Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Cross-site request forgery in rails_admin CVE-2016-10522, GHSA-pxqr-8v54-m2hj | High | 1.0% | 05 Jul, 2018 | RubyGems rails_admin |
xapian-core Cross-site Scripting vulnerability CVE-2018-0499, GHSA-7qw4-w7hf-22q3 | Medium | 1.0% | 02 Jul, 2018 | RubyGems xapian-core |
Rubyzip gem contains a Directory Traversal vulnerability in zip file component CVE-2018-1000544, GHSA-vqcq-mrmw-mcmg | Critical | 4.3% | 26 Jun, 2018 | RubyGems rubyzip |
Json-jwt did not verify the cryptographic signature for data CVE-2018-1000539, GHSA-mj4x-wcxf-hm8x | Medium | 0.8% | 26 Jun, 2018 | RubyGems json-jwt |
Ruby-ffi has a DLL loading issue CVE-2018-1000201, GHSA-2gw2-8q9w-cw8p | High | 1.3% | 22 Jun, 2018 | RubyGems ffi |
Phusion Passenger incorrect permission assignment CVE-2018-12615, GHSA-4284-jfhc-f854 | Medium | 1.2% | 21 Jun, 2018 | RubyGems passenger |
Sprockets path traversal leads to information leak CVE-2018-3760, GHSA-pr3h-jjhj-573x | High | 26.3% | 20 Jun, 2018 | RubyGems sprockets |
Phusion Passenger Race Condition Allows Privilege Escalation CVE-2018-12029, GHSA-jjcj-fgfm-9g9r | High | 0.3% | 17 Jun, 2018 | RubyGems passenger |
Incorrect Access Control in Phusion Passenger CVE-2018-12028, GHSA-jjhj-8gx7-x836 | High | 0.9% | 17 Jun, 2018 | RubyGems passenger |
Insecure Permissions in Phusion Passenger CVE-2018-12027, GHSA-whfx-877c-5p28 | High | 1.1% | 17 Jun, 2018 | RubyGems passenger |
Phusion Passenger SpawningKit Contains Arbitrary Read/Write Vulnerability CVE-2018-12026, GHSA-7cv3-gvmc-8mq5 | Critical | 1.9% | 17 Jun, 2018 | RubyGems passenger |
private_address_check contains race condition CVE-2018-3759, GHSA-2xvj-j3qh-x8c3 | High | 0.7% | 13 Jun, 2018 | RubyGems private_address_check |
Prototype Pollution in lodash CVE-2018-3721, GHSA-fvqr-27wr-82fm | Medium | 2.3% | 07 Jun, 2018 | RubyGems lodash-rails npm lodash |
Sinatra Cross-site Scripting vulnerability CVE-2018-11627, GHSA-mq35-wqvf-r23c | Medium | 2.2% | 31 May, 2018 | RubyGems sinatra |
Uncontrolled resource consumption in nokogiri CVE-2017-18258, GHSA-882p-jqgm-f45g | Medium | 2.7% | 08 Apr, 2018 | RubyGems nokogiri |
rails-html-sanitizer Cross-site Scripting vulnerability CVE-2018-3741, GHSA-px3r-jm9g-c8w8 | Medium | 1.3% | 30 Mar, 2018 | RubyGems rails-html-sanitizer |
Cross-site Scripting in loofah CVE-2018-8048, GHSA-x7rv-cr6v-4vm4 | Medium | 1.9% | 21 Mar, 2018 | RubyGems loofah RubyGems nokogiri |
Sanitize vulnerable to Improper Input Validation and Cross-site Scripting CVE-2018-3740, GHSA-7f42-p84j-f58p | High | 1.5% | 21 Mar, 2018 | RubyGems sanitize |
Doorkeeper is vulnerable to stored XSS and code execution CVE-2018-1000088, GHSA-hwhh-2fwm-cfgw | Medium | 1.4% | 13 Mar, 2018 | RubyGems doorkeeper |
RubyGems Path Traversal vulnerability CVE-2018-1000079, GHSA-8qxg-mff5-j3wc | Medium | 2.8% | 13 Mar, 2018 | Maven org.jruby:jruby-stdlib RubyGems rubygems-update |
RubyGems Cross-site Scripting vulnerability CVE-2018-1000078, GHSA-87qx-g5wg-mwmj | Medium | 2.7% | 13 Mar, 2018 | Maven org.jruby:jruby-stdlib RubyGems rubygems-update |
RubyGems Improper Input Validation vulnerability CVE-2018-1000077, GHSA-gv86-43rv-79m2 | Medium | 3.6% | 13 Mar, 2018 | Maven org.jruby:jruby-stdlib RubyGems rubygems-update |
RubyGems Improper Verification of Cryptographic Signature vulnerability CVE-2018-1000076, GHSA-mc6j-h948-v2p6 | Critical | 2.9% | 13 Mar, 2018 | Maven org.jruby:jruby-stdlib RubyGems rubygems-update |
RubyGems Infinite Loop vulnerability CVE-2018-1000075, GHSA-74pv-v9gh-h25p | High | 4.7% | 13 Mar, 2018 | Maven org.jruby:jruby-stdlib RubyGems rubygems-update |
RubyGems Deserialization of Untrusted Data vulnerability CVE-2018-1000074, GHSA-qj2w-mw2r-pv39 | High | 2.9% | 13 Mar, 2018 | Maven org.jruby:jruby-stdlib RubyGems rubygems-update |
RubyGems Link Following vulnerability CVE-2018-1000073, GHSA-gx69-6cp4-hxrj | High | 4.9% | 13 Mar, 2018 | Maven org.jruby:jruby-stdlib RubyGems rubygems-update |
hammer_cli_foreman Improper Certificate Validation vulnerability CVE-2017-2667, GHSA-77h8-xr85-3x5q | High | 0.7% | 12 Mar, 2018 | RubyGems hammer_cli_foreman |
rack-protection gem timing attack vulnerability when validating CSRF token CVE-2018-1000119, GHSA-688c-3x49-6rqj | Medium | 2.4% | 07 Mar, 2018 | RubyGems rack-protection |
Ox gem stack overflow in sax_parse CVE-2017-16229, GHSA-wfwm-chj7-w59r | Medium | 1.0% | 26 Feb, 2018 | RubyGems ox |
radiant vulnerable to Cross-site Scripting CVE-2018-7261, GHSA-gp82-xr77-88f4 | Medium | 0.6% | 21 Feb, 2018 | RubyGems radiant |
Sinatra Path Traversal vulnerability CVE-2018-7212, GHSA-h29f-7f56-j8wh | Medium | 1.8% | 18 Feb, 2018 | RubyGems sinatra |
ember-source Cross-site Scripting vulnerability CVE-2014-0014, GHSA-rcx6-7jp6-pqf2 | Medium | 1.2% | 15 Feb, 2018 | RubyGems ember-source |
Ember.js Cross-site Scripting vulnerability CVE-2014-0013, GHSA-8xm3-gm7c-5fjx | Medium | 0.7% | 15 Feb, 2018 | RubyGems ember-source |
Low severity vulnerability that affects sensu CVE-2018-1000060, GHSA-69mv-3642-wj3w | Critical | 2.4% | 09 Feb, 2018 | RubyGems sensu |
Tarball permission preservation in puppet CVE-2017-10689, GHSA-vw22-465p-8j5w | Medium | 0.4% | 09 Feb, 2018 | RubyGems puppet |
bson is vulnerable to denial of service due to incorrect regex validation CVE-2015-4412, GHSA-h6rj-8r3c-9gpj | Critical | 4.7% | 05 Feb, 2018 | RubyGems bson |
Echor Ruby Gem credentials can be stolen via process table monitoring CVE-2014-1835, GHSA-j4gx-p3x5-m987 | High | 0.3% | 02 Feb, 2018 | RubyGems echor |
Echor contains Command Injection CVE-2014-1834, GHSA-8936-cgj4-phr2 | High | 0.4% | 02 Feb, 2018 | RubyGems echor |
Omniauth allows POST parameters to be stored in session CVE-2017-18076, GHSA-9pr6-grf4-x2fr | High | 2.1% | 26 Jan, 2018 | RubyGems omniauth |
delayed_job_web Cross-site Scripting vulnerability CVE-2017-12097, GHSA-w7q9-xr2x-wh7x | Medium | 1.0% | 19 Jan, 2018 | RubyGems delayed_job_web |
rails_admin ruby gem XSS CVE-2017-12098, GHSA-pxr8-w3jq-rcwj | Medium | 1.3% | 19 Jan, 2018 | RubyGems rails_admin |
Denial of Service in jquery CVE-2016-10707, GHSA-mhpp-875w-9cpv | High | 3.2% | 18 Jan, 2018 | Maven org.webjars.npm:jquery NuGet jQuery RubyGems jquery-rails npm jquery |
Cross-Site Scripting (XSS) in jquery CVE-2015-9251, GHSA-rmxg-73gg-4p98 | Medium | 29.7% | 18 Jan, 2018 | Maven org.webjars.npm:jquery NuGet jQuery RubyGems jquery-rails npm jquery |
Cross-Site Scripting in jquery CVE-2012-6708, GHSA-2pqj-h3vj-pqgw | Medium | 8.6% | 18 Jan, 2018 | Maven org.webjars.npm:jquery NuGet jQuery RubyGems jquery-rails npm jquery |
brbackup exposes database password to unauthorized users CVE-2014-5004, GHSA-vqcm-7f7f-r539 | High | 0.4% | 10 Jan, 2018 | RubyGems brbackup |
Ciborg gem for Ruby allows local users to write files and gain privileges via Symlink CVE-2014-5003, GHSA-g982-9r8g-6qxw | Medium | 0.4% | 10 Jan, 2018 | RubyGems ciborg |
lynx doesn't properly sanitize user input and exposes database password to unauthorized users CVE-2014-5002, GHSA-94cq-7ccq-cmcm | High | 0.5% | 10 Jan, 2018 | RubyGems lynx |
Kcapifony gem for Ruby places database user passwords on the command line CVE-2014-5001, GHSA-6fcq-3cm2-j3j5 | High | 0.5% | 10 Jan, 2018 | RubyGems kcapifony |
lawn-login exposes database password to unauthorized users CVE-2014-5000, GHSA-rhgq-vv9x-j4p5 | High | 0.5% | 10 Jan, 2018 | RubyGems lawn-login |
kajam allows local users to obtain sensitive information by listing the process CVE-2014-4999, GHSA-4ph7-5c44-pppv | High | 0.5% | 10 Jan, 2018 | RubyGems kajam |