Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Withdrawn Advisory: Fat Free CRM Cross-site Scripting vulnerability CVE-2019-10226, GHSA-gmg5-r3c4-3fm9 | Medium | 4.7% | 10 Jun, 2019 | RubyGems fat_free_crm |
ruby-openid SSRF via claimed_id request CVE-2019-11027, GHSA-fqfj-cmh6-hj49 | Critical | 3.0% | 10 Jun, 2019 | RubyGems ruby-openid |
RubyGems Delete directory using symlink when decompressing tar CVE-2019-8320, GHSA-5x32-c9mf-49cc | High | 4.2% | 06 Jun, 2019 | RubyGems rubygems-update |
Cross-site Scripting in Chartkick CVE-2019-12732, GHSA-g45g-g52h-39rg | Medium | 0.8% | 06 Jun, 2019 | RubyGems chartkick |
OmniAuth Ruby gem Cross-site Request Forgery in request phase CVE-2015-9284, GHSA-ww4x-rwq6-qpgf | High | 1.5% | 26 Apr, 2019 | RubyGems omniauth |
XSS in jQuery as used in Drupal, Backdrop CMS, and other products CVE-2019-11358, DRUPAL-CORE-2019-006, GHSA-6c3j-c64m-qhgq, PYSEC-2026-628, SNYK-JS-JQUERY-174006 | Medium | 86.8% | 17 Apr, 2019 | Maven org.webjars.npm:jquery NuGet jQuery Packagist drupal/core Packagist maximebf/debugbar +3 more |
OmniAuth-SAML authentication bypass via incorrect XML canonicalization and DOM traversal CVE-2017-11430, GHSA-94hm-8q65-rmxm | Critical | 2.4% | 17 Apr, 2019 | RubyGems omniauth-saml |
Ruby-SAML Improper Authentication vulnerability CVE-2017-11428, GHSA-x2fr-v8wf-8wwv | Critical | 2.5% | 17 Apr, 2019 | RubyGems ruby-saml |
Nokogiri vulnerable to libxslt protection mechanism bypass CVE-2019-11068, GHSA-qxcg-xjjg-66mj | Critical | 5.2% | 10 Apr, 2019 | RubyGems nokogiri |
Bootstrap-sass contains code execution backdoor CVE-2019-10842, GHSA-vqqv-v9m2-48p2 | Critical | 4.9% | 04 Apr, 2019 | RubyGems bootstrap-sass |
Doorkeeper-openid_connect contains Open Redirect CVE-2019-9837, GHSA-vv4c-g6q7-p3q7 | Medium | 1.3% | 21 Mar, 2019 | RubyGems doorkeeper-openid_connect |
Improper Certificate Validation in chloride CVE-2018-6517, GHSA-573x-jhqh-jg36 | High | 0.9% | 21 Mar, 2019 | RubyGems chloride |
devise Time-of-check Time-of-use Race Condition vulnerability CVE-2019-5421, GHSA-73rf-6mrf-759q | Critical | 1.6% | 19 Mar, 2019 | RubyGems devise |
Use of Insufficiently Random Values in Railties Allows Remote Code Execution CVE-2019-5420, GHSA-m42h-mh85-4qgc | Critical | 89.3% | 13 Mar, 2019 | RubyGems railties |
Path Traversal in Action View CVE-2019-5418, GHSA-86g5-2wh3-gc9j | HighExploited | 98.5% | 13 Mar, 2019 | RubyGems actionview |
Denial of Service Vulnerability in Action View CVE-2019-5419, GHSA-m63j-wh5w-c252 | High | 8.4% | 13 Mar, 2019 | RubyGems actionview |
Bootstrap Vulnerable to Cross-Site Scripting CVE-2019-8331, GHSA-9v3m-8fp8-mj99 | Medium | 16.4% | 20 Feb, 2019 | Maven org.webjars:bootstrap NuGet Bootstrap.Less NuGet bootstrap NuGet bootstrap.sass +6 more |
Fileutils Command Injection vulnerability CVE-2013-2516, GHSA-9x97-x2p9-hvpf | High | 3.3% | 15 Feb, 2019 | RubyGems fileutils |
Prototype Pollution in lodash CVE-2018-16487, GHSA-4xc9-xhrj-v574 | High | 1.5% | 01 Feb, 2019 | RubyGems lodash-rails npm lodash |
katello Cross-site Scripting vulnerability CVE-2018-16887, GHSA-mhhc-r88h-2qrm | Medium | 1.0% | 13 Jan, 2019 | RubyGems katello |
bootstrap Cross-site Scripting vulnerability CVE-2018-20677, GHSA-ph58-4vrj-w6hr | Medium | 4.0% | 09 Jan, 2019 | Maven org.webjars:bootstrap NuGet bootstrap Packagist twbs/bootstrap RubyGems bootstrap +3 more |
XSS vulnerability that affects bootstrap CVE-2018-20676, GHSA-3mgp-fx93-9xv5 | Medium | 3.8% | 09 Jan, 2019 | Maven org.webjars:bootstrap NuGet bootstrap Packagist twbs/bootstrap RubyGems bootstrap +3 more |
Bootstrap Cross-site Scripting vulnerability CVE-2016-10735, GHSA-4p24-vmcr-4gqj | Medium | 4.0% | 09 Jan, 2019 | Maven org.webjars:bootstrap NuGet bootstrap NuGet bootstrap.sass Packagist twbs/bootstrap +4 more |
Cross Site Scripting (XSS) vulnerability in easymon CVE-2018-1000855, GHSA-c289-47qf-rvrr | Medium | 0.9% | 20 Dec, 2018 | RubyGems easymon |
Fat Free CRM vulnerable to Cross-site Scripting CVE-2018-1000842, GHSA-j5rj-g695-342r | Medium | 1.7% | 20 Dec, 2018 | RubyGems fat_free_crm |
katello SQL Injection vulnerability CVE-2018-14623, GHSA-jx5v-788g-qw58 | Medium | 1.4% | 14 Dec, 2018 | RubyGems katello |
Exposure of Sensitive Information to an Unauthorized Actor in activestorage CVE-2018-16477, GHSA-7rr7-rcjw-56vj | Medium | 1.3% | 30 Nov, 2018 | RubyGems activestorage |
Improper Access Control in activejob CVE-2018-16476, GHSA-q2qw-rmrh-vv42 | High | 2.9% | 30 Nov, 2018 | RubyGems activejob |
Ruby Openssl Allows Incorrect Value Comparison CVE-2018-16395, GHSA-mmrq-6999-72v8 | Critical | 10.7% | 16 Nov, 2018 | RubyGems openssl |
Rack vulnerable to Cross-site Scripting CVE-2018-16471, GHSA-5r2p-j47h-mhpg | Medium | 1.9% | 13 Nov, 2018 | RubyGems rack |
Rack vulnerable to Denial of Service CVE-2018-16470, GHSA-hg78-4f6x-99wq | High | 2.0% | 13 Nov, 2018 | RubyGems rack |
i18n Vulnerable to Denial of Service Attack CVE-2014-10077, GHSA-34hf-g744-jw64 | High | 3.4% | 06 Nov, 2018 | RubyGems i18n |
Loofah Cross-site Scripting vulnerability CVE-2018-16468, GHSA-g4xq-jx4w-4cjv | Medium | 0.9% | 30 Oct, 2018 | RubyGems loofah |
mysql-bunuuid-rails vulnerable to SQL injection CVE-2018-18476, GHSA-6j63-35hj-vmcg | Critical | 1.8% | 24 Oct, 2018 | RubyGems mysql-binuuid-rails |
Withdrawn Advisory: AlchemyCMS is vulnerable to stored XSS via the /admin/pictures image field CVE-2018-18307, GHSA-7mj4-2984-955f | Medium | 1.7% | 16 Oct, 2018 | RubyGems alchemy_cms |
Asciidoctor Infinite Loop vulnerability CVE-2018-18385, GHSA-qc9p-mjxm-j2wj | High | 2.3% | 16 Oct, 2018 | RubyGems asciidoctor |
Camaleon CMS vulnerable to Stored Cross-site Scripting CVE-2018-18260, GHSA-7f84-9cqf-g4j9 | Medium | 1.0% | 15 Oct, 2018 | RubyGems camaleon_cms |
karo Metacharacter Handling Remote Command Execution CVE-2014-10075, GHSA-qfwq-chf4-jvwg | Critical | 3.5% | 05 Oct, 2018 | RubyGems karo |
Jekyll allows attackers to access arbitrary files by specifying a symlink CVE-2018-17567, GHSA-4xjh-m3qx-49wc | High | 2.2% | 28 Sep, 2018 | RubyGems jekyll |
smart_proxy_dynflow gem authentication bypass in Foreman remote execution feature CVE-2018-14643, GHSA-gx5g-xcxj-cx2w | Critical | 6.2% | 21 Sep, 2018 | RubyGems smart_proxy_dynflow |
Nokogiri gem, via libxml, is affected by DoS vulnerabilities CVE-2017-15412, GHSA-r58r-74gx-6wx3 | High | 2.9% | 28 Aug, 2018 | RubyGems nokogiri |
katello Improper Privilege Management vulnerability CVE-2017-2662, GHSA-cpv6-pfq6-j2v7 | Medium | 0.9% | 22 Aug, 2018 | RubyGems katello |
active-support impersonates 'activesupport' gem CVE-2018-3779, GHSA-2j55-pcw5-x4h2 | Critical | 6.5% | 10 Aug, 2018 | RubyGems active-support |
restforce vulnerable to Improper Input Validation CVE-2018-3777, GHSA-534w-937m-v7x3 | Critical | 1.5% | 03 Aug, 2018 | RubyGems restforce |
Nokogiri NULL Pointer Dereference CVE-2018-14404, GHSA-6qvp-r6r3-9p7h | High | 3.7% | 19 Jul, 2018 | RubyGems nokogiri |
Doorkeeper subject to Incorrect Permission Assignment CVE-2018-1000211, GHSA-694m-jhr9-pf77 | High | 1.6% | 13 Jul, 2018 | RubyGems doorkeeper |
Bootstrap Cross-site Scripting vulnerability CVE-2018-14042, GHSA-7mvr-5x2g-wfc8 | Medium | 4.0% | 13 Jul, 2018 | Maven org.webjars:bootstrap NuGet bootstrap NuGet bootstrap.sass Packagist twbs/bootstrap +4 more |
Bootstrap Cross-site Scripting vulnerability CVE-2018-14041, GHSA-pj7m-g53m-7638 | Medium | 4.3% | 13 Jul, 2018 | Maven org.webjars:bootstrap NuGet bootstrap NuGet bootstrap.sass Packagist twbs/bootstrap +4 more |
Bootstrap vulnerable to Cross-Site Scripting (XSS) CVE-2018-14040, GHSA-3wqf-4x89-9g79 | Medium | 4.1% | 13 Jul, 2018 | Maven org.webjars:bootstrap NuGet bootstrap NuGet bootstrap.sass Packagist twbs/bootstrap +3 more |
grape subject to Cross-site Scripting CVE-2018-3769, GHSA-f599-5m7p-hcpf | Medium | 1.4% | 05 Jul, 2018 | RubyGems grape |