Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Puma vulnerable to HTTP Request Smuggling CVE-2022-24790, GHSA-h99w-9q5r-gjq9 | Critical | 2.2% | 30 Mar, 2022 | RubyGems puma |
Improper Certificate Validation in kubeclient CVE-2022-0759, GHSA-69p3-xp37-f692 | High | 0.9% | 26 Mar, 2022 | RubyGems kubeclient |
Nokogiri affected by zlib's Out-of-bounds Write vulnerability CVE-2018-25032, GHSA-jc36-42cf-vqwj, PSF-2022-3 | High | 51.7% | 25 Mar, 2022 | RubyGems nokogiri |
Missing Authentication for Critical Function in Foreman Ansible CVE-2021-3589, GHSA-vvff-6wrr-4g7q | High | 1.0% | 24 Mar, 2022 | RubyGems foreman_ansible |
Possible code injection vulnerability in Rails / Active Storage CVE-2022-21831, GHSA-w749-p3v6-hccq | Critical | 3.1% | 08 Mar, 2022 | RubyGems activestorage |
Integer overflow in cmark-gfm table parsing extension leads to heap memory corruption CVE-2024-22051, GHSA-fmx4-26r3-wxpf | High | 1.5% | 03 Mar, 2022 | RubyGems commonmarker |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in view_component CVE-2022-24722, GHSA-cm9w-c4rj-r2cf | High | 1.1% | 02 Mar, 2022 | RubyGems view_component |
Remote shell execution vulnerability in image_processing CVE-2022-24720, GHSA-cxf7-qrc5-9446 | Critical | 2.7% | 01 Mar, 2022 | RubyGems image_processing |
Vulnerable dependencies in Nokogiri CVE-2022-51000, GHSA-fq42-c5rg-92c2 | High | Not scored | 25 Feb, 2022 | RubyGems nokogiri |
Puma used with Rails may lead to Information Exposure CVE-2022-23634, GHSA-rmj8-8hhh-gv5h | High | 2.1% | 11 Feb, 2022 | RubyGems puma |
Exposure of information in Action Pack CVE-2022-23633, GHSA-wh98-p28r-vrc9 | High | 2.2% | 11 Feb, 2022 | RubyGems actionpack |
Publify Business Logic Errors BIT-publify-2022-0524, CVE-2022-0524, GHSA-x3rq-r3cm-5vc4 | High | 1.6% | 09 Feb, 2022 | RubyGems publify_core |
Denial of service in sidekiq CVE-2022-23837, GHSA-jrfj-98qg-qjgv | High | 5.2% | 27 Jan, 2022 | RubyGems sidekiq |
Cookie Prefix Spoofing in CGI::Cookie.parse BIT-ruby-2021-41819, BIT-ruby-min-2021-41819, CVE-2021-41819, GHSA-4vf4-qmvg-mh7h | High | 3.2% | 21 Jan, 2022 | RubyGems cgi |
A potential Denial of Service issue in protobuf-java CVE-2021-22569, GHSA-wrvw-hg22-4m67 | High | 1.8% | 07 Jan, 2022 | Maven com.google.protobuf:protobuf-java Maven com.google.protobuf:protobuf-kotlin RubyGems google-protobuf |
CSRF forgery protection bypass in solidus_frontend CVE-2021-43846, GHSA-h3fg-h5v3-vf8m | Medium | 0.6% | 06 Jan, 2022 | RubyGems solidus_frontend |
Path traversal when MessageBus::Diagnostics is enabled CVE-2021-43840, GHSA-xmgj-5fh3-xjmm | Medium | 1.9% | 17 Dec, 2021 | RubyGems message_bus |
Buffer overrun in CGI.escape_html CVE-2021-41816, GHSA-5cqm-crxm-6qpv | Critical | 4.9% | 14 Dec, 2021 | RubyGems cgi |
actionpack Open Redirect in Host Authorization Middleware BIT-rails-2021-44528, CVE-2021-44528, GHSA-qphc-hf5q-v8fc | Medium | 4.4% | 14 Dec, 2021 | RubyGems actionpack |
Improper Privilege Management in devise_masquerade CVE-2021-28680, GHSA-25f5-gc4h-hc22 | High | 1.3% | 08 Dec, 2021 | RubyGems devise_masquerade |
Local Code Execution through Argument Injection via dash leading git url parameter in Gemfile. CVE-2021-43809, GHSA-fj7f-vq84-fh43 | Medium | 2.9% | 08 Dec, 2021 | RubyGems bundler |
ReDos vulnerability on guest checkout email validation CVE-2021-43805, GHSA-qxmr-qxh6-2cc9 | High | 1.4% | 07 Dec, 2021 | RubyGems solidus_core |
Silent Configuration Failure in Puppet Agent CVE-2021-27025, GHSA-q4g7-jrxv-67r9 | Medium | 1.1% | 02 Dec, 2021 | RubyGems puppet |
Unsafe HTTP Redirect in Puppet Agent and Puppet Server CVE-2021-27023, GHSA-93j5-g845-9wqp | Medium | 1.4% | 02 Dec, 2021 | RubyGems puppet |
Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness CVE-2021-41275, GHSA-26xx-m4q2-xhq8 | Critical | 0.6% | 18 Nov, 2021 | RubyGems spree_auth_devise |
Authentication Bypass by CSRF Weakness GHSA-5629-8855-gf4g | Critical | Not scored | 18 Nov, 2021 | RubyGems solidus_core |
Authentication Bypass by CSRF Weakness CVE-2021-41274, GHSA-xm34-v85h-9pg2 | Critical | 0.7% | 18 Nov, 2021 | RubyGems solidus_auth_devise |
Regular expression denial of service vulnerability (ReDoS) in date BIT-ruby-2021-41817, BIT-ruby-min-2021-41817, CVE-2021-41817, GHSA-qg54-694p-wgpp | High | 3.5% | 16 Nov, 2021 | RubyGems date |
Rails Multisite secure/signed cookies share secrets between sites in a multi-site application CVE-2021-41263, GHSA-844m-cpr9-jcmh | Medium | 0.6% | 15 Nov, 2021 | RubyGems rails_multisite |
Publify `guest` role users can self-register even when the admin does not allow it BIT-publify-2021-25973, CVE-2021-25973, GHSA-x24j-87x9-jvv5 | Medium | 0.8% | 03 Nov, 2021 | RubyGems publify_core |
ReDoS vulnerability in parser_apache2 BIT-fluentd-2021-41186, CVE-2021-41186, GHSA-hwhf-64mh-r662 | Medium | 2.2% | 01 Nov, 2021 | RubyGems fluentd |
XSS in `*Text` options of the Datepicker widget in jquery-ui BIT-drupal-2021-41183, CVE-2021-41183, GHSA-j7qv-pgf6-hvh4 | Medium | 8.5% | 26 Oct, 2021 | Maven org.webjars.npm:jquery-ui NuGet jQuery.UI.Combined RubyGems jquery-ui-rails npm jquery-ui |
XSS in the `of` option of the `.position()` util in jquery-ui BIT-drupal-2021-41184, CVE-2021-41184, GHSA-gpqq-952q-5327 | Medium | 40.8% | 26 Oct, 2021 | Maven org.webjars.npm:jquery-ui NuGet jQuery.UI.Combined RubyGems jquery-ui-rails npm jquery-ui |
XSS in the `altField` option of the Datepicker widget in jquery-ui BIT-drupal-2021-41182, CVE-2021-41182, GHSA-9gj3-hwp5-pmwc | Medium | 39.4% | 26 Oct, 2021 | Maven org.webjars.npm:jquery-ui NuGet jQuery.UI.Combined RubyGems jquery-ui-rails npm jquery-ui |
Cross site scripting in actionpack Rubygem CVE-2011-1497, GHSA-q58j-fmvf-9rq6 | Medium | 1.3% | 19 Oct, 2021 | RubyGems actionpack |
Puma with proxy which forwards LF characters as line endings could allow HTTP request smuggling CVE-2021-41136, GHSA-48w2-rm65-62xx | Low | 1.2% | 12 Oct, 2021 | RubyGems puma |
Remote code execution in ruby-jss CVE-2021-33575, GHSA-vmfh-c547-v45h | Critical | 2.6% | 06 Oct, 2021 | RubyGems ruby-jss |
Cross-site Scripting in Sidekiq CVE-2021-30151, GHSA-grh7-935j-hg6w | Medium | 4.2% | 06 Oct, 2021 | RubyGems sidekiq |
Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby CVE-2021-41098, GHSA-2rr5-8q37-2w7h | High | 1.5% | 27 Sep, 2021 | RubyGems nokogiri |
Clearance Gem Open Redirect Vulnerability CVE-2021-23435, GHSA-4hpq-rjcx-7vj9, SNYK-RUBY-CLEARANCE-1577284 | High | 0.7% | 13 Sep, 2021 | RubyGems clearance |
Older releases of better_errors open to Cross-Site Request Forgery attack CVE-2021-39197, GHSA-w3j4-76qw-wwjm | Medium | 0.6% | 07 Sep, 2021 | RubyGems better_errors |
Arbitrary Code Execution in Rdoc CVE-2021-31799, GHSA-ggxm-pgc9-g7fp | High | 1.5% | 01 Sep, 2021 | RubyGems rdoc |
Open Redirect in ActionPack CVE-2021-22942, GHSA-2rqw-v265-jf8c | Medium | 1.7% | 26 Aug, 2021 | RubyGems actionpack |
Cross-Site Scripting in Qiita-Markdown CVE-2021-28796, GHSA-f2c9-5jqw-3xh3 | Medium | 0.8% | 02 Aug, 2021 | RubyGems qiita-markdown |
qiita-markdown Cross-site Scripting vulnerability CVE-2021-28833, GHSA-9p29-94hp-8rvc | Medium | 0.7% | 02 Aug, 2021 | RubyGems qiita-markdown |
Regular Expression Denial of Service in Addressable templates CVE-2021-32740, GHSA-jxhc-q857-3j6g | High | 2.1% | 12 Jul, 2021 | RubyGems addressable |
Code injection in Narou CVE-2021-35514, GHSA-gwrj-88fp-5m36 | High | 1.4% | 02 Jul, 2021 | RubyGems narou |
Potential Denial-of-Service in bindata BIT-gitlab-2021-32823, CVE-2021-32823, GHSA-hj56-84jw-67h6 | Medium | 1.9% | 23 Jun, 2021 | RubyGems bindata |
Exposure of Sensitive Information to an Unauthorized Actor in foreman_fog_proxmox CVE-2021-20259, GHSA-f2rp-4rv7-fc95 | High | 0.3% | 10 Jun, 2021 | RubyGems foreman_fog_proxmox |
Dragonfly contains remote code execution vulnerability CVE-2021-33564, GHSA-j858-xp5v-f8xx | Critical | 72.1% | 02 Jun, 2021 | RubyGems dragonfly |