Open Source Vulnerabilities

actionpack, actionpack, actionpack

actionpack Cross-site Scripting vulnerability

md2pdf

md2pdf allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename

activesupport, activesupport

activesupport Improper Input Validation vulnerability

extlib

extlib does not properly restrict casts of string values

show_in_browser

Script Injection in Show In Browser gem

passenger, passenger

Phusion Passenger Denial of Service

activerecord, activerecord, activerecord

Active Record allows bypassing of database-query restrictions

cocaine

Cocaine Gem OS Command Injection vulnerability

omniauth-facebook

omniauth-facebook Cross-Site Request Forgery vulnerability

puppet, puppet

Puppet allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service

puppet, puppet

Puppet Improper Input Validation vulnerability

omniauth-oauth2

omniauth-oauth2 Cross-Site Request Forgery vulnerability

activerecord, activerecord

Active Record contains deserialization of arbitrary YAML

ldoce

ldoce Gem Arbitrary Command Execution

puppet, puppet

Puppet vulnerable to Path Traversal

activerecord, activerecord, activerecord, activerecord

Active Record contains SQL Injection

activerecord, activerecord, activerecord

ActiveRecord vulnerable to modification of protected model attributes

rack, rack, rack, rack

Rack vulnerable to REDoS

activesupport, activesupport, activesupport, activesupport

activesupport Cross-site Scripting vulnerability

curl

Curl Gem insufficient URL escaping command injection

actionpack, actionpack, actionpack

actionpack Cross-site Scripting vulnerability

rgpg

rgpg Code Injection vulnerability

actionpack, actionpack, actionpack, actionpack

actionpack Improper Input Validation vulnerability

devise, devise, devise, devise

Devise does not properly perform type conversion when performing database queries

spree

Spree Improper Input Validation vulnerability

cremefraiche

Creme Fraiche contains OS Command Injection

crack

crack does not properly restrict casts of string values

httparty

HTTParty does not restrict casts of string values

actionpack, actionpack

actionpack Improper Input Validation vulnerability

dragonfly, dragonfly

Dragonfly Code Injection vulnerability

command_wrap

Shell command injection in command_wrap

multi_xml

Improper Input Validation in multi_xml

puppet, puppet

Pupper does not properly restrict characters in Common Name field of Certificate Signing Request

newrelic_rpm

newrelic_rpm Gem Discloses Sensitive Information

actionpack, actionpack, actionpack

actionpack Cross-site Scripting vulnerability

jquery-ui, jquery-ui-rails, org.webjars.npm:jquery-ui, jQuery.UI.Combined

jquery-ui Tooltip widget vulnerable to XSS

dragonfly, fog-dragonfly

Code injection in dragonfly gem

RedCloth

RedCloth Cross-site Scripting vulnerability

i18n

i18n gem Cross-site Scripting vulnerability

sounder

Sounder Contains Arbitrary Command Execution Vulnerability

actionmailer

actionmailer email address processing causes Denial of service

wicked

Wicked gem contains Path traversal vulnerability

rdoc

RDoc contains XSS vulnerability

fastreader

fastreader Gem for Ruby URI Handling Arbitrary Command Injection

passenger

insecure temporary directory usage in passenger

mini_magick

MiniMagick Gem for Ruby URI Handling Arbitrary Command Injection

json, json, json

JSON gem has Improper Input Validation vulnerability

activesupport, activesupport

activesupport in Rails vulnerable to incorrect data conversion

js-yaml

Deserialization Code Execution in js-yaml

sprout

sprout Arbitrary Code Execution vulnerability