Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
The rack-cors rubygem may allow directory traveral CVE-2019-18978, GHSA-pf8f-w267-mq2h | Medium | Not scored | 15 Nov, 2019 | RubyGems rack-cors |
Loofah Allows Cross-site Scripting CVE-2019-15587, GHSA-c3gv-9cxf-6f57 | Medium | Not scored | 05 Nov, 2019 | RubyGems loofah |
Haml vulnerable to cross-site scripting CVE-2017-1002201, GHSA-r53w-g4xm-3gc6, SNYK-RUBY-HAML-20362 | Medium | Not scored | 21 Oct, 2019 | RubyGems haml |
Rubyzip denial of service CVE-2019-16892, GHSA-5m2v-hc64-56h6 | Medium | Not scored | 30 Sep, 2019 | RubyGems rubyzip |
Cross-site scripting in padrino-contrib CVE-2019-16145, GHSA-rwpr-83g3-96g7 | Medium | Not scored | 23 Sep, 2019 | RubyGems padrino-contrib |
Authentication Bypass in Devise CVE-2019-16109, GHSA-fcjw-8rhj-gwwc | Medium | Not scored | 11 Sep, 2019 | RubyGems devise |
Cross-site scripting in fat_free_crm CVE-2018-20975, GHSA-4p8f-mmfj-r45g | Medium | Not scored | 21 Aug, 2019 | RubyGems fat_free_crm |
Regular Expression Denial of Service (ReDoS) in lodash CVE-2019-1010266, GHSA-x5rq-j2xg-h7qm, SNYK-JS-LODASH-73639 | Medium | 3.0% | 17 Jul, 2019 | RubyGems lodash-rails npm lodash npm lodash-amd npm lodash-es |
field_test gem contains injection vulnerability CVE-2019-13146, GHSA-wg9m-gw3h-hg83 | Medium | Not scored | 16 Jul, 2019 | RubyGems field_test |
Cross-site Scripting in Chartkick CVE-2019-12732, GHSA-g45g-g52h-39rg | Medium | Not scored | 07 Jun, 2019 | RubyGems chartkick |
XSS in jQuery as used in Drupal, Backdrop CMS, and other products CVE-2019-11358, DRUPAL-CORE-2019-006, GHSA-6c3j-c64m-qhgq, PYSEC-2026-628, SNYK-JS-JQUERY-174006 | Medium | 86.8% | 17 Apr, 2019 | Maven org.webjars.npm:jquery NuGet jQuery Packagist drupal/core Packagist maximebf/debugbar +3 more |
Doorkeeper-openid_connect contains Open Redirect CVE-2019-9837, GHSA-vv4c-g6q7-p3q7 | Medium | Not scored | 25 Mar, 2019 | RubyGems doorkeeper-openid_connect |
devise Time-of-check Time-of-use Race Condition vulnerability CVE-2019-5421, GHSA-73rf-6mrf-759q | Medium | Not scored | 19 Mar, 2019 | RubyGems devise |
Bootstrap Vulnerable to Cross-Site Scripting CVE-2019-8331, GHSA-9v3m-8fp8-mj99 | Medium | 16.4% | 20 Feb, 2019 | Maven org.webjars:bootstrap NuGet Bootstrap.Less NuGet bootstrap NuGet bootstrap.sass +6 more |
bootstrap Cross-site Scripting vulnerability CVE-2018-20677, GHSA-ph58-4vrj-w6hr | Medium | 4.0% | 09 Jan, 2019 | Maven org.webjars:bootstrap NuGet bootstrap Packagist twbs/bootstrap RubyGems bootstrap +3 more |
XSS vulnerability that affects bootstrap CVE-2018-20676, GHSA-3mgp-fx93-9xv5 | Medium | 3.8% | 09 Jan, 2019 | Maven org.webjars:bootstrap NuGet bootstrap Packagist twbs/bootstrap RubyGems bootstrap +3 more |
Bootstrap Cross-site Scripting vulnerability CVE-2016-10735, GHSA-4p24-vmcr-4gqj | Medium | 4.0% | 09 Jan, 2019 | Maven org.webjars:bootstrap NuGet bootstrap NuGet bootstrap.sass Packagist twbs/bootstrap +4 more |
Cross Site Scripting (XSS) vulnerability in easymon CVE-2018-1000855, GHSA-c289-47qf-rvrr | Medium | Not scored | 21 Dec, 2018 | RubyGems easymon |
Fat Free CRM vulnerable to Cross-site Scripting CVE-2018-1000842, GHSA-j5rj-g695-342r | Medium | Not scored | 20 Dec, 2018 | RubyGems fat_free_crm |
Exposure of Sensitive Information to an Unauthorized Actor in activestorage CVE-2018-16477, GHSA-7rr7-rcjw-56vj | Medium | Not scored | 05 Dec, 2018 | RubyGems activestorage |
Rack vulnerable to Cross-site Scripting CVE-2018-16471, GHSA-5r2p-j47h-mhpg | Medium | Not scored | 15 Nov, 2018 | RubyGems rack |
Loofah Cross-site Scripting vulnerability CVE-2018-16468, GHSA-g4xq-jx4w-4cjv | Medium | Not scored | 01 Nov, 2018 | RubyGems loofah |
Heap-based buffer overflow in nokogiri CVE-2015-7499, GHSA-jxjr-5h69-qw3w | Medium | Not scored | 17 Sep, 2018 | RubyGems nokogiri |
Doorkeeper vulnerable to Cross-site Request Forgery CVE-2014-8144, GHSA-685w-vc84-wxcx | Medium | Not scored | 17 Sep, 2018 | RubyGems doorkeeper |
ember-source vulnerable to Cross-site Scripting CVE-2015-1866, GHSA-mp78-r56v-45qc | Medium | Not scored | 28 Aug, 2018 | RubyGems ember-source |
Tinfoil Devise-two-factor does not "burn" a successfully validated one-time password (OTP) CVE-2015-7225, GHSA-x489-jjwm-52g7 | Medium | Not scored | 28 Aug, 2018 | RubyGems devise-two-factor |
Gollum Exposure of Sensitive Information CVE-2015-7314, GHSA-m2q3-53fq-7h66 | Medium | Not scored | 28 Aug, 2018 | RubyGems gollum |
ember-source Cross-site Scripting vulnerability CVE-2015-7565, GHSA-m3q7-rj8g-m457 | Medium | Not scored | 28 Aug, 2018 | RubyGems ember-source |
grape subject to Cross-site Scripting CVE-2018-3769, GHSA-f599-5m7p-hcpf | Medium | Not scored | 13 Aug, 2018 | RubyGems grape |
Nokogiri vulnerable to libxml XML Entity Expansion CVE-2015-1819, GHSA-q7wx-62r7-j2x7 | Medium | Not scored | 08 Aug, 2018 | RubyGems nokogiri |
Json-jwt did not verify the cryptographic signature for data CVE-2018-1000539, GHSA-mj4x-wcxf-hm8x | Medium | Not scored | 31 Jul, 2018 | RubyGems json-jwt |
radiant vulnerable to Cross-site Scripting CVE-2018-7261, GHSA-gp82-xr77-88f4 | Medium | Not scored | 27 Jul, 2018 | RubyGems radiant |
Ciborg gem for Ruby allows local users to write files and gain privileges via Symlink CVE-2014-5003, GHSA-g982-9r8g-6qxw | Medium | Not scored | 23 Jul, 2018 | RubyGems ciborg |
Bootstrap Cross-site Scripting vulnerability CVE-2018-14042, GHSA-7mvr-5x2g-wfc8 | Medium | 4.0% | 13 Jul, 2018 | Maven org.webjars:bootstrap NuGet bootstrap NuGet bootstrap.sass Packagist twbs/bootstrap +4 more |
Bootstrap Cross-site Scripting vulnerability CVE-2018-14041, GHSA-pj7m-g53m-7638 | Medium | 4.3% | 13 Jul, 2018 | Maven org.webjars:bootstrap NuGet bootstrap NuGet bootstrap.sass Packagist twbs/bootstrap +4 more |
Bootstrap vulnerable to Cross-Site Scripting (XSS) CVE-2018-14040, GHSA-3wqf-4x89-9g79 | Medium | 4.1% | 13 Jul, 2018 | Maven org.webjars:bootstrap NuGet bootstrap NuGet bootstrap.sass Packagist twbs/bootstrap +3 more |
Prototype Pollution in lodash CVE-2018-3721, GHSA-fvqr-27wr-82fm | Medium | 2.3% | 07 Jun, 2018 | RubyGems lodash-rails npm lodash |
Sinatra Cross-site Scripting vulnerability CVE-2018-11627, GHSA-mq35-wqvf-r23c | Medium | Not scored | 05 Jun, 2018 | RubyGems sinatra |
rails-html-sanitizer Cross-site Scripting vulnerability CVE-2018-3741, GHSA-px3r-jm9g-c8w8 | Medium | Not scored | 26 Apr, 2018 | RubyGems rails-html-sanitizer |
Uncontrolled resource consumption in nokogiri CVE-2017-18258, GHSA-882p-jqgm-f45g | Medium | Not scored | 13 Apr, 2018 | RubyGems nokogiri |
Cross-site Scripting in loofah CVE-2018-8048, GHSA-x7rv-cr6v-4vm4 | Medium | Not scored | 21 Mar, 2018 | RubyGems loofah RubyGems nokogiri |
Doorkeeper is vulnerable to stored XSS and code execution CVE-2018-1000088, GHSA-hwhh-2fwm-cfgw | Medium | Not scored | 13 Mar, 2018 | RubyGems doorkeeper |
http vulnerable to Exposure of Sensitive Information to an Unauthorized Actor CVE-2015-1828, GHSA-6wpv-cj6x-v3jw | Medium | Not scored | 13 Mar, 2018 | RubyGems http |
rack-protection gem timing attack vulnerability when validating CSRF token CVE-2018-1000119, GHSA-688c-3x49-6rqj | Medium | Not scored | 07 Mar, 2018 | RubyGems rack-protection |
rails_admin ruby gem XSS CVE-2017-12098, GHSA-pxr8-w3jq-rcwj | Medium | Not scored | 05 Mar, 2018 | RubyGems rails_admin |
delayed_job_web Cross-site Scripting vulnerability CVE-2017-12097, GHSA-w7q9-xr2x-wh7x | Medium | Not scored | 05 Mar, 2018 | RubyGems delayed_job_web |
Ox gem stack overflow in sax_parse CVE-2017-16229, GHSA-wfwm-chj7-w59r | Medium | Not scored | 05 Mar, 2018 | RubyGems ox |
Sinatra Path Traversal vulnerability CVE-2018-7212, GHSA-h29f-7f56-j8wh | Medium | Not scored | 20 Feb, 2018 | RubyGems sinatra |
Gyazo allows local users to write arbitrary files CVE-2014-4994, GHSA-6x45-86q6-rcmr | Medium | Not scored | 22 Jan, 2018 | RubyGems gyazo |
Cross-Site Scripting (XSS) in jquery CVE-2015-9251, GHSA-rmxg-73gg-4p98 | Medium | 29.7% | 18 Jan, 2018 | Maven org.webjars.npm:jquery NuGet jQuery RubyGems jquery-rails npm jquery |