Open Source Vulnerabilities

actionpack, actionpack, actionpack, actionpack

actionpack vulnerable to Path Traversal

geddy

Directory Traversal in geddy

sprockets, sprockets, sprockets, sprockets, sprockets, sprockets, sprockets, sprockets, sprockets, sprockets, sprockets, sprockets

sprockets vulnerable to Path Traversal

uglify-js, uglifier

Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js

ms

Regular Expression Denial of Service in ms

aescrypt

Aescrypt does not sufficiently use random values

validator

Moderate severity vulnerability that affects validator

syntax-error

Potential for Script Injection in syntax-error

rails-html-sanitizer

rails-html-sanitizer Cross-site Scripting vulnerability

bassmaster

Arbitrary JavaScript Execution in bassmaster

web-console

Web Console (Ruby gem) contains whitelisted_ips bypass

actionpack, actionpack

actionpack vulnerable to Cross-site Scripting

paperclip

paperclip Cross-site Scripting vulnerability

actionpack, actionpack, actionpack

actionpack Path Traversal vulnerability

colorscore

colorscore Command Injection vulnerability

actionpack

actionpack Improper Input Validation vulnerability

crumb

CORS Token Disclosure in crumb

will_paginate

will_paginate Cross-site Scripting vulnerability

facter, facter, hiera, puppet, puppet, mcollective-client

facter, hiera, mcollective-client, and puppet affected by untrusted search path vulnerability

paratrooper-newrelic

Paratrooper-newrelic Exposes of Sensitive Information to an Unauthorized Actor

validator

Moderate severity vulnerability that affects validator

actionpack

actionpack is vulnerable to denial of service because of a wildcard controller route

activerecord, activerecord

Active Record subject to strong parameters protection bypass

sentry-raven

sentry-raven allows remote attackers to cause a denial of service via a large exponent value in a scientific number

uglify-js

Regular Expression Denial of Service in uglify-js

marked

VBScript Content Injection in marked

hapi

File Descriptor Leak Can Cause DoS Vulnerability in hapi

handlebars

Moderate severity vulnerability that affects handlebars

paratrooper-pingdom

Local API Login Credentials Disclosure in paratrooper-pingdom

tar

Symlink Arbitrary File Overwrite in tar

rails-html-sanitizer

rails-html-sanitizer Cross-site Scripting vulnerability

actionpack, actionpack, actionpack, actionpack

Directory traversal vulnerability in actionpack

Arabic-Prawn

Arabic Prawn allows remote attackers to execute arbitrary commands via shell metacharacters

marked

Regular Expression Denial of Service in marked

activerecord, activerecord

Array data injection vulnerability in activerecord

activesupport, activesupport, activesupport

activesupport vulnerable to Denial of Service via large XML document depth

send

Root Path Disclosure in send

qs

Denial-of-Service Memory Exhaustion in qs

rails, rails, actionpack, actionpack

Rails vulnerable to Cross-site Scripting

activerecord

SQL Injection in Active Record

rest-client

rest-client allows local users to obtain sensitive information by reading the log

webbynode

Webbynode Code Injection vulnerability

actionpack, actionpack

actionpack is vulnerable to remote bypass authentication

validator

Multiple XSS Filter Bypasses in validator

dns-sync

dns-sync command injection vulnerability

mail

Mail Gem CRLF Injection vulnerability

validator

Moderate severity vulnerability that affects validator

activerecord, activerecord

Active Record contains SQL Injection via improper range quoting

rails-html-sanitizer

rails-html-sanitizer Cross-site Scripting vulnerability

rack, rack, rack

Rack vulnerable to Denial of Service via large parameter depth request