regex anchor in Rack-Cors allows malicious third party site to perform CORS request CVE-2017-11173, GHSA-2j9c-9vmv-7m39 | High | Not scored | 31 Jul, 2018 | RubyGems rack-cors |
private_address_check contains race condition CVE-2018-3759, GHSA-2xvj-j3qh-x8c3 | High | Not scored | 31 Jul, 2018 | RubyGems private_address_check |
Kcapifony gem for Ruby places database user passwords on the command line CVE-2014-5001, GHSA-6fcq-3cm2-j3j5 | High | Not scored | 23 Jul, 2018 | RubyGems kcapifony |
Sprockets path traversal leads to information leak CVE-2018-3760, GHSA-pr3h-jjhj-573x | High | Not scored | 20 Jun, 2018 | RubyGems sprockets |
Sanitize vulnerable to Improper Input Validation and Cross-site Scripting CVE-2018-3740, GHSA-7f42-p84j-f58p | High | Not scored | 21 Mar, 2018 | RubyGems sanitize |
Cap-Strap gem for Ruby places credentials on the useradd command line CVE-2014-4992, GHSA-pcm6-g2qp-9gw8 | High | Not scored | 16 Mar, 2018 | RubyGems cap-strap |
brbackup exposes database password to unauthorized users CVE-2014-5004, GHSA-vqcm-7f7f-r539 | High | Not scored | 05 Mar, 2018 | RubyGems brbackup |
Omniauth allows POST parameters to be stored in session CVE-2017-18076, GHSA-9pr6-grf4-x2fr | High | Not scored | 29 Jan, 2018 | RubyGems omniauth |
lynx doesn't properly sanitize user input and exposes database password to unauthorized users CVE-2014-5002, GHSA-94cq-7ccq-cmcm | High | Not scored | 24 Jan, 2018 | RubyGems lynx |
lawn-login exposes database password to unauthorized users CVE-2014-5000, GHSA-rhgq-vv9x-j4p5 | High | Not scored | 22 Jan, 2018 | RubyGems lawn-login |
Denial of Service in jquery CVE-2016-10707, GHSA-mhpp-875w-9cpv | High | 3.2% | 18 Jan, 2018 | Maven org.webjars.npm:jquery NuGet jQuery RubyGems jquery-rails npm jquery |
Arbitrary file read vulnerability in yard server CVE-2017-17042, GHSA-gj4p-3wh3-2rmf | High | Not scored | 21 Dec, 2017 | RubyGems yard |
Out-of-bounds read in nokogiri CVE-2017-9050, GHSA-8c56-cpmw-89x7 | High | Not scored | 13 Dec, 2017 | RubyGems nokogiri |
private_address_check contains Incomplete List of Disallowed Inputs CVE-2017-0909, GHSA-3v3c-r5v2-68ph | High | Not scored | 30 Nov, 2017 | RubyGems private_address_check |
yajl-ruby gem Denial of Service vulnerability CVE-2017-16516, GHSA-wwh7-4jw9-33x6 | High | Not scored | 28 Nov, 2017 | RubyGems yajl-ruby |
Ox gem crashes due to a crafted input CVE-2017-15928, GHSA-pjj4-w39g-pw54 | High | Not scored | 21 Nov, 2017 | RubyGems ox |
gollum and gollum-lib allow remote authenticated users to execute arbitrary code CVE-2014-9489, GHSA-q97v-764g-r2rp | High | Not scored | 16 Nov, 2017 | RubyGems gollum RubyGems gollum-lib |
Remote code execution in rwiki CVE-2006-2582, GHSA-wwmf-6p58-6vj2 | High | Not scored | 24 Oct, 2017 | RubyGems rwiki |
Ruby on Rails vulnerable to code injection CVE-2006-4111, GHSA-rvpq-5xqx-pfpp | High | Not scored | 24 Oct, 2017 | RubyGems rails |
Rails Denial of Service vulnerability CVE-2006-4112, GHSA-9wrq-xvmp-xjc8 | High | Not scored | 24 Oct, 2017 | RubyGems rails |
Rails ActiveRecord gem vulnerable to SQL injection CVE-2008-4094, GHSA-xf96-32q2-9rw2 | High | Not scored | 24 Oct, 2017 | RubyGems activerecord |
High severity vulnerability that affects thin CVE-2009-3287, GHSA-j24p-r6wx-r79w | High | Not scored | 24 Oct, 2017 | RubyGems thin |
activerecord vulnerable to SQL Injection CVE-2011-0448, GHSA-jmm9-2p29-vh2w | High | Not scored | 24 Oct, 2017 | RubyGems activerecord |
actionpack allows remote attackers to bypass intended access restrictions CVE-2011-0449, GHSA-4ww3-3rxj-8v6q | High | Not scored | 24 Oct, 2017 | RubyGems actionpack |
activerecord vulnerable to SQL Injection CVE-2011-2930, GHSA-h6w6-xmqv-7q78 | High | Not scored | 24 Oct, 2017 | RubyGems activerecord |
Mail Gem Improper Input Validation vulnerability CVE-2012-2140, GHSA-rp63-jfmw-532w | High | Not scored | 24 Oct, 2017 | RubyGems mail |
activerecord vulnerable to SQL Injection CVE-2012-2695, GHSA-76wq-xw4h-f8wj | High | Not scored | 24 Oct, 2017 | RubyGems activerecord |
Active Record contains SQL Injection CVE-2012-6496, GHSA-gh2w-j7cx-2664 | High | Not scored | 24 Oct, 2017 | RubyGems activerecord |
actionpack Improper Input Validation vulnerability CVE-2013-0156, GHSA-jmgw-6vjg-jjwg | High | Not scored | 24 Oct, 2017 | RubyGems actionpack |
Improper Input Validation in multi_xml CVE-2013-0175, GHSA-pchc-949f-53m5 | High | Not scored | 24 Oct, 2017 | RubyGems multi_xml |
JSON gem has Improper Input Validation vulnerability CVE-2013-0269, GHSA-x457-cw4h-hq5f | High | Not scored | 24 Oct, 2017 | RubyGems json |
nori contains Improper Input Validation CVE-2013-0285, GHSA-4936-rj25-6wm6 | High | Not scored | 24 Oct, 2017 | RubyGems nori |
activesupport in Rails vulnerable to incorrect data conversion CVE-2013-0333, GHSA-xgr2-v94m-rc9g | High | Not scored | 24 Oct, 2017 | RubyGems activesupport |
Puppet Improper Input Validation vulnerability CVE-2013-1655, GHSA-574q-fxfj-wv6h | High | Not scored | 24 Oct, 2017 | RubyGems puppet |
Dragonfly Code Injection vulnerability CVE-2013-1756, GHSA-p463-639r-q9g9 | High | Not scored | 24 Oct, 2017 | RubyGems dragonfly |
crack does not properly restrict casts of string values CVE-2013-1800, GHSA-m7fq-cf8q-35q7 | High | Not scored | 24 Oct, 2017 | RubyGems crack |
HTTParty does not restrict casts of string values CVE-2013-1801, GHSA-mgx3-27hr-mfgp | High | Not scored | 24 Oct, 2017 | RubyGems httparty |
extlib does not properly restrict casts of string values CVE-2013-1802, GHSA-9h36-4jf2-hx53 | High | Not scored | 24 Oct, 2017 | RubyGems extlib |