Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Remote code execution via user-provided local names in ActionView BIT-rails-2020-8163, CVE-2020-8163, GHSA-cr3x-7m39-c6jq | High | 82.5% | 07 Jul, 2020 | RubyGems actionview |
CSRF Vulnerability in rails-ujs CVE-2020-8167, GHSA-xq5j-gw7f-jgj8 | Medium | 1.5% | 07 Jul, 2020 | RubyGems actionview |
Directory traversal in Rack::Directory app bundled with Rack CVE-2020-8161, GHSA-5f9h-9pjv-v6j7 | High | 3.4% | 06 Jul, 2020 | RubyGems rack |
Untrusted users can run pending migrations in production in Rails CVE-2020-8185, GHSA-c6qr-h5vq-59jc | Medium | 2.2% | 24 Jun, 2020 | RubyGems actionpack |
Rack allows Percent-encoded cookies to overwrite existing prefixed cookie names CVE-2020-8184, GHSA-j6w9-fv6q-3q52 | High | 3.0% | 24 Jun, 2020 | RubyGems rack |
Cross-site Scripting in Sanitize CVE-2020-4054, GHSA-p4x4-rw2p-8j8m | High | 1.9% | 16 Jun, 2020 | RubyGems sanitize |
SQL Injection in Geocoder CVE-2020-7981, GHSA-864j-6qpp-cmrr | Critical | 1.5% | 10 Jun, 2020 | RubyGems geocoder |
Regular Expression Denial of Service in websocket-extensions (RubyGem) CVE-2020-7663, GHSA-g6wq-qcwm-j5g2, SNYK-RUBY-WEBSOCKETEXTENSIONS-570830 | High | 4.6% | 05 Jun, 2020 | RubyGems websocket-extensions |
Cross-Site Scripting in Kaminari CVE-2020-11082, GHSA-r5jw-62xg-j433 | Medium | 1.5% | 28 May, 2020 | RubyGems kaminari |
Ability to forge per-form CSRF tokens in Rails CVE-2020-8166, GHSA-jp5v-5gx4-jmj9 | Medium | 1.7% | 26 May, 2020 | RubyGems actionpack |
Circumvention of file size limits in ActiveStorage CVE-2020-8162, GHSA-m42x-37p3-fv5w | High | 3.0% | 26 May, 2020 | RubyGems activestorage |
Possible Strong Parameters Bypass in ActionPack CVE-2020-8164, GHSA-8727-m6gj-mc37 | High | 4.9% | 26 May, 2020 | RubyGems actionpack |
ActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore CVE-2020-8165, GHSA-2p68-f74v-9wc6 | Critical | 45.7% | 26 May, 2020 | RubyGems activesupport |
Improper Certificate Validation in EM-HTTP-Request CVE-2020-13482, GHSA-q27f-v3r6-9v77 | High | 0.9% | 25 May, 2020 | RubyGems em-http-request |
HTTP Smuggling via Transfer-Encoding Header in Puma CVE-2020-11077, GHSA-w64w-qqph-5gxm | High | 2.9% | 22 May, 2020 | RubyGems puma |
HTTP Smuggling via Transfer-Encoding Header in Puma CVE-2020-11076, GHSA-x7jg-6pwg-fx5h | High | 4.1% | 22 May, 2020 | RubyGems puma |
Information disclosure issue in Active Resource CVE-2020-8151, GHSA-46j2-xjgp-jrfm | High | 2.2% | 21 May, 2020 | RubyGems activeresource |
Improper certificate validation in em-imap CVE-2020-13163, GHSA-4f68-49qq-h392 | High | 0.8% | 19 May, 2020 | RubyGems em-imap |
Cross-Site Scripting in jquery CVE-2020-7656, GHSA-q4m3-2j7h-f7xw, SNYK-JS-JQUERY-569619 | Medium | 6.4% | 19 May, 2020 | Maven org.webjars.npm:jquery NuGet jQuery RubyGems jquery-rails npm jquery |
Arbitrary file write in actionpack-page_caching gem CVE-2020-8159, GHSA-mg5p-95m9-rmfp | Critical | 5.4% | 13 May, 2020 | RubyGems actionpack-page_caching |
Improper Restriction of Excessive Authentication Attempts in Sorcery CVE-2020-11052, GHSA-jc8m-cxhj-668x | Critical | 1.6% | 07 May, 2020 | RubyGems sorcery |
Exposure of Sensitive Information to an Unauthorized Actor in Doorkeeper CVE-2020-10187, GHSA-j7vx-8mqj-cqp9 | High | 1.8% | 04 May, 2020 | RubyGems doorkeeper |
Potential XSS vulnerability in jQuery BIT-drupal-2020-11022, CVE-2020-11022, GHSA-gxr4-xjj5-5px2 | Medium | 99.2% | 29 Apr, 2020 | Maven org.webjars.npm:jquery NuGet jquery Packagist athlon1600/youtube-downloader Packagist components/jquery +3 more |
Potential XSS vulnerability in jQuery BIT-drupal-2020-11023, CVE-2020-11023, GHSA-jpcq-cgw6-v4j6 | MediumExploited | 84.9% | 29 Apr, 2020 | Maven org.webjars.npm:jquery NuGet jQuery Packagist components/jquery RubyGems jquery-rails +1 more |
Authentication and extension bypass in Faye CVE-2020-11020, GHSA-qpg4-4w7w-2mq5 | Critical | 1.6% | 29 Apr, 2020 | RubyGems faye |
Unsafe object creation in json RubyGem CVE-2020-10663, GHSA-jphg-qwrw-7w9g | High | 6.8% | 28 Apr, 2020 | RubyGems json |
Cross site scripting vulnerability in ActionView CVE-2020-5267, GHSA-65cv-r6x7-79hv | Medium | 1.5% | 19 Mar, 2020 | RubyGems actionview |
Sort order SQL injection in Administrate CVE-2020-5257, GHSA-2p5p-m353-833w | High | 0.9% | 13 Mar, 2020 | RubyGems administrate |
Denial of Service in uap-core when processing crafted User-Agent strings GHSA-pcqq-5962-hvcw | High | Not scored | 10 Mar, 2020 | RubyGems user_agent_parser |
HTTP Response Splitting (Early Hints) in Puma CVE-2020-5249, GHSA-33vf-4xgg-9r58 | Medium | 1.6% | 03 Mar, 2020 | RubyGems puma |
OS Command Injection in Rake CVE-2020-8130, GHSA-jppv-gw3r-w3q8 | Medium | 1.4% | 28 Feb, 2020 | RubyGems rake |
HTTP Response Splitting in Puma BIT-ruby-2020-5247, BIT-ruby-min-2020-5247, CVE-2020-5247, GHSA-84j7-475p-hp8v | Medium | 2.5% | 28 Feb, 2020 | RubyGems puma |
libxml as used in Nokogiri has an infinite loop in a certain end-of-file situation CVE-2020-7595, GHSA-7553-jr98-vx47 | High | 7.8% | 24 Feb, 2020 | RubyGems nokogiri |
Denial of Service in uap-core when processing crafted User-Agent strings CVE-2020-5243, GHSA-cmcx-xhr8-3w9p | High | 2.3% | 20 Feb, 2020 | RubyGems user_agent_parser npm uap-core |
BSON rubygem contains potential denial of service CVE-2015-4411, GHSA-qh4w-7pw3-p4rp | High | 6.4% | 20 Feb, 2020 | RubyGems bson |
Moped Rubygem Data Injection Vulnerability CVE-2015-4410, GHSA-f93j-hmcr-jcwh | High | 5.7% | 20 Feb, 2020 | RubyGems moped |
Nokogiri is vulnerable to XML External Entity (XXE) attack CVE-2012-6685, GHSA-6wj9-77wq-jq7p | High | 2.2% | 19 Feb, 2020 | RubyGems nokogiri |
XSS/Script injection vulnerability in matestack CVE-2020-5241, GHSA-3jqw-vv45-mjhh | High | 0.6% | 12 Feb, 2020 | RubyGems matestack-ui-core |
PDFKit Improper Input Validation vulnerability CVE-2013-1607, GHSA-39v7-xpq4-8884 | Critical | 2.7% | 11 Feb, 2020 | RubyGems pdfkit |
omniauth-weibo-oauth2 included a code-execution backdoor inserted by a third party CVE-2019-17268, GHSA-vr22-43gj-rx3f | Critical | 2.4% | 07 Feb, 2020 | RubyGems omniauth-weibo-oauth2 |
Directive injection when using dynamic overrides with user input CVE-2020-5217, GHSA-xq52-rv6w-397c | Medium | 1.8% | 23 Jan, 2020 | RubyGems secure_headers |
Limited header injection when using dynamic overrides with user input in RubyGems secure_headers CVE-2020-5216, GHSA-w978-rmpf-qmwg | Medium | 1.2% | 23 Jan, 2020 | RubyGems secure_headers |
BibTeX-Ruby vulnerable to OS command injection CVE-2019-10780, GHSA-c5r5-7pfh-6qg6, SNYK-RUBY-BIBTEXRUBY-542602 | Critical | 2.8% | 22 Jan, 2020 | RubyGems bibtex-ruby |
papercrop does not properly handle crop input CVE-2015-2784, GHSA-m44r-gv6q-9j9r | Critical | 1.8% | 21 Jan, 2020 | RubyGems papercrop |
Publify vulnerable to DoS attack CVE-2014-3211, GHSA-vq74-9583-hrm4 | High | 1.1% | 09 Jan, 2020 | RubyGems publify_core |
Features file injection vulnerability CVE-2013-4318, GHSA-42gq-h7xj-33r4 | Medium | 0.8% | 26 Dec, 2019 | RubyGems features |
Prototype Pollution in handlebars CVE-2019-19919, GHSA-w457-6q6x-cgp9 | Critical | 7.1% | 20 Dec, 2019 | RubyGems bootstrap-wysihtml5-rails npm handlebars |
Possible Information Leak / Session Hijack Vulnerability in Rack CVE-2019-16782, GHSA-hrqr-hxpp-chr3 | Medium | 3.7% | 18 Dec, 2019 | RubyGems rack |
In RubyGem excon, interrupted Persistent Connections May Leak Response Data CVE-2019-16779, GHSA-q58g-455p-8vw9 | Medium | 1.7% | 16 Dec, 2019 | RubyGems excon |
omniauth-facebook Improper Authentication vulnerability CVE-2013-4593, GHSA-33vg-hpx5-pfxg | High | 1.8% | 11 Dec, 2019 | RubyGems omniauth-facebook |