# RubyGems Advisories. Every RubyGems Advisory we hold (Ruby), newest first. ## Records, newest first (an older page) - [request_store has Incorrect Default Permissions](https://agentprime.io/advisories/GHSA-frp2-5qfc-7r8m.md) `GHSA-frp2-5qfc-7r8m`, `CVE-2024-43791` · RubyGems `request_store`: affected `>=1.3.2, <1.4.0`, fixed in `1.4.0` · CVSS 7.8 High · Not analysed yet · Published 23 Aug 2024 · Tags: Broken access control - [REXML denial of service vulnerability](https://agentprime.io/advisories/GHSA-vmwr-mc7x-5vc3.md) `GHSA-vmwr-mc7x-5vc3`, `CVE-2024-43398` · RubyGems `rexml`: affected `<3.3.6`, fixed in `3.3.6` · CVSS 5.9 Medium · Not analysed yet · Published 22 Aug 2024 · Tags: Denial of service - [fugit parse and parse_nat stall on lengthy input](https://agentprime.io/advisories/GHSA-2m96-52r3-2f3g.md) `GHSA-2m96-52r3-2f3g`, `CVE-2024-43380` · RubyGems `fugit`: affected `<1.11.1`, fixed in `1.11.1` · CVSS 5.3 Medium · Not analysed yet · Published 19 Aug 2024 · Tags: Denial of service - [Command Injection in sequenceserver](https://agentprime.io/advisories/GHSA-qv32-5wm2-p32h.md) `GHSA-qv32-5wm2-p32h`, `CVE-2024-42360` · RubyGems `sequenceserver`: affected `<3.1.2`, fixed in `3.1.2` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2024 · Tags: Command injection - [REXML DoS vulnerability](https://agentprime.io/advisories/GHSA-5866-49gr-22v4.md) `GHSA-5866-49gr-22v4`, `CVE-2024-41946` · RubyGems `rexml`: affected `<3.3.3`, fixed in `3.3.3` · CVSS 5.3 Medium · Not analysed yet · Published 2 Aug 2024 · Tags: Denial of service - [REXML DoS vulnerability](https://agentprime.io/advisories/GHSA-r55c-59qm-vjw6.md) `GHSA-r55c-59qm-vjw6`, `CVE-2024-41123` · RubyGems `rexml`: affected `<3.3.3`, fixed in `3.3.3` · CVSS 5.3 Medium · Not analysed yet · Published 1 Aug 2024 · Tags: Denial of service - [Cross-Site Request Forgery in Spina](https://agentprime.io/advisories/GHSA-wqw3-p83g-r24v.md) `GHSA-wqw3-p83g-r24v`, `CVE-2024-7106` · RubyGems `spina`: affected `<=2.18.0`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 25 Jul 2024 · Tags: Cross-site request forgery (CSRF) - [REXML denial of service vulnerability](https://agentprime.io/advisories/GHSA-4xqq-m2hx-25v8.md) `GHSA-4xqq-m2hx-25v8`, `CVE-2024-39908` · RubyGems `rexml`: affected `<3.3.2`, fixed in `3.3.2` · CVSS 4.3 Medium · Not analysed yet · Published 16 Jul 2024 · Tags: Denial of service - [Withdrawn Advisory: Bootstrap Cross-Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/GHSA-vc8w-jr9v-vj7f.md) `GHSA-vc8w-jr9v-vj7f`, `CVE-2024-6531` · Maven `org.webjars:bootstrap` and 6 more: affected `>=4.0.0, <5.0.0`, fixed in `5.0.0` · CVSS 6.4 Medium · Withdrawn · Not analysed yet · Published 11 Jul 2024 · Tags: Cross-site scripting (XSS) - [Withdrawn Advisory: Bootstrap Cross-Site Scripting (XSS) vulnerability](https://agentprime.io/advisories/GHSA-9mvj-f7w8-pvh2.md) `GHSA-9mvj-f7w8-pvh2`, `CVE-2024-6484` · Maven `org.webjars:bootstrap` and 8 more: affected `>=2.0.0, <=3.4.1`, no fixed version yet · CVSS 6.4 Medium · Withdrawn · Not analysed yet · Published 11 Jul 2024 · Tags: Cross-site scripting (XSS) - [Decidim cross-site scripting (XSS) in the admin panel](https://agentprime.io/advisories/GHSA-529p-jj47-w3m3.md) `GHSA-529p-jj47-w3m3`, `CVE-2024-27095` · RubyGems `decidim-admin`: affected `<0.27.6 || >=0.28.0.rc1, <0.28.1`, fixed in `0.27.6`, `0.28.1` · CVSS 5.4 Medium · Not analysed yet · Published 10 Jul 2024 · Tags: Cross-site scripting (XSS) - [Decidim cross-site scripting (XSS) in the pagination](https://agentprime.io/advisories/GHSA-7cx8-44pc-xv3q.md) `GHSA-7cx8-44pc-xv3q`, `CVE-2024-32469` · RubyGems `decidim`: affected `<0.27.6 || >=0.28.0.rc1, <0.28.1`, fixed in `0.27.6`, `0.28.1` · CVSS 7.1 High · Not analysed yet · Published 10 Jul 2024 · Tags: Cross-site scripting (XSS) - [Decidim vulnerable to data disclosure through the embed feature](https://agentprime.io/advisories/GHSA-qcj6-vxwx-4rqv.md) `GHSA-qcj6-vxwx-4rqv`, `CVE-2024-27090` · RubyGems `decidim`: affected `<0.27.6`, fixed in `0.27.6` · CVSS 5.3 Medium · Not analysed yet · Published 10 Jul 2024 · Tags: Information disclosure - [RailsAdmin Cross-site Scripting vulnerability in the list view](https://agentprime.io/advisories/GHSA-8qgm-g2vv-vwvc.md) `GHSA-8qgm-g2vv-vwvc`, `CVE-2024-39308` · RubyGems `rails_admin`: affected `>=3.0.0.beta, <3.1.3`, fixed in `3.1.3` · CVSS 6.8 Medium · Not analysed yet · Published 8 Jul 2024 · Tags: Cross-site scripting (XSS) - [Rack ReDoS Vulnerability in HTTP Accept Headers Parsing](https://agentprime.io/advisories/GHSA-cj83-2ww7-mvq7.md) `GHSA-cj83-2ww7-mvq7`, `CVE-2024-39316` · RubyGems `rack`: affected `>=3.1.0, <3.1.5`, fixed in `3.1.5` · CVSS 6.5 Medium · Not analysed yet · Published 3 Jul 2024 · Tags: Denial of service - [Missing security headers in Action Pack on non-HTML responses](https://agentprime.io/advisories/GHSA-fwhr-88qx-h9g7.md) `GHSA-fwhr-88qx-h9g7`, `BIT-rails-2024-28103`, `CVE-2024-28103` · RubyGems `actionpack`: affected `>=6.1.0, <6.1.7.8 || >=7.0.0, <7.0.8.4 || >=7.1.0, <7.1.3.4 || >=7.2.0.beta1, <7.2.0.beta2`, fixed in `6.1.7.8`, `7.0.8.4`, `7.1.3.4`, `7.2.0.beta2` · CVSS 5.4 Medium · Not analysed yet · Published 4 Jun 2024 · Tags: CWE-20 - [ActionText ContentAttachment can Contain Unsanitized HTML](https://agentprime.io/advisories/GHSA-prjp-h48f-jgf6.md) `GHSA-prjp-h48f-jgf6`, `BIT-rails-2024-32464`, `CVE-2024-32464` · RubyGems `actiontext`: affected `>=7.1.0, <7.1.3.4 || >=7.2.0.beta1, <7.2.0.beta2`, fixed in `7.1.3.4`, `7.2.0.beta2` · CVSS 6.1 Medium · Not analysed yet · Published 4 Jun 2024 · Tags: Cross-site scripting (XSS) - [activeadmin vulnerable to stored persistent cross-site scripting (XSS) in dynamic form legends](https://agentprime.io/advisories/GHSA-9mg6-x45v-hcfm.md) `GHSA-9mg6-x45v-hcfm`, `CVE-2024-37031` · RubyGems `activeadmin`: affected `<3.2.2 || >=4.0.0.beta1, <4.0.0.beta7`, fixed in `3.2.2`, `4.0.0.beta7` · CVSS 7.2 High · Not analysed yet · Published 2 Jun 2024 · Tags: Cross-site scripting (XSS) - [rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter](https://agentprime.io/advisories/GHSA-8c8q-2xw3-j869.md) `GHSA-8c8q-2xw3-j869`, `CVE-2024-35231` · RubyGems `rack-contrib`: affected `<2.5.0`, fixed in `2.5.0` · CVSS 8.6 High · Not analysed yet · Published 28 May 2024 · Tags: Denial of service - [Kaminari Insecure File Permissions Vulnerability](https://agentprime.io/advisories/GHSA-7r3j-qmr4-jfpj.md) `GHSA-7r3j-qmr4-jfpj`, `CVE-2024-32978` · RubyGems `kaminari`: affected `>=0.15.0, <0.16.2`, fixed in `0.16.2` · CVSS 6.6 Medium · Not analysed yet · Published 28 May 2024 · Tags: Broken access control - [REXML contains a denial of service vulnerability](https://agentprime.io/advisories/GHSA-vg3r-rm7w-2xgh.md) `GHSA-vg3r-rm7w-2xgh`, `CVE-2024-35176` · RubyGems `rexml`: affected `<3.2.7`, fixed in `3.2.7` · CVSS 5.3 Medium · Not analysed yet · Published 16 May 2024 · Tags: Denial of service - [Duplicate Advisory: Nokogiri updates packaged libxml2 to v2.12.7 to resolve CVE-2024-34459](https://agentprime.io/advisories/GHSA-r3w4-36x6-7r99.md) `GHSA-r3w4-36x6-7r99` · RubyGems `nokogiri`: affected `<1.16.5`, fixed in `1.16.5` · No CVSS score · Withdrawn · Not analysed yet · Published 14 May 2024 · Tags: Memory corruption - [Nokogiri updates packaged libxml2 to v2.12.7 to resolve CVE-2024-34459](https://agentprime.io/advisories/GHSA-r95h-9x8f-r3f7.md) `GHSA-r95h-9x8f-r3f7`, `CVE-2024-58377` · RubyGems `nokogiri`: affected `<1.16.5`, fixed in `1.16.5` · No CVSS score · Not analysed yet · Published 13 May 2024 · Tags: Memory corruption - [Trix Editor Arbitrary Code Execution Vulnerability](https://agentprime.io/advisories/GHSA-qjqp-xr96-cj99.md) `GHSA-qjqp-xr96-cj99`, `CVE-2024-34341` · npm `trix` and 1 more: affected `>=0.9.0, <1.3.2 || >=2.0.0, <2.1.1`, fixed in `1.3.2`, `2.1.1` · CVSS 5.4 Medium · Not analysed yet · Published 7 May 2024 · Tags: Cross-site scripting (XSS) - [Phlex vulnerable to Cross-site Scripting (XSS) via maliciously formed HTML attribute names and values](https://agentprime.io/advisories/GHSA-9p57-h987-4vgx.md) `GHSA-9p57-h987-4vgx`, `CVE-2024-32970` · RubyGems `phlex`: affected `<1.9.3 || >=1.10.0, <1.10.2`, fixed in `1.9.3`, `1.10.2` · CVSS 7.1 High · Not analysed yet · Published 1 May 2024 · Tags: Cross-site scripting (XSS) - [Sidekiq vulnerable to a Reflected XSS in Queues Web Page](https://agentprime.io/advisories/GHSA-q655-3pj8-9fxq.md) `GHSA-q655-3pj8-9fxq`, `CVE-2024-32887` · RubyGems `sidekiq`: affected `>=7.2.0, <7.2.4`, fixed in `7.2.4` · CVSS 5.5 Medium · Not analysed yet · Published 26 Apr 2024 · Tags: Cross-site scripting (XSS) - [Cross-site Scripting (XSS) possible due to improper sanitisation of \`href\` attributes on \`\\` tags](https://agentprime.io/advisories/GHSA-g7xq-xv8c-h98c.md) `GHSA-g7xq-xv8c-h98c`, `CVE-2024-32463` · RubyGems `phlex`: affected `<1.4.2 || >=1.5.0, <1.5.3 || >=1.6.0, <1.6.3 || >=1.7.0, <1.7.2 || >=1.8.0, <1.8.3 || >=1.9.0, <1.9.2 || >=1.10.0, <1.10.1`, fixed in `1.4.2`, `1.5.3`, `1.6.3`, `1.7.2`, `1.8.3`, `1.9.2`, `1.10.1` · CVSS 7.1 High · Not analysed yet · Published 17 Apr 2024 · Tags: Cross-site scripting (XSS) - [CarrierWave content-Type allowlist bypass vulnerability which possibly leads to XSS remained](https://agentprime.io/advisories/GHSA-vfmv-jfc5-pjjw.md) `GHSA-vfmv-jfc5-pjjw`, `CVE-2024-29034` · RubyGems `carrierwave`: affected `<2.2.6 || >=3.0.0, <3.0.7`, fixed in `2.2.6`, `3.0.7` · CVSS 6.8 Medium · Not analysed yet · Published 25 Mar 2024 · Tags: Cross-site scripting (XSS), CWE-436 - [RDoc RCE vulnerability with .rdoc_options](https://agentprime.io/advisories/GHSA-592j-995h-p23j.md) `GHSA-592j-995h-p23j`, `CVE-2024-27281` · RubyGems `rdoc`: affected `>=6.3.3, <6.3.4.1 || >=6.4.0, <6.4.1.1 || >=6.5.0, <6.5.1.1 || >=6.6.0, <6.6.3.1`, fixed in `6.3.4.1`, `6.4.1.1`, `6.5.1.1`, `6.6.3.1` · CVSS 4.5 Medium · Not analysed yet · Published 25 Mar 2024 · Tags: Other injection, Insecure deserialization - [StringIO buffer overread vulnerability](https://agentprime.io/advisories/GHSA-v5h6-c2hv-hv3r.md) `GHSA-v5h6-c2hv-hv3r`, `CVE-2024-27280` · RubyGems `stringio`: affected `<3.0.1.1`, fixed in `3.0.1.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Mar 2024 · Tags: Memory corruption, CWE-126 - [Duplicate Advisory: Use-after-free in libxml2 via Nokogiri::XML::Reader](https://agentprime.io/advisories/GHSA-vcc3-rw6f-jv97.md) `GHSA-vcc3-rw6f-jv97` · RubyGems `nokogiri`: affected `<1.15.6 || >=1.16.0, <1.16.2`, fixed in `1.15.6`, `1.16.2` · No CVSS score · Withdrawn · Not analysed yet · Published 18 Mar 2024 · Tags: Memory corruption - [ROTP 6.2.2 and 6.2.1 has 0666 permissions for the .rb files.](https://agentprime.io/advisories/GHSA-x2h8-qmj4-g62f.md) `GHSA-x2h8-qmj4-g62f`, `CVE-2024-28862` · RubyGems `rotp`: affected `>=6.2.1, <6.3.0`, fixed in `6.3.0` · CVSS 5.3 Medium · Not analysed yet · Published 18 Mar 2024 · Tags: Broken access control - [TurboBoost Commands vulnerable to arbitrary method invocation](https://agentprime.io/advisories/GHSA-mp76-7w5v-pr75.md) `GHSA-mp76-7w5v-pr75`, `CVE-2024-28181` · npm `@turbo-boost/commands` and 1 more: affected `<0.1.3 || >=0.2.0, <0.2.2`, fixed in `0.1.3`, `0.2.2` · CVSS 8.1 High · Not analysed yet · Published 15 Mar 2024 · Tags: Other injection - [discordrb OS Command Injection vulnerability](https://agentprime.io/advisories/GHSA-8832-4mm5-x2r6.md) `GHSA-8832-4mm5-x2r6`, `CVE-2023-28102` · RubyGems `discordrb`: affected `<3.4.3`, fixed in `3.4.3` · CVSS 8.4 High · Not analysed yet · Published 14 Mar 2024 · Tags: Command injection - [StimulusReflex arbitrary method call](https://agentprime.io/advisories/GHSA-f78j-4w3g-4q65.md) `GHSA-f78j-4w3g-4q65`, `CVE-2024-28121` · npm `stimulus_reflex` and 1 more: affected `<3.4.2 || >=3.5.0-pre0, <3.5.0-rc4`, fixed in `3.4.2`, `3.5.0-rc4` · CVSS 8.8 High · Not analysed yet · Published 12 Mar 2024 · Tags: Code injection - [Cross-site Scripting (XSS) possible with maliciously formed HTML attribute names and values in Phlex](https://agentprime.io/advisories/GHSA-242p-4v39-2v8g.md) `GHSA-242p-4v39-2v8g`, `CVE-2024-28199` · RubyGems `phlex`: affected `<1.0.1 || >=1.1.0, <1.1.1 || >=1.2.0, <1.2.2 || >=1.3.0, <1.3.3 || >=1.4.0, <1.4.1 || >=1.5.0, <1.5.2 || >=1.6.0, <1.6.2 || >=1.7.0, <1.7.1 || >=1.8.0, <1.8.2 || >=1.9.0, <1.9.1`, fixed in `1.0.1`, `1.1.1`, `1.2.2`, `1.3.3`, `1.4.1`, `1.5.2`, `1.6.2`, `1.7.1`, `1.8.2`, `1.9.1` · CVSS 7.1 High · Not analysed yet · Published 12 Mar 2024 · Tags: Cross-site scripting (XSS) - [json-jwt allows bypass of identity checks via a sign/encryption confusion attack](https://agentprime.io/advisories/GHSA-c8v6-786g-vjx6.md) `GHSA-c8v6-786g-vjx6`, `CVE-2023-51774` · RubyGems `json-jwt`: affected `<1.15.3.1 || >=1.16.0, <1.16.6`, fixed in `1.15.3.1`, `1.16.6` · CVSS 8.4 High · Not analysed yet · Published 29 Feb 2024 · Tags: Broken access control - [Rack vulnerable to ReDoS in content type parsing (2nd degree polynomial)](https://agentprime.io/advisories/GHSA-22f2-v57c-j9cx.md) `GHSA-22f2-v57c-j9cx`, `CVE-2024-25126` · RubyGems `rack`: affected `>=0.4, <2.2.8.1 || >=3.0.0, <3.0.9.1`, fixed in `2.2.8.1`, `3.0.9.1` · CVSS 5.3 Medium · EPSS 0.35 · Not analysed yet · Published 28 Feb 2024 · Tags: Denial of service - [Rack has possible DoS Vulnerability with Range Header](https://agentprime.io/advisories/GHSA-xj5v-6v4g-jfw6.md) `GHSA-xj5v-6v4g-jfw6`, `CVE-2024-26141` · RubyGems `rack`: affected `>=1.3.0, <2.2.8.1 || >=3.0.0, <3.0.9.1`, fixed in `2.2.8.1`, `3.0.9.1` · CVSS 5.8 Medium · Not analysed yet · Published 28 Feb 2024 · Tags: Denial of service - [Rack Header Parsing leads to Possible Denial of Service Vulnerability](https://agentprime.io/advisories/GHSA-54rr-7fvw-6x8f.md) `GHSA-54rr-7fvw-6x8f`, `CVE-2024-26146` · RubyGems `rack`: affected `<2.0.9.4 || >=2.1.0, <2.1.4.4 || >=2.2.0, <2.2.8.1 || >=3.0.0, <3.0.9.1`, fixed in `2.0.9.4`, `2.1.4.4`, `2.2.8.1`, `3.0.9.1` · CVSS 5.3 Medium · Not analysed yet · Published 28 Feb 2024 · Tags: Denial of service - [YARD's default template vulnerable to Cross-site Scripting in generated frames.html](https://agentprime.io/advisories/GHSA-8mq4-9jjh-9xrc.md) `GHSA-8mq4-9jjh-9xrc`, `CVE-2024-27285` · RubyGems `yard`: affected `<0.9.36`, fixed in `0.9.36` · CVSS 5.4 Medium · Not analysed yet · Published 28 Feb 2024 · Tags: Cross-site scripting (XSS) - [Rails has possible Sensitive Session Information Leak in Active Storage](https://agentprime.io/advisories/GHSA-8h22-8cf7-hq6g.md) `GHSA-8h22-8cf7-hq6g`, `BIT-rails-2024-26144`, `CVE-2024-26144` · RubyGems `activestorage`: affected `>=5.2.0, <6.1.7.7 || >=7.0.0, <7.0.8.1`, fixed in `6.1.7.7`, `7.0.8.1` · CVSS 5.3 Medium · Not analysed yet · Published 27 Feb 2024 · Tags: Information disclosure - [Rails has possible XSS Vulnerability in Action Controller](https://agentprime.io/advisories/GHSA-9822-6m93-xqf4.md) `GHSA-9822-6m93-xqf4`, `BIT-rails-2024-26143`, `CVE-2024-26143` · RubyGems `actionpack` and 1 more: affected `>=7.0.0, <7.0.8.1 || >=7.1.0, <7.1.3.1`, fixed in `7.0.8.1`, `7.1.3.1` · CVSS 6.1 Medium · Not analysed yet · Published 27 Feb 2024 · Tags: Cross-site scripting (XSS) - [Rails has possible ReDoS vulnerability in Accept header parsing in Action Dispatch](https://agentprime.io/advisories/GHSA-jjhx-jhvp-74wq.md) `GHSA-jjhx-jhvp-74wq`, `BIT-rails-2024-26142`, `CVE-2024-26142` · RubyGems `actionpack`: affected `>=7.1.0, <7.1.3.1`, fixed in `7.1.3.1` · CVSS 7.5 High · Not analysed yet · Published 27 Feb 2024 · Tags: Denial of service - [Rack CORS Middleware has Insecure File Permissions](https://agentprime.io/advisories/GHSA-785g-282q-pwvx.md) `GHSA-785g-282q-pwvx`, `CVE-2024-27456` · RubyGems `rack-cors`: affected `>=2.0.1, <2.0.2`, fixed in `2.0.2` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Feb 2024 · Tags: Information disclosure - [Cross-site scripting (XSS) in the dynamic file uploads](https://agentprime.io/advisories/GHSA-9w99-78rj-hmxq.md) `GHSA-9w99-78rj-hmxq`, `CVE-2023-51447` · RubyGems `decidim` and 1 more: affected `>=0.27.0, <0.27.5`, fixed in `0.27.5` · CVSS 6.3 Medium · Not analysed yet · Published 20 Feb 2024 · Tags: Cross-site scripting (XSS) - [Possibility to circumvent the invitation token expiry period](https://agentprime.io/advisories/GHSA-w3q8-m492-4pwp.md) `GHSA-w3q8-m492-4pwp`, `CVE-2023-48220` · RubyGems `decidim` and 3 more: affected `>=0.0.1.alpha3, <0.26.9 || >=0.27.0, <0.27.5`, fixed in `0.26.9`, `0.27.5` · CVSS 5.7 Medium · Not analysed yet · Published 20 Feb 2024 · Tags: CWE-672 - [Possible CSRF attack at questionnaire templates preview](https://agentprime.io/advisories/GHSA-f3qm-vfc3-jg6v.md) `GHSA-f3qm-vfc3-jg6v`, `CVE-2023-47635` · RubyGems `decidim-templates`: affected `>=0.23.0, <0.27.5`, fixed in `0.27.5` · CVSS 4.5 Medium · Not analysed yet · Published 20 Feb 2024 · Tags: Cross-site request forgery (CSRF), Server-side request forgery (SSRF) - [Race condition in Endorsements](https://agentprime.io/advisories/GHSA-r275-j57c-7mf2.md) `GHSA-r275-j57c-7mf2`, `CVE-2023-47634` · RubyGems `decidim`: affected `>=0.10.0, <0.26.9 || >=0.27.0, <0.27.5`, fixed in `0.26.9`, `0.27.5` · CVSS 3.1 Low · Not analysed yet · Published 20 Feb 2024 · Tags: Race condition - [XSS sidekiq-unique-jobs UI server vulnerability](https://agentprime.io/advisories/GHSA-cmh9-rx85-xj38.md) `GHSA-cmh9-rx85-xj38`, `CVE-2023-46950`, `CVE-2023-46951`, `CVE-2024-25122`, `GHSA-fhx8-5c23-x7x5` · RubyGems `sidekiq-unique-jobs`: affected `>=6.0.0.rc7, <7.1.33 || >=8.0.0, <8.0.7`, fixed in `7.1.33`, `8.0.7` · CVSS 7.1 High · Not analysed yet · Published 13 Feb 2024 · Tags: Cross-site scripting (XSS), Denial of service, CWE-754 - [Nokogiri update packaged libxml2 to v2.12.5 to resolve CVE-2024-25062](https://agentprime.io/advisories/GHSA-xc9x-jj77-9p9j.md) `GHSA-xc9x-jj77-9p9j`, `CVE-2024-58378` · RubyGems `nokogiri`: affected `<1.15.6 || >=1.16.0, <1.16.2`, fixed in `1.15.6`, `1.16.2` · No CVSS score · Not analysed yet · Published 5 Feb 2024 · Tags: Memory corruption - [Cross-site scripting (XSS) in Action messages on Avo](https://agentprime.io/advisories/GHSA-g8vp-2v5p-9qfh.md) `GHSA-g8vp-2v5p-9qfh`, `CVE-2024-22411` · RubyGems `avo`: affected `<2.47.0 || >=3.0.0.beta1, <3.3.0`, fixed in `2.47.0`, `3.3.0` · CVSS 6.5 Medium · Not analysed yet · Published 17 Jan 2024 · Tags: Cross-site scripting (XSS) - [avo vulnerable to stored cross-site scripting (XSS) in key_value field](https://agentprime.io/advisories/GHSA-ghjv-mh6x-7q6h.md) `GHSA-ghjv-mh6x-7q6h`, `CVE-2024-22191` · RubyGems `avo`: affected `<2.47.0 || >=3.0.0.beta1, <3.2.4`, fixed in `2.47.0`, `3.2.4` · CVSS 7.3 High · Not analysed yet · Published 16 Jan 2024 · Tags: Cross-site scripting (XSS) - [Devise-Two-Factor vulnerable to brute force attacks](https://agentprime.io/advisories/GHSA-chcr-x7hc-8fp8.md) `GHSA-chcr-x7hc-8fp8`, `CVE-2024-0227` · RubyGems `devise-two-factor`: affected `>=1.0.0, <=5.0.0`, no fixed version yet · CVSS 5.0 Medium · Withdrawn · Not analysed yet · Published 12 Jan 2024 · Tags: Authentication bypass - [Puma HTTP Request/Response Smuggling vulnerability](https://agentprime.io/advisories/GHSA-c2f4-cvqm-65w2.md) `GHSA-c2f4-cvqm-65w2`, `CVE-2024-21647` · RubyGems `puma`: affected `<5.6.8 || >=6.0.0, <6.4.2`, fixed in `5.6.8`, `6.4.2` · CVSS 5.9 Medium · Not analysed yet · Published 8 Jan 2024 · Tags: HTTP request smuggling - [view_component Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-wf2x-8w6j-qw37.md) `GHSA-wf2x-8w6j-qw37`, `CVE-2024-21636` · RubyGems `view_component`: affected `<2.83.0 || >=3.0.0, <3.9.0`, fixed in `2.83.0`, `3.9.0` · CVSS 6.1 Medium · Not analysed yet · Published 4 Jan 2024 · Tags: Cross-site scripting (XSS) - [Duplicate Advisory: Race Condition leading to logging errors](https://agentprime.io/advisories/GHSA-v444-jggx-6v7f.md) `GHSA-v444-jggx-6v7f` · RubyGems `audited`: affected `>=4.0.0`, no fixed version yet · CVSS 3.1 Low · Withdrawn · Not analysed yet · Published 4 Jan 2024 · Tags: Race condition - [Duplicate Advisory: Malicious URL drafting attack against iodines static file server may allow path traversal](https://agentprime.io/advisories/GHSA-qwf7-rv77-fcr3.md) `GHSA-qwf7-rv77-fcr3` · RubyGems `iodine`: affected `*`, no fixed version yet · No CVSS score · Withdrawn · Not analysed yet · Published 4 Jan 2024 · Tags: Path traversal - [Duplicate Advisory: httparty has multipart/form-data request tampering vulnerability](https://agentprime.io/advisories/GHSA-g47j-3m2m-74qv.md) `GHSA-g47j-3m2m-74qv` · RubyGems `httparty`: affected `<=0.20.0`, no fixed version yet · CVSS 5.3 Medium · Withdrawn · Not analysed yet · Published 4 Jan 2024 · Tags: Information disclosure, CWE-472 - [Duplicate Advisory: Integer overflow in cmark-gfm table parsing extension leads to heap memory corruption](https://agentprime.io/advisories/GHSA-c2v4-chx5-vff6.md) `GHSA-c2v4-chx5-vff6` · RubyGems `commonmarker`: affected `*`, no fixed version yet · No CVSS score · Withdrawn · Not analysed yet · Published 4 Jan 2024 · Tags: Memory corruption Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .