Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Externally Controlled Reference to a Resource in Another Sphere in ruby-mysql CVE-2021-3779, GHSA-73pr-g6jj-5hc9 | Medium | 1.2% | 29 Jun, 2022 | RubyGems ruby-mysql |
Rails::Html::Sanitizer vulnerable to Cross-site Scripting CVE-2022-32209, GHSA-pg8v-g4xq-hww9 | Medium | 26.5% | 25 Jun, 2022 | RubyGems rails-html-sanitizer |
Improper handling of double quotes in file name in Diffy in Windows environment CVE-2022-33127, GHSA-5ww9-9qp2-x524 | Critical | 1.8% | 24 Jun, 2022 | RubyGems diffy |
Octokit gem published with world-writable files CVE-2022-31072, GHSA-g28x-pgr3-qqx6 | Low | 0.3% | 15 Jun, 2022 | RubyGems octokit |
Octopoller gem published with world-writable files CVE-2022-31071, GHSA-26qj-cr27-r5c4 | Low | 0.2% | 15 Jun, 2022 | RubyGems octopoller |
Mechanize before v2.8.5 vulnerable to authorization header leak on port redirect CVE-2022-31033, GHSA-64qm-hrgp-pgr9 | Medium | 1.5% | 09 Jun, 2022 | RubyGems mechanize |
JMESPath for Ruby uses unsafe JSON.load when safe JSON.parse is preferable CVE-2022-32511, GHSA-5c5f-7vfq-3732 | Critical | 2.4% | 07 Jun, 2022 | RubyGems jmespath |
Use of Uninitialized Variable in trilogy CVE-2022-31026, GHSA-5g4r-2qhx-vqfm | Medium | 1.1% | 06 Jun, 2022 | RubyGems trilogy |
Arbitrary file write in dragonfly CVE-2021-33473, GHSA-fj34-jhjx-xmvv | Critical | 1.1% | 03 Jun, 2022 | RubyGems dragonfly |
CSRF allows attacker to finalize/unfinalize order adjustments in solidus_backend CVE-2022-31000, GHSA-8639-qx56-r428 | Low | 0.4% | 01 Jun, 2022 | RubyGems solidus_backend |
Denial of Service Vulnerability in Rack Multipart Parsing CVE-2022-30122, GHSA-hxqx-xwvh-44m2 | High | 2.2% | 27 May, 2022 | RubyGems rack |
Possible shell escape sequence injection vulnerability in Rack CVE-2022-30123, GHSA-wq4h-7r42-5hrr | Critical | 2.0% | 27 May, 2022 | RubyGems rack |
Camaleon CMS Stored Cross-site Scripting vulnerability CVE-2021-25969, GHSA-x78v-4fvj-rg9j | Medium | 0.8% | 24 May, 2022 | RubyGems camaleon_cms |
Cross site scripting in publify BIT-publify-2021-25974, CVE-2021-25974, GHSA-wmh9-x28j-c6gr | Medium | 0.6% | 24 May, 2022 | RubyGems publify_core |
Camaleon CMS Insufficient Session Expiration vulnerability CVE-2021-25970, GHSA-438x-2p9v-g8h9 | High | 1.3% | 24 May, 2022 | RubyGems camaleon_cms |
Cross site scripting in publify BIT-publify-2021-25975, CVE-2021-25975, GHSA-3h7v-wqw7-ff28 | Medium | 0.6% | 24 May, 2022 | RubyGems publify_core |
Camaleon CMS vulnerable to Uncaught Exception CVE-2021-25971, GHSA-r2w2-h6r8-3r53 | Medium | 1.0% | 24 May, 2022 | RubyGems camaleon_cms |
Camaleon CMS vulnerable to Server-Side Request Forgery CVE-2021-25972, GHSA-vx6p-q4gj-x6xx | Medium | 1.0% | 24 May, 2022 | RubyGems camaleon_cms |
apollo_upload_server has Denial of Service vulnerability BIT-gitlab-2021-39880, CVE-2021-39880, GHSA-w6pv-c757-6rgr | Medium | 2.1% | 24 May, 2022 | RubyGems apollo_upload_server |
Nokogiri has vulnerable dependencies on libxml2 and libxslt CVE-2021-30560, GHSA-59gp-qqm7-cw4j | High | 20.4% | 24 May, 2022 | RubyGems nokogiri |
Smashing Cross-site Scripting vulnerability CVE-2021-35440, GHSA-254j-mmc5-qhpx | Medium | 1.0% | 24 May, 2022 | RubyGems smashing |
Nokogiri contains libxml Out-of-bounds Write vulnerability CVE-2021-3517, GHSA-jw9f-hh49-cvp9 | High | 17.0% | 24 May, 2022 | RubyGems nokogiri |
Nokogiri Implements libxml2 version vulnerable to use-after-free CVE-2021-3518, GHSA-v4f8-2847-rwm7 | High | 21.9% | 24 May, 2022 | RubyGems nokogiri |
Nokogiri Implements libxml2 version vulnerable to null pointer dereferencing CVE-2021-3537, GHSA-286v-pcf5-25rc | Medium | 3.6% | 24 May, 2022 | RubyGems nokogiri |
Metasploit Framework user exposes Metasploit to same deserialization issue that is exploited by that module CVE-2020-7385, GHSA-xgww-h98f-24qf | High | 1.8% | 24 May, 2022 | RubyGems metasploit-framework |
WEBRick vulnerable to HTTP Request/Response Smuggling BIT-ruby-2020-25613, BIT-ruby-min-2020-25613, CVE-2020-25613, GHSA-gwfg-cqmg-cf8f | High | 3.8% | 24 May, 2022 | RubyGems webrick |
Publify has Improper Access Controls BIT-publify-2022-1810, CVE-2022-1810, GHSA-c273-c6vg-4pv5 | Medium | 0.8% | 24 May, 2022 | RubyGems publify_core |
Publify vulnerable to cross site scripting BIT-publify-2022-1811, CVE-2022-1811, GHSA-3hwx-c6cp-q972 | Critical | 0.8% | 24 May, 2022 | RubyGems publify_core |
Nokogiri Improperly Handles Unexpected Data Type CVE-2022-29181, GHSA-xh29-r2w5-wx8m | High | 3.2% | 23 May, 2022 | RubyGems nokogiri |
Integer Overflow or Wraparound in libxml2 affects Nokogiri CVE-2022-50999, GHSA-cgx6-hpwq-fhv5 | High | Not scored | 18 May, 2022 | RubyGems nokogiri |
Insecure PRNG use in random_password_generator CVE-2019-25061, GHSA-ggfx-h9xj-5v9c | High | 1.9% | 18 May, 2022 | RubyGems random_password_generator |
Publify exposes article metadata BIT-publify-2022-1553, CVE-2022-1553, GHSA-5jm7-g527-m694 | Medium | 1.2% | 17 May, 2022 | RubyGems publify_core |
Publify Incorrect Authorization BIT-publify-2022-0574, CVE-2022-0574, GHSA-79m3-q3wh-c3qm | Medium | 0.8% | 17 May, 2022 | RubyGems publify_core |
Publify vulnerable to code injection BIT-publify-2022-0578, CVE-2022-0578, GHSA-w78q-4w34-jrjx | Medium | 0.9% | 17 May, 2022 | RubyGems publify_core |
CSV-Safe improperly filters special characters potentially leading to CSV injection CVE-2022-28481, GHSA-f55g-x8qq-2569 | Critical | 1.8% | 03 May, 2022 | RubyGems csv-safe |
sinatra does not validate expanded path matches CVE-2022-29970, GHSA-qp49-3pvw-x4m5 | High | 2.1% | 03 May, 2022 | RubyGems sinatra |
XSS Vulnerability in Action View tag helpers CVE-2022-27777, GHSA-ch3h-j2vf-95pv | Medium | 1.7% | 27 Apr, 2022 | RubyGems actionview |
Cross-site Scripting Vulnerability in Action Pack CVE-2022-22577, GHSA-mm33-5vfq-3mm3 | Medium | 1.8% | 27 Apr, 2022 | RubyGems actionpack |
Server side request forgery in gibbon CVE-2022-27311, GHSA-vx9g-377x-xwxq | Critical | 1.6% | 26 Apr, 2022 | RubyGems gibbon |
SQL injection in blazer CVE-2022-29498, GHSA-qf9q-q4hh-qph3 | High | 0.9% | 22 Apr, 2022 | RubyGems blazer |
Command injection in ruby-git BIT-git-2022-25648, CVE-2022-25648, GHSA-69p6-wvmq-27gg, SNYK-RUBY-GIT-2421270 | Critical | 4.9% | 20 Apr, 2022 | RubyGems git |
Denial of Service (DoS) in Nokogiri on JRuby GHSA-gx8x-g87m-h5q6 | High | Not scored | 11 Apr, 2022 | RubyGems nokogiri |
XML Injection in Xerces Java affects Nokogiri GHSA-xxx9-3xcr-gjj3 | Medium | Not scored | 11 Apr, 2022 | RubyGems nokogiri |
Out-of-bounds Write in zlib affects Nokogiri GHSA-v6gp-9mmm-c6p5 | High | Not scored | 11 Apr, 2022 | RubyGems nokogiri |
Nokogiri Inefficient Regular Expression Complexity CVE-2022-24836, GHSA-crjr-9rc5-ghw8 | High | 3.5% | 11 Apr, 2022 | RubyGems nokogiri |
Improper one time password handling in devise-two-factor CVE-2021-43177, GHSA-jm35-h8q2-73mp | Medium | 0.9% | 07 Apr, 2022 | RubyGems devise-two-factor |
Buffer Overflow in yajl-ruby CVE-2022-24795, GHSA-jj47-x69x-mxrm | Medium | 3.4% | 05 Apr, 2022 | RubyGems yajl-ruby |
Command injection in cocoapods-downloader CVE-2022-21223, GHSA-g397-v4w5-4m79, SNYK-RUBY-COCOAPODSDOWNLOADER-2414280 | High | 1.7% | 02 Apr, 2022 | RubyGems cocoapods-downloader |
Command injection in cocoapods-downloader CVE-2022-24440, GHSA-7627-mp87-jf6q, SNYK-RUBY-COCOAPODSDOWNLOADER-2414278 | High | 2.6% | 02 Apr, 2022 | RubyGems cocoapods-downloader |
Command Injection vulnerability in asciidoctor-include-ext CVE-2022-24803, GHSA-v222-6mr4-qj29 | Critical | 2.7% | 31 Mar, 2022 | RubyGems asciidoctor-include-ext |