# RubyGems Advisories. Every RubyGems Advisory we hold (Ruby), newest first. ## Records, newest first (an older page) - [samlr XML nodes comment attack](https://agentprime.io/advisories/GHSA-qpxp-5j56-gg3x.md) `GHSA-qpxp-5j56-gg3x`, `CVE-2018-20857` · RubyGems `samlr`: affected `<2.6.2`, fixed in `2.6.2` · CVSS 7.5 High · Not analysed yet · Published 31 Jul 2019 · Tags: CWE-20 - [datagrid contains code Injection backdoor](https://agentprime.io/advisories/GHSA-rqp5-pg7w-832p.md) `GHSA-rqp5-pg7w-832p`, `CVE-2019-14281` · RubyGems `datagrid`: affected `=1.0.6`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Jul 2019 · Tags: Code injection - [Code backdoor in simple_captcha2](https://agentprime.io/advisories/GHSA-wg6j-r28m-7293.md) `GHSA-wg6j-r28m-7293`, `CVE-2019-14282` · RubyGems `simple_captcha2`: affected `=0.2.3`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Jul 2019 · Tags: Code injection - [SQL Injection in marginalia](https://agentprime.io/advisories/GHSA-hrj5-qp7x-rpg6.md) `GHSA-hrj5-qp7x-rpg6`, `CVE-2019-1010191` · RubyGems `marginalia`: affected `<1.6`, fixed in `1.6` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jul 2019 · Tags: SQL injection - [Regular Expression Denial of Service (ReDoS) in lodash](https://agentprime.io/advisories/GHSA-x5rq-j2xg-h7qm.md) `GHSA-x5rq-j2xg-h7qm`, `CVE-2019-1010266`, `SNYK-JS-LODASH-73639` · npm `lodash` and 3 more: affected `>=4.7.0, <4.17.11`, fixed in `4.17.11` · CVSS 6.5 Medium · Not analysed yet · Published 19 Jul 2019 · Tags: Denial of service - [OS Command Injection in MiniMagick](https://agentprime.io/advisories/GHSA-r7j3-vvh2-xrpj.md) `GHSA-r7j3-vvh2-xrpj`, `CVE-2019-13574` · RubyGems `mini_magick`: affected `<4.9.4`, fixed in `4.9.4` · CVSS 7.8 High · Not analysed yet · Published 18 Jul 2019 · Tags: Command injection - [field_test gem contains injection vulnerability](https://agentprime.io/advisories/GHSA-wg9m-gw3h-hg83.md) `GHSA-wg9m-gw3h-hg83`, `CVE-2019-13146` · RubyGems `field_test`: affected `>=0.3.0, <0.3.1`, fixed in `0.3.1` · CVSS 5.3 Medium · Not analysed yet · Published 16 Jul 2019 · Tags: Other injection - [paranoid2 gem Code backdoor](https://agentprime.io/advisories/GHSA-4g4c-8gqh-m4vm.md) `GHSA-4g4c-8gqh-m4vm`, `CVE-2019-13589` · RubyGems `paranoid2`: affected `=1.1.6`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jul 2019 · Tags: CWE-829 - [Slanger Arbitrary command execution](https://agentprime.io/advisories/GHSA-rg32-m3hf-772v.md) `GHSA-rg32-m3hf-772v`, `CVE-2019-1010306` · RubyGems `slanger`: affected `<0.6.1`, fixed in `0.6.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jul 2019 · Tags: Insecure deserialization - [Prototype Pollution in lodash](https://agentprime.io/advisories/GHSA-jf85-cpcp-j695.md) `GHSA-jf85-cpcp-j695`, `CVE-2019-10744`, `SNYK-JS-LODASH-450202` · npm `lodash` and 4 more: affected `<4.17.12`, fixed in `4.17.12` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Jul 2019 · Tags: Prototype pollution, CWE-20 - [strong_password Ruby gem malicious version causing Remote Code Execution vulnerability](https://agentprime.io/advisories/GHSA-5h5r-ffc4-c455.md) `GHSA-5h5r-ffc4-c455`, `CVE-2019-13354` · RubyGems `strong_password`: affected `>=0.0.7, <0.0.8`, fixed in `0.0.8` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Jul 2019 · Tags: Code injection - [OmniAuth-SAML authentication bypass via incorrect XML canonicalization and DOM traversal](https://agentprime.io/advisories/GHSA-94hm-8q65-rmxm.md) `GHSA-94hm-8q65-rmxm`, `CVE-2017-11430` · RubyGems `omniauth-saml`: affected `<1.10.0`, fixed in `1.10.0` · CVSS 7.7 High · Not analysed yet · Published 5 Jul 2019 · Tags: Authentication bypass - [Ruby-SAML Improper Authentication vulnerability](https://agentprime.io/advisories/GHSA-x2fr-v8wf-8wwv.md) `GHSA-x2fr-v8wf-8wwv`, `CVE-2017-11428` · RubyGems `ruby-saml`: affected `<1.7.0`, fixed in `1.7.0` · CVSS 7.7 High · Not analysed yet · Published 5 Jul 2019 · Tags: Authentication bypass - [Path Traversal vulnerability that affects yard](https://agentprime.io/advisories/GHSA-xfhh-rx56-rxcr.md) `GHSA-xfhh-rx56-rxcr`, `CVE-2019-1020001` · RubyGems `yard`: affected `<0.9.20`, fixed in `0.9.20` · CVSS 7.5 High · Not analysed yet · Published 2 Jul 2019 · Tags: Path traversal - [RubyGems Escape sequence injection in errors](https://agentprime.io/advisories/GHSA-4wm8-fjv7-j774.md) `GHSA-4wm8-fjv7-j774`, `CVE-2019-8325` · RubyGems `rubygems-update`: affected `>=2.6.0, <2.7.9 || >=3.0.0, <3.0.2`, fixed in `2.7.9`, `3.0.2` · CVSS 7.5 High · Not analysed yet · Published 20 Jun 2019 · Tags: Other injection - [RubyGems Delete directory using symlink when decompressing tar](https://agentprime.io/advisories/GHSA-5x32-c9mf-49cc.md) `GHSA-5x32-c9mf-49cc`, `CVE-2019-8320` · RubyGems `rubygems-update`: affected `>=2.7.6, <2.7.9 || >=3.0.0, <3.0.3`, fixed in `2.7.9`, `3.0.3` · CVSS 7.4 High · Not analysed yet · Published 20 Jun 2019 · Tags: Path traversal - [Code injection in RubyGems](https://agentprime.io/advisories/GHSA-76wm-422q-92mq.md) `GHSA-76wm-422q-92mq`, `CVE-2019-8324` · RubyGems `rubygems-update`: affected `>=2.6.0, <2.7.9 || >=3.0.0, <3.0.2`, fixed in `2.7.9`, `3.0.2` · CVSS 8.8 High · Not analysed yet · Published 20 Jun 2019 · Tags: Code injection - [RubyGems Escape sequence injection vulnerability in verbose](https://agentprime.io/advisories/GHSA-fr32-gr5c-xq5c.md) `GHSA-fr32-gr5c-xq5c`, `CVE-2019-8321` · RubyGems `rubygems-update`: affected `>=2.6.0, <2.7.9 || >=3.0.0, <3.0.2`, fixed in `2.7.9`, `3.0.2` · CVSS 7.5 High · Not analysed yet · Published 20 Jun 2019 · Tags: Command injection - [RubyGems Escape sequence injection vulnerability in gem owner](https://agentprime.io/advisories/GHSA-mh37-8c3g-3fgc.md) `GHSA-mh37-8c3g-3fgc`, `CVE-2019-8322` · RubyGems `rubygems-update`: affected `>=2.6.0, <2.7.9 || >=3.0.0, <3.0.2`, fixed in `2.7.9`, `3.0.2` · CVSS 7.5 High · Not analysed yet · Published 20 Jun 2019 · Tags: Other injection - [RubyGems Escape sequence injection vulnerability in api response handling](https://agentprime.io/advisories/GHSA-3h4r-pjv6-cph9.md) `GHSA-3h4r-pjv6-cph9`, `CVE-2019-8323` · RubyGems `rubygems-update`: affected `>=2.6.0, <2.7.9 || >=3.0.0, <3.0.2`, fixed in `2.7.9`, `3.0.2` · CVSS 7.5 High · Not analysed yet · Published 20 Jun 2019 · Tags: Other injection - [ruby-openid SSRF via claimed_id request](https://agentprime.io/advisories/GHSA-fqfj-cmh6-hj49.md) `GHSA-fqfj-cmh6-hj49`, `CVE-2019-11027` · RubyGems `ruby-openid`: affected `<2.9.0`, fixed in `2.9.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Jun 2019 · Tags: Server-side request forgery (SSRF) - [Cross-site Scripting in Chartkick](https://agentprime.io/advisories/GHSA-g45g-g52h-39rg.md) `GHSA-g45g-g52h-39rg`, `CVE-2019-12732` · RubyGems `chartkick`: affected `<3.2.0`, fixed in `3.2.0` · CVSS 4.7 Medium · Not analysed yet · Published 7 Jun 2019 · Tags: Cross-site scripting (XSS) - [OmniAuth Ruby gem Cross-site Request Forgery in request phase](https://agentprime.io/advisories/GHSA-ww4x-rwq6-qpgf.md) `GHSA-ww4x-rwq6-qpgf`, `CVE-2015-9284` · RubyGems `omniauth`: affected `<2.0.0`, fixed in `2.0.0` · CVSS 8.8 High · Not analysed yet · Published 29 May 2019 · Tags: Cross-site request forgery (CSRF) - [Duplicate Advisory: Prototype Pollution in jquery](https://agentprime.io/advisories/GHSA-wv67-q8rr-grjp.md) `GHSA-wv67-q8rr-grjp`, `CVE-2019-5428` · Maven `org.webjars.npm:jquery` and 3 more: affected `<3.4.0`, fixed in `3.4.0` · No CVSS score · Withdrawn · Not analysed yet · Published 23 Apr 2019 - [Bootstrap-sass contains code execution backdoor](https://agentprime.io/advisories/GHSA-vqqv-v9m2-48p2.md) `GHSA-vqqv-v9m2-48p2`, `CVE-2019-10842` · RubyGems `bootstrap-sass`: affected `>=3.2.0.3, <3.2.0.4`, fixed in `3.2.0.4` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Apr 2019 · Tags: Code injection - [Improper Certificate Validation in chloride](https://agentprime.io/advisories/GHSA-573x-jhqh-jg36.md) `GHSA-573x-jhqh-jg36`, `CVE-2018-6517` · RubyGems `chloride`: affected `<0.3.0`, fixed in `0.3.0` · CVSS 7.5 High · Not analysed yet · Published 25 Mar 2019 · Tags: Weak cryptography or TLS - [Doorkeeper-openid_connect contains Open Redirect](https://agentprime.io/advisories/GHSA-vv4c-g6q7-p3q7.md) `GHSA-vv4c-g6q7-p3q7`, `CVE-2019-9837` · RubyGems `doorkeeper-openid_connect`: affected `>=1.4.0, <1.5.4`, fixed in `1.5.4` · CVSS 6.1 Medium · Not analysed yet · Published 25 Mar 2019 · Tags: Open redirect - [devise Time-of-check Time-of-use Race Condition vulnerability](https://agentprime.io/advisories/GHSA-73rf-6mrf-759q.md) `GHSA-73rf-6mrf-759q`, `CVE-2019-5421` · RubyGems `devise`: affected `<4.6.0`, fixed in `4.6.0` · No CVSS score · Not analysed yet · Published 19 Mar 2019 · Tags: Race condition - [Use of Insufficiently Random Values in Railties Allows Remote Code Execution](https://agentprime.io/advisories/GHSA-m42h-mh85-4qgc.md) `GHSA-m42h-mh85-4qgc`, `CVE-2019-5420` · RubyGems `railties`: affected `>=5.2.0, <5.2.2.1`, fixed in `5.2.2.1` · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.89 · Not analysed yet · Published 13 Mar 2019 · Tags: Command injection, Weak cryptography or TLS - [Path Traversal in Action View](https://agentprime.io/advisories/GHSA-86g5-2wh3-gc9j.md) `GHSA-86g5-2wh3-gc9j`, `CVE-2019-5418` · RubyGems `actionview`: affected `>=4.0.0, <4.2.11.1 || >=5.0.0, <5.0.7.2 || >=5.1.0, <5.1.6.2 || >=5.2.0, <5.2.2.1`, fixed in `4.2.11.1`, `5.0.7.2`, `5.1.6.2`, `5.2.2.1` · CVSS 7.5 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.99 · Not analysed yet · Published 13 Mar 2019 · Tags: Path traversal - [Denial of Service Vulnerability in Action View](https://agentprime.io/advisories/GHSA-m63j-wh5w-c252.md) `GHSA-m63j-wh5w-c252`, `CVE-2019-5419` · RubyGems `actionview`: affected `>=4.0.0, <4.2.11.1 || >=5.0.0, <5.0.7.2 || >=5.1.0, <5.1.6.2 || >=5.2.0, <5.2.2.1 || >=6.0.0.beta1, <6.0.0.beta3`, fixed in `4.2.11.1`, `5.0.7.2`, `5.1.6.2`, `5.2.2.1`, `6.0.0.beta3` · CVSS 7.5 High · Not analysed yet · Published 13 Mar 2019 · Tags: Denial of service - [Bootstrap Vulnerable to Cross-Site Scripting](https://agentprime.io/advisories/GHSA-9v3m-8fp8-mj99.md) `GHSA-9v3m-8fp8-mj99`, `CVE-2019-8331`, `PKSA-n9qh-kqvz-7b6d` · Maven `org.webjars:bootstrap` and 9 more: affected `>=3.0.0, <3.4.1 || >=4.0.0, <4.3.1`, fixed in `3.4.1`, `4.3.1` · CVSS 6.1 Medium · EPSS 0.16 · Not analysed yet · Published 22 Feb 2019 · Tags: Cross-site scripting (XSS) - [Prototype Pollution in lodash](https://agentprime.io/advisories/GHSA-4xc9-xhrj-v574.md) `GHSA-4xc9-xhrj-v574`, `CVE-2018-16487` · npm `lodash` and 1 more: affected `<4.17.11`, fixed in `4.17.11` · No CVSS score · Not analysed yet · Published 7 Feb 2019 · Tags: Denial of service - [High severity vulnerability that affects many_versioned_gem](https://agentprime.io/advisories/GHSA-hhxm-4f85-rgr8.md) `GHSA-hhxm-4f85-rgr8` · RubyGems `many_versioned_gem`: affected `<0.2.3`, fixed in `0.2.3` · No CVSS score · Withdrawn · Not analysed yet · Published 5 Feb 2019 - [Nokogiri NULL Pointer Dereference](https://agentprime.io/advisories/GHSA-6qvp-r6r3-9p7h.md) `GHSA-6qvp-r6r3-9p7h`, `CVE-2018-14404` · RubyGems `nokogiri`: affected `<1.8.5`, fixed in `1.8.5` · CVSS 7.5 High · Not analysed yet · Published 17 Jan 2019 · Tags: Memory corruption - [bootstrap Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-ph58-4vrj-w6hr.md) `GHSA-ph58-4vrj-w6hr`, `CVE-2018-20677`, `PKSA-p8c4-fdq4-sycz` · Maven `org.webjars:bootstrap` and 6 more: affected `<3.4.0`, fixed in `3.4.0` · CVSS 6.1 Medium · Not analysed yet · Published 17 Jan 2019 · Tags: Cross-site scripting (XSS) - [XSS vulnerability that affects bootstrap](https://agentprime.io/advisories/GHSA-3mgp-fx93-9xv5.md) `GHSA-3mgp-fx93-9xv5`, `CVE-2018-20676`, `PKSA-np3v-gp83-8hk7` · Maven `org.webjars:bootstrap` and 6 more: affected `<3.4.0`, fixed in `3.4.0` · CVSS 6.1 Medium · Not analysed yet · Published 17 Jan 2019 · Tags: Cross-site scripting (XSS) - [Bootstrap Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-4p24-vmcr-4gqj.md) `GHSA-4p24-vmcr-4gqj`, `CVE-2016-10735`, `PKSA-4yjv-xg8r-3739` · Maven `org.webjars:bootstrap` and 7 more: affected `>=2.0.4, <3.4.0 || >=4.0.0-beta, <4.0.0-beta.2`, fixed in `3.4.0`, `4.0.0-beta.2` · CVSS 6.1 Medium · Not analysed yet · Published 17 Jan 2019 · Tags: Cross-site scripting (XSS) - [Cross Site Scripting (XSS) vulnerability in easymon](https://agentprime.io/advisories/GHSA-c289-47qf-rvrr.md) `GHSA-c289-47qf-rvrr`, `CVE-2018-1000855` · RubyGems `easymon`: affected `<1.4.1`, fixed in `1.4.1` · CVSS 6.1 Medium · Not analysed yet · Published 21 Dec 2018 · Tags: Cross-site scripting (XSS) - [Fat Free CRM vulnerable to Cross-site Scripting](https://agentprime.io/advisories/GHSA-j5rj-g695-342r.md) `GHSA-j5rj-g695-342r`, `CVE-2018-1000842` · RubyGems `fat_free_crm`: affected `<0.14.2 || >=0.15.0, <0.15.2 || >=0.16.0, <0.16.4 || >=0.17.0, <0.17.3 || >=0.18.0, <0.18.1`, fixed in `0.14.2`, `0.15.2`, `0.16.4`, `0.17.3`, `0.18.1` · CVSS 6.1 Medium · Not analysed yet · Published 20 Dec 2018 · Tags: Cross-site scripting (XSS) - [Improper Access Control in activejob](https://agentprime.io/advisories/GHSA-q2qw-rmrh-vv42.md) `GHSA-q2qw-rmrh-vv42`, `CVE-2018-16476` · RubyGems `activejob`: affected `>=4.2.0, <4.2.11 || >=5.0.0, <5.0.7.1 || >=5.1.0, <5.1.6.1 || >=5.2.0, <5.2.1.1`, fixed in `4.2.11`, `5.0.7.1`, `5.1.6.1`, `5.2.1.1` · CVSS 7.5 High · Not analysed yet · Published 5 Dec 2018 · Tags: Broken access control, Insecure deserialization - [Exposure of Sensitive Information to an Unauthorized Actor in activestorage](https://agentprime.io/advisories/GHSA-7rr7-rcjw-56vj.md) `GHSA-7rr7-rcjw-56vj`, `CVE-2018-16477` · RubyGems `activestorage`: affected `>=5.2.0, <5.2.1.1`, fixed in `5.2.1.1` · CVSS 6.5 Medium · Not analysed yet · Published 5 Dec 2018 · Tags: Information disclosure - [Rack vulnerable to Cross-site Scripting](https://agentprime.io/advisories/GHSA-5r2p-j47h-mhpg.md) `GHSA-5r2p-j47h-mhpg`, `CVE-2018-16471` · RubyGems `rack`: affected `<1.6.11 || >=2.0.0, <2.0.6`, fixed in `1.6.11`, `2.0.6` · CVSS 6.1 Medium · Not analysed yet · Published 15 Nov 2018 · Tags: Cross-site scripting (XSS) - [Rack vulnerable to Denial of Service](https://agentprime.io/advisories/GHSA-hg78-4f6x-99wq.md) `GHSA-hg78-4f6x-99wq`, `CVE-2018-16470` · RubyGems `rack`: affected `>=2.0.4, <2.0.6`, fixed in `2.0.6` · CVSS 7.5 High · Not analysed yet · Published 15 Nov 2018 · Tags: Denial of service - [Content Injection via TileJSON Name in mapbox.js](https://agentprime.io/advisories/GHSA-q69p-5h74-w36f.md) `GHSA-q69p-5h74-w36f`, `CVE-2017-1000043` · npm `mapbox.js` and 1 more: affected `<1.6.6 || >=2.0.0, <2.2.4`, fixed in `1.6.6`, `2.2.4` · CVSS 6.1 Medium · Not analysed yet · Published 9 Nov 2018 · Tags: Cross-site scripting (XSS) - [Content Injection via TileJSON attribute in mapbox.js](https://agentprime.io/advisories/GHSA-qr28-7j6p-9hmv.md) `GHSA-qr28-7j6p-9hmv`, `CVE-2017-1000042` · npm `mapbox.js` and 1 more: affected `<1.6.5 || >=2.0.0, <2.1.7`, fixed in `1.6.5`, `2.1.7` · CVSS 6.1 Medium · Not analysed yet · Published 9 Nov 2018 · Tags: Cross-site scripting (XSS) - [Loofah Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-g4xq-jx4w-4cjv.md) `GHSA-g4xq-jx4w-4cjv`, `CVE-2018-16468` · RubyGems `loofah`: affected `<2.2.3`, fixed in `2.2.3` · CVSS 5.4 Medium · Not analysed yet · Published 1 Nov 2018 · Tags: Cross-site scripting (XSS) - [mysql-bunuuid-rails vulnerable to SQL injection](https://agentprime.io/advisories/GHSA-6j63-35hj-vmcg.md) `GHSA-6j63-35hj-vmcg`, `CVE-2018-18476` · RubyGems `mysql-binuuid-rails`: affected `<1.1.1`, fixed in `1.1.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2018 · Tags: SQL injection - [Moderate severity vulnerability that affects sprockets](https://agentprime.io/advisories/GHSA-r4x3-g983-9g48.md) `GHSA-r4x3-g983-9g48` · RubyGems `sprockets`: affected `<2.0.5 || >=2.1.0, <2.1.4 || >=2.2.0, <2.2.3 || >=2.4.0, <2.4.6 || >=2.5.0, <2.5.1 || >=2.6.0, <2.7.1 || >=2.8.0, <2.8.3 || >=2.9.0, <2.9.4 || >=2.10.0, <2.10.2 || >=2.11.0, <2.11.3 || >=2.12.0, <2.12.3`, fixed in `2.0.5`, `2.1.4`, `2.2.3`, `2.4.6`, `2.5.1`, `2.7.1`, `2.8.3`, `2.9.4`, `2.10.2`, `2.11.3`, `2.12.3` · No CVSS score · Withdrawn · Not analysed yet · Published 10 Oct 2018 - [Insecure use of temporary files in Phusion passenger](https://agentprime.io/advisories/GHSA-qw8w-2xcp-xg59.md) `GHSA-qw8w-2xcp-xg59`, `CVE-2014-1832` · RubyGems `passenger`: affected `>=4.0.37, <4.0.38`, fixed in `4.0.38` · No CVSS score · Not analysed yet · Published 10 Oct 2018 - [Insecure use of temporary files in passenger](https://agentprime.io/advisories/GHSA-c7j7-p5jq-26ff.md) `GHSA-c7j7-p5jq-26ff`, `CVE-2014-1831` · RubyGems `passenger`: affected `<4.0.38`, fixed in `4.0.38` · No CVSS score · Not analysed yet · Published 10 Oct 2018 - [Phusion Passenger allows remote attackers to spoof headers](https://agentprime.io/advisories/GHSA-fxwv-953p-7qpf.md) `GHSA-fxwv-953p-7qpf`, `CVE-2015-7519` · RubyGems `passenger`: affected `<4.0.60 || >=5.0.0, <5.0.22`, fixed in `4.0.60`, `5.0.22` · CVSS 3.7 Low · Not analysed yet · Published 10 Oct 2018 · Tags: CWE-20 - [smart_proxy_dynflow gem authentication bypass in Foreman remote execution feature](https://agentprime.io/advisories/GHSA-gx5g-xcxj-cx2w.md) `GHSA-gx5g-xcxj-cx2w`, `CVE-2018-14643` · RubyGems `smart_proxy_dynflow`: affected `<0.1.11 || >=0.2.0, <0.2.1`, fixed in `0.1.11`, `0.2.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2018 · Tags: Authentication bypass, CWE-592 - [Jekyll allows attackers to access arbitrary files by specifying a symlink](https://agentprime.io/advisories/GHSA-4xjh-m3qx-49wc.md) `GHSA-4xjh-m3qx-49wc`, `CVE-2018-17567` · RubyGems `jekyll`: affected `<3.6.3 || >=3.7.0, <3.7.4 || >=3.8.0, <3.8.4`, fixed in `3.6.3`, `3.7.4`, `3.8.4` · CVSS 7.5 High · Not analysed yet · Published 28 Sept 2018 · Tags: Path traversal - [Moderate severity vulnerability that affects rails-html-sanitizer](https://agentprime.io/advisories/GHSA-77pc-q5q7-qg9h.md) `GHSA-77pc-q5q7-qg9h` · RubyGems `rails-html-sanitizer`: affected `<1.0.3`, fixed in `1.0.3` · No CVSS score · Withdrawn · Not analysed yet · Published 17 Sept 2018 - [Moderate severity vulnerability that affects rails-html-sanitizer](https://agentprime.io/advisories/GHSA-mrhj-2g4v-39qx.md) `GHSA-mrhj-2g4v-39qx` · RubyGems `rails-html-sanitizer`: affected `>=1.0.2, <1.0.3`, fixed in `1.0.3` · No CVSS score · Withdrawn · Not analysed yet · Published 17 Sept 2018 - [Moderate severity vulnerability that affects activerecord](https://agentprime.io/advisories/GHSA-7phj-gmgx-2r66.md) `GHSA-7phj-gmgx-2r66` · RubyGems `activerecord`: affected `>=3.0.0, <3.2.22.1 || >=4.0.0, <4.1.14.1 || >=4.2.0, <4.2.5.1`, fixed in `3.2.22.1`, `4.1.14.1`, `4.2.5.1` · No CVSS score · Withdrawn · Not analysed yet · Published 17 Sept 2018 - [Moderate severity vulnerability that affects rails-html-sanitizer](https://agentprime.io/advisories/GHSA-qc8j-m8j3-rjq6.md) `GHSA-qc8j-m8j3-rjq6` · RubyGems `rails-html-sanitizer`: affected `<1.0.3`, fixed in `1.0.3` · No CVSS score · Withdrawn · Not analysed yet · Published 17 Sept 2018 - [Moderate severity vulnerability that affects actionpack](https://agentprime.io/advisories/GHSA-vwfg-qj3r-6v3r.md) `GHSA-vwfg-qj3r-6v3r` · RubyGems `actionpack`: affected `<3.2.22.1 || >=4.0.0, <4.1.14.1 || >=4.2.0, <4.2.5.1`, fixed in `3.2.22.1`, `4.1.14.1`, `4.2.5.1` · No CVSS score · Withdrawn · Not analysed yet · Published 17 Sept 2018 - [Heap-based buffer overflow in nokogiri](https://agentprime.io/advisories/GHSA-jxjr-5h69-qw3w.md) `GHSA-jxjr-5h69-qw3w`, `CVE-2015-7499` · RubyGems `nokogiri`: affected `>=1.6.0, <1.6.7.2`, fixed in `1.6.7.2` · No CVSS score · Not analysed yet · Published 17 Sept 2018 · Tags: Memory corruption Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .