Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Nokogiri implementation of libxslt vulnerable to heap corruption CVE-2019-5815, GHSA-vmfx-gcfq-wvm2 | High | 1.8% | 11 Dec, 2019 | RubyGems nokogiri |
RubyGem openshift-origin-controller is vulnerable to command injection CVE-2013-2095, GHSA-77xq-7c6p-6xp6 | Critical | 2.5% | 10 Dec, 2019 | RubyGems openshift-origin-controller |
A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack CVE-2019-16770, GHSA-7xx3-m584-x994 | High | 2.0% | 05 Dec, 2019 | RubyGems puma |
Katello cleartext password storage issue CVE-2019-14825, GHSA-m4wh-848j-9w2r | Low | 0.7% | 25 Nov, 2019 | RubyGems katello |
openshift-origin-node Improper Input Validation vulnerability CVE-2014-0084, GHSA-756m-3qf2-hp58 | Medium | 0.3% | 21 Nov, 2019 | RubyGems openshift-origin-node |
net-ldap has weak salt when generating passwords CVE-2014-0083, GHSA-qwgm-mxm4-3q2c | Medium | 0.3% | 21 Nov, 2019 | RubyGems net-ldap |
RubyGems passenger gem allows remote attackers to delete files CVE-2012-6135, GHSA-8mw8-j583-vqfg | High | 2.3% | 19 Nov, 2019 | RubyGems passenger |
The rack-cors rubygem may allow directory traveral CVE-2019-18978, GHSA-pf8f-w267-mq2h | Medium | 2.5% | 14 Nov, 2019 | RubyGems rack-cors |
JSON-jwt Gem lacked element count during splitting of JWE string CVE-2019-18848, GHSA-cff7-6h4q-q5pj | High | 1.3% | 12 Nov, 2019 | RubyGems json-jwt |
Prototype Pollution in chartkick CVE-2019-18841, GHSA-5pm8-492c-92p5 | High | 1.4% | 11 Nov, 2019 | RubyGems chartkick npm chartkick |
Missing Initialization of Resource in Apache Arrow CVE-2019-12408, GHSA-8cw2-jv5c-c825, PYSEC-2019-195 | High | 3.3% | 08 Nov, 2019 | PyPI pyarrow RubyGems red-arrow |
Missing Initialization of Resource in Apache Arrow CVE-2019-12410, GHSA-cjw4-2w9r-r8mv, PYSEC-2019-196 | High | 4.6% | 08 Nov, 2019 | PyPI pyarrow RubyGems red-arrow |
Nokogiri vulnerable to DoS while parsing XML entities CVE-2013-6461, GHSA-jmhh-w7xp-wg39 | Medium | 2.2% | 05 Nov, 2019 | RubyGems nokogiri |
Nokogiri vulnerable to DoS while parsing XML documents CVE-2013-6460, GHSA-62qp-3fxm-9wxf | Medium | 2.1% | 05 Nov, 2019 | RubyGems nokogiri |
Ruby_parser-legacy Incorrect Permission Assignment for Critical Resource CVE-2019-18409, GHSA-hhwc-8g49-j8jx | High | 0.3% | 24 Oct, 2019 | RubyGems ruby_parser-legacy |
Loofah Allows Cross-site Scripting CVE-2019-15587, GHSA-c3gv-9cxf-6f57 | Medium | 1.6% | 22 Oct, 2019 | RubyGems loofah |
Nokogiri affected by libxslt Use of Uninitialized Resource/Use After Free vulnerability CVE-2019-18197, GHSA-242x-7cm6-4w8j | High | 4.4% | 18 Oct, 2019 | RubyGems nokogiri |
Haml vulnerable to cross-site scripting CVE-2017-1002201, GHSA-r53w-g4xm-3gc6, SNYK-RUBY-HAML-20362 | Medium | 1.5% | 15 Oct, 2019 | RubyGems haml |
netaddr before 1.5.3 and 2.0.4 has Incorrect Default Permissions CVE-2019-17383, GHSA-49pj-69vf-c689 | Critical | 2.4% | 09 Oct, 2019 | RubyGems netaddr |
Malicious URL drafting attack against iodines static file server may allow path traversal CVE-2024-22050, GHSA-85rf-xh54-whp3 | High | 0.9% | 07 Oct, 2019 | RubyGems iodine |
Improper Input Validation in simple_form CVE-2019-16676, GHSA-r74q-gxcg-73hx | Critical | 3.4% | 30 Sep, 2019 | RubyGems simple_form |
Rubyzip denial of service CVE-2019-16892, GHSA-5m2v-hc64-56h6 | Medium | 1.6% | 25 Sep, 2019 | RubyGems rubyzip |
Devise Token Auth vulnerable to Cross-site Scripting CVE-2019-16751, GHSA-mvqr-r76c-wm5f | Medium | 0.9% | 24 Sep, 2019 | RubyGems devise_token_auth |
Consul gem insufficient authentication check - Multiple powers in one controller are not always checked correctly CVE-2019-16377, GHSA-8jhx-9gf4-hhf5 | Critical | 2.6% | 23 Sep, 2019 | RubyGems consul |
Cross-site scripting in padrino-contrib CVE-2019-16145, GHSA-rwpr-83g3-96g7 | Medium | 0.8% | 09 Sep, 2019 | RubyGems padrino-contrib |
Authentication Bypass in Devise CVE-2019-16109, GHSA-fcjw-8rhj-gwwc | Medium | 1.8% | 08 Sep, 2019 | RubyGems devise |
Airbrake keys not being filtered CVE-2019-16060, GHSA-2p82-v77v-mppr | Critical | 1.4% | 06 Sep, 2019 | RubyGems airbrake-ruby |
Cross-site scripting in fat_free_crm CVE-2018-20975, GHSA-4p8f-mmfj-r45g | Medium | 1.2% | 20 Aug, 2019 | RubyGems fat_free_crm |
rest-client Gem Contains Malicious Code CVE-2019-15224, GHSA-333g-rpr4-7hxq | Critical | 3.5% | 19 Aug, 2019 | RubyGems awesome-bot RubyGems bitcoin_vanity RubyGems blockchain_wallet RubyGems capistrano-colors +6 more |
Nokogiri Command Injection Vulnerability CVE-2019-5477, GHSA-cr5j-953j-xw5p | Critical | 5.9% | 16 Aug, 2019 | RubyGems nokogiri RubyGems rexical |
Elastic APM agent for Ruby vulnerable to Improper Certificate Validation CVE-2019-7615, GHSA-35j2-p8fh-x966 | High | 0.6% | 30 Jul, 2019 | RubyGems elastic-apm |
samlr XML nodes comment attack CVE-2018-20857, GHSA-qpxp-5j56-gg3x | High | 1.2% | 26 Jul, 2019 | RubyGems samlr |
Code backdoor in simple_captcha2 CVE-2019-14282, GHSA-wg6j-r28m-7293 | Critical | 3.1% | 26 Jul, 2019 | RubyGems simple_captcha2 |
datagrid contains code Injection backdoor CVE-2019-14281, GHSA-rqp5-pg7w-832p | Critical | 3.1% | 26 Jul, 2019 | RubyGems datagrid |
SQL Injection in marginalia CVE-2019-1010191, GHSA-hrj5-qp7x-rpg6 | Critical | 1.4% | 24 Jul, 2019 | RubyGems marginalia |
Regular Expression Denial of Service (ReDoS) in lodash CVE-2019-1010266, GHSA-x5rq-j2xg-h7qm, SNYK-JS-LODASH-73639 | Medium | 3.0% | 17 Jul, 2019 | RubyGems lodash-rails npm lodash npm lodash-amd npm lodash-es |
Slanger Arbitrary command execution CVE-2019-1010306, GHSA-rg32-m3hf-772v | Critical | 4.0% | 15 Jul, 2019 | RubyGems slanger |
paranoid2 gem Code backdoor CVE-2019-13589, GHSA-4g4c-8gqh-m4vm | Critical | 4.3% | 14 Jul, 2019 | RubyGems paranoid2 |
OS Command Injection in MiniMagick CVE-2019-13574, GHSA-r7j3-vvh2-xrpj | High | 7.6% | 12 Jul, 2019 | RubyGems mini_magick |
Prototype Pollution in lodash CVE-2019-10744, GHSA-jf85-cpcp-j695, SNYK-JS-LODASH-450202 | Critical | 5.0% | 10 Jul, 2019 | RubyGems lodash-rails npm lodash npm lodash-amd npm lodash-es +1 more |
field_test gem contains injection vulnerability CVE-2019-13146, GHSA-wg9m-gw3h-hg83 | Medium | 1.4% | 09 Jul, 2019 | RubyGems field_test |
strong_password Ruby gem malicious version causing Remote Code Execution vulnerability CVE-2019-13354, GHSA-5h5r-ffc4-c455 | Critical | 3.3% | 08 Jul, 2019 | RubyGems strong_password |
Path Traversal vulnerability that affects yard CVE-2019-1020001, GHSA-xfhh-rx56-rxcr | High | 2.3% | 02 Jul, 2019 | RubyGems yard |
libxslt Type Confusion vulnerability that affects Nokogiri CVE-2019-13118, GHSA-cf46-6xxh-pc75 | High | 5.1% | 01 Jul, 2019 | RubyGems nokogiri |
Uninitialized read in Nokogiri gem CVE-2019-13117, GHSA-4hm9-844j-jmxp | Medium | 6.5% | 01 Jul, 2019 | RubyGems nokogiri |
RubyGems Escape sequence injection vulnerability in api response handling CVE-2019-8323, GHSA-3h4r-pjv6-cph9 | High | 3.3% | 17 Jun, 2019 | RubyGems rubygems-update |
RubyGems Escape sequence injection vulnerability in gem owner CVE-2019-8322, GHSA-mh37-8c3g-3fgc | High | 3.3% | 17 Jun, 2019 | RubyGems rubygems-update |
RubyGems Escape sequence injection vulnerability in verbose CVE-2019-8321, GHSA-fr32-gr5c-xq5c | High | 3.3% | 17 Jun, 2019 | RubyGems rubygems-update |
RubyGems Escape sequence injection in errors CVE-2019-8325, GHSA-4wm8-fjv7-j774 | High | 3.3% | 17 Jun, 2019 | RubyGems rubygems-update |
Code injection in RubyGems CVE-2019-8324, GHSA-76wm-422q-92mq | High | 3.2% | 17 Jun, 2019 | RubyGems rubygems-update |