Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Silent Configuration Failure in Puppet Agent CVE-2021-27025, GHSA-q4g7-jrxv-67r9 | Medium | Not scored | 02 Dec, 2021 | RubyGems puppet |
Unsafe HTTP Redirect in Puppet Agent and Puppet Server CVE-2021-27023, GHSA-93j5-g845-9wqp | Medium | Not scored | 02 Dec, 2021 | RubyGems puppet |
Rails Multisite secure/signed cookies share secrets between sites in a multi-site application CVE-2021-41263, GHSA-844m-cpr9-jcmh | Medium | Not scored | 15 Nov, 2021 | RubyGems rails_multisite |
Publify `guest` role users can self-register even when the admin does not allow it BIT-publify-2021-25973, CVE-2021-25973, GHSA-x24j-87x9-jvv5 | Medium | Not scored | 03 Nov, 2021 | RubyGems publify_core |
ReDoS vulnerability in parser_apache2 BIT-fluentd-2021-41186, CVE-2021-41186, GHSA-hwhf-64mh-r662 | Medium | Not scored | 01 Nov, 2021 | RubyGems fluentd |
XSS in `*Text` options of the Datepicker widget in jquery-ui BIT-drupal-2021-41183, CVE-2021-41183, GHSA-j7qv-pgf6-hvh4 | Medium | 8.5% | 26 Oct, 2021 | Maven org.webjars.npm:jquery-ui NuGet jQuery.UI.Combined RubyGems jquery-ui-rails npm jquery-ui |
XSS in the `of` option of the `.position()` util in jquery-ui BIT-drupal-2021-41184, CVE-2021-41184, GHSA-gpqq-952q-5327 | Medium | 40.8% | 26 Oct, 2021 | Maven org.webjars.npm:jquery-ui NuGet jQuery.UI.Combined RubyGems jquery-ui-rails npm jquery-ui |
XSS in the `altField` option of the Datepicker widget in jquery-ui BIT-drupal-2021-41182, CVE-2021-41182, GHSA-9gj3-hwp5-pmwc | Medium | 39.4% | 26 Oct, 2021 | Maven org.webjars.npm:jquery-ui NuGet jQuery.UI.Combined RubyGems jquery-ui-rails npm jquery-ui |
Cross-site Scripting in Sidekiq CVE-2021-30151, GHSA-grh7-935j-hg6w | Medium | Not scored | 06 Oct, 2021 | RubyGems sidekiq |
Older releases of better_errors open to Cross-Site Request Forgery attack CVE-2021-39197, GHSA-w3j4-76qw-wwjm | Medium | Not scored | 07 Sep, 2021 | RubyGems better_errors |
Open Redirect in ActionPack CVE-2021-22942, GHSA-2rqw-v265-jf8c | Medium | Not scored | 26 Aug, 2021 | RubyGems actionpack |
Cross-Site Scripting in Qiita-Markdown CVE-2021-28796, GHSA-f2c9-5jqw-3xh3 | Medium | Not scored | 02 Aug, 2021 | RubyGems qiita-markdown |
qiita-markdown Cross-site Scripting vulnerability CVE-2021-28833, GHSA-9p29-94hp-8rvc | Medium | Not scored | 02 Aug, 2021 | RubyGems qiita-markdown |
Potential Denial-of-Service in bindata BIT-gitlab-2021-32823, CVE-2021-32823, GHSA-hj56-84jw-67h6 | Medium | Not scored | 23 Jun, 2021 | RubyGems bindata |
Nokogiri updates packaged dependency on libxml2 from 2.9.10 to 2.9.12 CVE-2021-47996, GHSA-7rrm-v45f-jp64 | Medium | Not scored | 17 May, 2021 | RubyGems nokogiri |
Possible Open Redirect Vulnerability in Action Pack CVE-2021-22903, GHSA-5hq2-xf89-9jxq | Medium | Not scored | 05 May, 2021 | RubyGems actionpack |
Gon gem lack of escaping certain input when outputting as JSON CVE-2020-25739, GHSA-78vq-9j56-wrfr | Medium | Not scored | 30 Apr, 2021 | RubyGems gon |
Improper Certificate Validation in TweetStream CVE-2020-24393, GHSA-6hrm-jqp3-64cv | Medium | Not scored | 13 Apr, 2021 | RubyGems tweetstream |
Improper Certificate Validation in Puppet CVE-2020-7942, GHSA-gqvf-892r-vjm5 | Medium | Not scored | 13 Apr, 2021 | RubyGems puppet |
Cross-site scripting in actionpack CVE-2020-8264, GHSA-35mm-cc6r-8fjp | Medium | Not scored | 07 Apr, 2021 | RubyGems actionpack |
Improper Certificate Validation in twitter-stream CVE-2020-24392, GHSA-p6p8-q4pj-f74m | Medium | Not scored | 29 Mar, 2021 | RubyGems twitter-stream |
Activerecord-session_store Vulnerable to Timing Attack CVE-2019-25025, GHSA-cvw2-xj8r-mjf7 | Medium | Not scored | 09 Mar, 2021 | RubyGems activerecord-session_store |
Actionpack Open Redirect Vulnerability CVE-2021-22881, GHSA-8877-prq4-9xfw | Medium | Not scored | 02 Mar, 2021 | RubyGems actionpack |
Regular Expression Denial of Service (ReDoS) in lodash CVE-2020-28500, GHSA-29mw-wpgm-hmr9 | Medium | 7.3% | 15 Feb, 2021 | RubyGems lodash-rails npm lodash npm lodash-es npm lodash.trim +1 more |
Server-side request forgery in CarrierWave CVE-2021-21288, GHSA-fwcm-636p-68r5 | Medium | Not scored | 08 Feb, 2021 | RubyGems carrierwave |
rails_admin ruby gem XSS vulnerability CVE-2020-36190, GHSA-wjx2-7hqq-8h7m | Medium | Not scored | 14 Jan, 2021 | RubyGems rails_admin |
Injection/XSS in Redcarpet CVE-2020-26298, GHSA-q3wr-qw3g-3p4h | Medium | Not scored | 11 Jan, 2021 | RubyGems redcarpet |
Nokogiri::XML::Schema trusts input by default, exposing risk of XXE vulnerability CVE-2020-26247, GHSA-vr8q-g5c7-m54m | Medium | Not scored | 30 Dec, 2020 | RubyGems nokogiri |
Possible timing attack in derivation_endpoint CVE-2020-15237, GHSA-5jjv-x4fq-qjwp | Medium | Not scored | 05 Oct, 2020 | RubyGems shrine |
XSS in Action View CVE-2020-15169, GHSA-cfjv-5498-mph5 | Medium | Not scored | 11 Sep, 2020 | RubyGems actionview |
CSS Injection in Chartkick gem CVE-2020-16254, GHSA-3j95-fjv2-3m4p | Medium | Not scored | 12 Aug, 2020 | RubyGems chartkick |
Field Test CSRF vulnerability CVE-2020-16252, GHSA-w542-cpp9-r3g7 | Medium | Not scored | 05 Aug, 2020 | RubyGems field_test |
Ability to change order address without triggering address validations in solidus CVE-2020-15109, GHSA-3mvg-rrrw-m7ph | Medium | Not scored | 04 Aug, 2020 | RubyGems solidus_api RubyGems solidus_frontend |
CSRF Vulnerability in rails-ujs CVE-2020-8167, GHSA-xq5j-gw7f-jgj8 | Medium | Not scored | 07 Jul, 2020 | RubyGems actionview |
Untrusted users can run pending migrations in production in Rails CVE-2020-8185, GHSA-c6qr-h5vq-59jc | Medium | Not scored | 24 Jun, 2020 | RubyGems actionpack |
Cross-Site Scripting in Kaminari CVE-2020-11082, GHSA-r5jw-62xg-j433 | Medium | Not scored | 28 May, 2020 | RubyGems kaminari |
Ability to forge per-form CSRF tokens in Rails CVE-2020-8166, GHSA-jp5v-5gx4-jmj9 | Medium | Not scored | 26 May, 2020 | RubyGems actionpack |
HTTP Smuggling via Transfer-Encoding Header in Puma CVE-2020-11077, GHSA-w64w-qqph-5gxm | Medium | Not scored | 22 May, 2020 | RubyGems puma |
Cross-Site Scripting in jquery CVE-2020-7656, GHSA-q4m3-2j7h-f7xw, SNYK-JS-JQUERY-569619 | Medium | 6.4% | 19 May, 2020 | Maven org.webjars.npm:jquery NuGet jQuery RubyGems jquery-rails npm jquery |
Potential XSS vulnerability in jQuery BIT-drupal-2020-11022, CVE-2020-11022, GHSA-gxr4-xjj5-5px2 | Medium | 99.2% | 29 Apr, 2020 | Maven org.webjars.npm:jquery NuGet jquery Packagist athlon1600/youtube-downloader Packagist components/jquery +3 more |
Potential XSS vulnerability in jQuery BIT-drupal-2020-11023, CVE-2020-11023, GHSA-jpcq-cgw6-v4j6 | MediumExploited | 84.9% | 29 Apr, 2020 | Maven org.webjars.npm:jquery NuGet jQuery Packagist components/jquery RubyGems jquery-rails +1 more |
Cross site scripting vulnerability in ActionView CVE-2020-5267, GHSA-65cv-r6x7-79hv | Medium | Not scored | 19 Mar, 2020 | RubyGems actionview |
HTTP Response Splitting (Early Hints) in Puma CVE-2020-5249, GHSA-33vf-4xgg-9r58 | Medium | Not scored | 03 Mar, 2020 | RubyGems puma |
OS Command Injection in Rake CVE-2020-8130, GHSA-jppv-gw3r-w3q8 | Medium | Not scored | 28 Feb, 2020 | RubyGems rake |
HTTP Response Splitting in Puma BIT-ruby-2020-5247, BIT-ruby-min-2020-5247, CVE-2020-5247, GHSA-84j7-475p-hp8v | Medium | Not scored | 28 Feb, 2020 | RubyGems puma |
Directive injection when using dynamic overrides with user input CVE-2020-5217, GHSA-xq52-rv6w-397c | Medium | Not scored | 23 Jan, 2020 | RubyGems secure_headers |
Limited header injection when using dynamic overrides with user input in RubyGems secure_headers CVE-2020-5216, GHSA-w978-rmpf-qmwg | Medium | Not scored | 23 Jan, 2020 | RubyGems secure_headers |
Possible Information Leak / Session Hijack Vulnerability in Rack CVE-2019-16782, GHSA-hrqr-hxpp-chr3 | Medium | Not scored | 18 Dec, 2019 | RubyGems rack |
In RubyGem excon, interrupted Persistent Connections May Leak Response Data CVE-2019-16779, GHSA-q58g-455p-8vw9 | Medium | Not scored | 16 Dec, 2019 | RubyGems excon |
A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack CVE-2019-16770, GHSA-7xx3-m584-x994 | Medium | Not scored | 05 Dec, 2019 | RubyGems puma |