Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
HTTP Request Smuggling in goliath CVE-2020-7671, GHSA-3892-2r52-p65m, SNYK-RUBY-GOLIATH-569136 | High | 1.3% | 24 May, 2021 | RubyGems goliath |
HTTP Request Smuggling in reel CVE-2020-7659, GHSA-x3v4-pxvm-63j8, SNYK-RUBY-REEL-569135 | High | 1.4% | 24 May, 2021 | RubyGems reel |
Dependency Confusion in Bundler CVE-2020-36327, GHSA-fp4w-jxhp-m23p | High | 6.3% | 24 May, 2021 | RubyGems bundler |
Puma's Keepalive Connections Causing Denial Of Service CVE-2021-29509, GHSA-q28m-8xjw-8vr5 | High | 1.6% | 18 May, 2021 | RubyGems puma |
Nokogiri updates packaged dependency on libxml2 from 2.9.10 to 2.9.12 CVE-2021-47996, GHSA-7rrm-v45f-jp64 | Medium | Not scored | 17 May, 2021 | RubyGems nokogiri |
Tempfile on Windows path traversal vulnerability BIT-ruby-2021-28966, BIT-ruby-min-2021-28966, CVE-2021-28966, GHSA-46f2-3v63-3xrp | High | 58.0% | 06 May, 2021 | RubyGems tmpdir |
Possible DoS Vulnerability in Action Controller Token Authentication CVE-2021-22904, GHSA-7wjx-3g7j-8584 | High | 4.9% | 05 May, 2021 | RubyGems actionpack |
Action Pack contains Information Disclosure / Unintended Method Execution vulnerability CVE-2021-22885, GHSA-hjg4-8q5f-x6fm | High | 4.0% | 05 May, 2021 | RubyGems actionpack |
Possible Open Redirect Vulnerability in Action Pack CVE-2021-22903, GHSA-5hq2-xf89-9jxq | Medium | 1.2% | 05 May, 2021 | RubyGems actionpack |
Denial of Service in Action Dispatch CVE-2021-22902, GHSA-g8ww-46x2-2p65 | High | 2.9% | 05 May, 2021 | RubyGems actionpack |
REXML round-trip instability BIT-ruby-2021-28965, BIT-ruby-min-2021-28965, CVE-2021-28965, GHSA-8cr8-4vfw-mr7h | High | 5.1% | 30 Apr, 2021 | RubyGems rexml |
Gon gem lack of escaping certain input when outputting as JSON CVE-2020-25739, GHSA-78vq-9j56-wrfr | Medium | 1.4% | 30 Apr, 2021 | RubyGems gon |
Pgsync Contains Cleartext Transmission of Sensitive Information CVE-2021-31671, GHSA-72rj-36qc-47g7 | High | 0.7% | 27 Apr, 2021 | RubyGems pgsync |
Cross-Site Request Forgery (CSRF) in trestle-auth CVE-2021-29435, GHSA-h8hx-2c5r-32cf | High | 0.7% | 13 Apr, 2021 | RubyGems trestle-auth |
Improper Certificate Validation in TweetStream CVE-2020-24393, GHSA-6hrm-jqp3-64cv | Medium | 0.9% | 13 Apr, 2021 | RubyGems tweetstream |
Improper Certificate Validation in Puppet CVE-2020-7942, GHSA-gqvf-892r-vjm5 | Medium | 0.8% | 13 Apr, 2021 | RubyGems puppet |
Cross-site scripting in actionpack CVE-2020-8264, GHSA-35mm-cc6r-8fjp | Medium | 67.0% | 07 Apr, 2021 | RubyGems actionpack |
Remote code execution in Kramdown CVE-2021-28834, GHSA-52p9-v744-mwjj | High | 2.7% | 29 Mar, 2021 | RubyGems kramdown |
Improper Certificate Validation in twitter-stream CVE-2020-24392, GHSA-p6p8-q4pj-f74m | Medium | 0.9% | 29 Mar, 2021 | RubyGems twitter-stream |
Activerecord-session_store Vulnerable to Timing Attack CVE-2019-25025, GHSA-cvw2-xj8r-mjf7 | Medium | 1.8% | 05 Mar, 2021 | RubyGems activerecord-session_store |
Actionpack Open Redirect Vulnerability CVE-2021-22881, GHSA-8877-prq4-9xfw | Medium | 87.3% | 02 Mar, 2021 | RubyGems actionpack |
Active Record subject to Regular Expression Denial-of-Service (ReDoS) CVE-2021-22880, GHSA-8hc4-xxm3-5ppp | High | 4.5% | 02 Mar, 2021 | RubyGems activerecord |
Command Injection in lodash CVE-2021-23337, GHSA-35jh-r3h4-6jhm | High | 21.3% | 15 Feb, 2021 | RubyGems lodash-rails npm lodash npm lodash-es npm lodash-template +1 more |
Regular Expression Denial of Service (ReDoS) in lodash CVE-2020-28500, GHSA-29mw-wpgm-hmr9 | Medium | 7.3% | 15 Feb, 2021 | RubyGems lodash-rails npm lodash npm lodash-es npm lodash.trim +1 more |
Code Injection vulnerability in CarrierWave::RMagick CVE-2021-21305, GHSA-cf3w-g86h-35x4 | High | 13.2% | 08 Feb, 2021 | RubyGems carrierwave |
Server-side request forgery in CarrierWave CVE-2021-21288, GHSA-fwcm-636p-68r5 | Medium | 1.2% | 08 Feb, 2021 | RubyGems carrierwave |
Command Injection Vulnerability in Mechanize CVE-2021-21289, GHSA-qrqm-fpv6-6r8g | High | 3.5% | 02 Feb, 2021 | RubyGems mechanize |
OS Command Injection in ftpd CVE-2013-2512, GHSA-7vxr-6cxg-j3x8 | Critical | 3.6% | 26 Jan, 2021 | RubyGems ftpd |
rails_admin ruby gem XSS vulnerability CVE-2020-36190, GHSA-wjx2-7hqq-8h7m | Medium | 1.3% | 14 Jan, 2021 | RubyGems rails_admin |
Injection/XSS in Redcarpet CVE-2020-26298, GHSA-q3wr-qw3g-3p4h | Medium | 1.6% | 11 Jan, 2021 | RubyGems redcarpet |
Nokogiri::XML::Schema trusts input by default, exposing risk of XXE vulnerability CVE-2020-26247, GHSA-vr8q-g5c7-m54m | Medium | 1.2% | 30 Dec, 2020 | RubyGems nokogiri |
omniauth-apple allows attacker to fake their email address during authentication CVE-2020-26254, GHSA-49r3-2549-3633 | High | 1.3% | 08 Dec, 2020 | RubyGems omniauth-apple |
Gitaly Insufficient Session Expiration vulnerability CVE-2020-13353, GHSA-mmmm-chjf-jmvw | Low | 0.3% | 17 Nov, 2020 | RubyGems gitaly |
Authorization bypass in Spree CVE-2020-26223, GHSA-m2jr-hmc3-qmpr | High | 1.1% | 13 Nov, 2020 | RubyGems spree_api |
Remote code execution in dependabot-core branch names when cloning CVE-2020-26222, GHSA-23f7-99jx-m54r | High | 3.1% | 13 Nov, 2020 | RubyGems dependabot-common RubyGems dependabot-omnibus |
Regression in JWT Signature Validation CVE-2020-15240, GHSA-58r4-h6v8-jcvm | High | 0.8% | 03 Nov, 2020 | RubyGems omniauth-auth0 |
Ensure that doorkeeper_token is valid when authenticating requests in API v2 calls CVE-2020-15269, GHSA-f8cm-364f-q9qh | High | 1.1% | 20 Oct, 2020 | RubyGems spree |
Possible timing attack in derivation_endpoint CVE-2020-15237, GHSA-5jjv-x4fq-qjwp | Medium | 1.0% | 05 Oct, 2020 | RubyGems shrine |
Improper Certificate Validation in oauth ruby gem CVE-2016-11086, GHSA-7359-3c6r-hfc2 | High | 0.9% | 24 Sep, 2020 | RubyGems oauth |
personnummer/ruby vulnerable to Improper Input Validation GHSA-vp9c-fpxx-744v | Low | Not scored | 23 Sep, 2020 | RubyGems personnummer |
XSS in Action View CVE-2020-15169, GHSA-cfjv-5498-mph5 | Medium | 2.4% | 11 Sep, 2020 | RubyGems actionview |
Insecure path handling in Bundler CVE-2019-3881, GHSA-g98m-96g9-wfjq | High | 0.5% | 04 Sep, 2020 | RubyGems bundler |
CSS Injection in Chartkick gem CVE-2020-16254, GHSA-3j95-fjv2-3m4p | Medium | 0.8% | 12 Aug, 2020 | RubyGems chartkick |
PgHero gem allows CSRF CVE-2020-16253, GHSA-v6fx-752r-ccp2 | High | 0.5% | 05 Aug, 2020 | RubyGems pghero |
Field Test CSRF vulnerability CVE-2020-16252, GHSA-w542-cpp9-r3g7 | Medium | 0.4% | 05 Aug, 2020 | RubyGems field_test |
Ability to change order address without triggering address validations in solidus CVE-2020-15109, GHSA-3mvg-rrrw-m7ph | Medium | 1.0% | 04 Aug, 2020 | RubyGems solidus_api RubyGems solidus_frontend |
Missing TLS certificate verification in faye-websocket CVE-2020-15133, GHSA-2v5c-755p-p4gv | High | 0.9% | 31 Jul, 2020 | RubyGems faye-websocket |
Missing TLS certificate verification CVE-2020-15134, GHSA-3q49-h8f9-9fr9 | High | 0.9% | 31 Jul, 2020 | RubyGems faye |
Unintended read access in kramdown gem CVE-2020-14001, GHSA-mqm2-cgpr-p4m6 | Critical | 4.6% | 17 Jul, 2020 | RubyGems kramdown |
Prototype Pollution in lodash CVE-2020-8203, GHSA-p6mc-m468-83gw | High | 5.2% | 15 Jul, 2020 | RubyGems lodash-rails npm lodash npm lodash-es npm lodash.pick +4 more |