# RubyGems Advisories. Every RubyGems Advisory we hold (Ruby), newest first. ## Records, newest first (an older page) - [Possible Denial of Service Vulnerability in Rack's header parsing](https://agentprime.io/advisories/GHSA-c6qg-cjj8-47qp.md) `GHSA-c6qg-cjj8-47qp`, `CVE-2023-27539` · RubyGems `rack`: affected `>=2.0.0, <2.2.6.4 || >=3.0.0, <3.0.6.1`, fixed in `2.2.6.4`, `3.0.6.1` · CVSS 5.3 Medium · Not analysed yet · Published 15 Mar 2023 - [Possible XSS Security Vulnerability in SafeBuffer#bytesplice](https://agentprime.io/advisories/GHSA-pj73-v5mw-pm9j.md) `GHSA-pj73-v5mw-pm9j`, `CVE-2023-28120` · RubyGems `activesupport`: affected `<6.1.7.3 || >=7.0.0, <7.0.4.3`, fixed in `6.1.7.3`, `7.0.4.3` · CVSS 5.3 Medium · Not analysed yet · Published 15 Mar 2023 · Tags: Cross-site scripting (XSS) - [Rack has possible DoS Vulnerability in Multipart MIME parsing](https://agentprime.io/advisories/GHSA-3h57-hmj3-gj3p.md) `GHSA-3h57-hmj3-gj3p`, `CVE-2023-27530` · RubyGems `rack`: affected `<2.0.9.3 || >=2.1.0, <2.1.4.3 || >=2.2.0, <2.2.6.3 || >=3.0.0, <3.0.4.2`, fixed in `2.0.9.3`, `2.1.4.3`, `2.2.6.3`, `3.0.4.2` · CVSS 7.5 High · Not analysed yet · Published 8 Mar 2023 · Tags: Denial of service - [Code injection in pdf_info](https://agentprime.io/advisories/GHSA-9fh3-j99m-f4v7.md) `GHSA-9fh3-j99m-f4v7`, `CVE-2022-36231` · RubyGems `pdf_info`: affected `<=0.5.3`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Feb 2023 · Tags: Command injection, Code injection - [Withdrawn: Fortra GoAnywhere MFT Deserialization of Untrusted Data vulnerability affects metasploit-framework](https://agentprime.io/advisories/GHSA-6pm2-j2v8-h3cj.md) `GHSA-6pm2-j2v8-h3cj`, `CVE-2023-0669` · RubyGems `metasploit-framework`: affected `<=6.0.33`, no fixed version yet · CVSS 7.2 High · In CISA KEV, ransomware · EPSS 1.00 · Withdrawn · Not analysed yet · Published 6 Feb 2023 · Tags: Insecure deserialization - [Clockwork Web contains a Cross-Site Request Forgery Vulnerability with Rails < 5.2](https://agentprime.io/advisories/GHSA-p4xx-w6fr-c4w9.md) `GHSA-p4xx-w6fr-c4w9`, `CVE-2023-25015` · RubyGems `clockwork_web`: affected `<0.1.2`, fixed in `0.1.2` · CVSS 6.5 Medium · Not analysed yet · Published 2 Feb 2023 · Tags: Cross-site request forgery (CSRF), CWE-652 - [Publify contains Weak Password Requirements](https://agentprime.io/advisories/GHSA-g7gf-2rqw-5rwx.md) `GHSA-g7gf-2rqw-5rwx`, `BIT-publify-2023-0569`, `CVE-2023-0569` · RubyGems `publify_core`: affected `<9.2.10`, fixed in `9.2.10` · CVSS 8.1 High · Not analysed yet · Published 29 Jan 2023 · Tags: Hard-coded credentials - [Improper neutralization of \`noscript\` element content may allow XSS in Sanitize](https://agentprime.io/advisories/GHSA-fw3g-2h3j-qmm7.md) `GHSA-fw3g-2h3j-qmm7`, `CVE-2023-23627` · RubyGems `sanitize`: affected `>=5.0.0, <6.0.1`, fixed in `6.0.1` · CVSS 6.1 Medium · Not analysed yet · Published 28 Jan 2023 · Tags: Cross-site scripting (XSS) - [flash_tool Gem for Ruby File Download Handling Arbitrary Command Execution](https://agentprime.io/advisories/GHSA-6325-6g32-7p35.md) `GHSA-6325-6g32-7p35`, `CVE-2013-2513` · RubyGems `flash_tool`: affected `<=0.6.0`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jan 2023 · Tags: Command injection - [Devise Gem for Ruby Unauthorized Access Using "Remember Me" Cookie](https://agentprime.io/advisories/GHSA-746g-3gfp-hfhw.md) `GHSA-746g-3gfp-hfhw`, `CVE-2015-8314` · RubyGems `devise`: affected `<3.5.4`, fixed in `3.5.4` · CVSS 7.5 High · Not analysed yet · Published 26 Jan 2023 · Tags: Authentication bypass, Information disclosure - [xaviershay-dm-rails Gem for Ruby exposes sensitive information via the process table](https://agentprime.io/advisories/GHSA-88p8-4vv5-82j7.md) `GHSA-88p8-4vv5-82j7`, `CVE-2015-2179` · RubyGems `xaviershay-dm-rails`: affected `<=1.2.0`, no fixed version yet · CVSS 5.5 Medium · Not analysed yet · Published 26 Jan 2023 · Tags: Information disclosure - [Several quadratic complexity bugs may lead to denial of service in Commonmarker](https://agentprime.io/advisories/GHSA-636f-xm5j-pj9m.md) `GHSA-636f-xm5j-pj9m` · RubyGems `commonmarker`: affected `<0.23.7`, fixed in `0.23.7` · No CVSS score · Not analysed yet · Published 24 Jan 2023 · Tags: Denial of service - [ExifTool vulnerable to arbitrary code execution](https://agentprime.io/advisories/GHSA-q95h-cqrv-8jv5.md) `GHSA-q95h-cqrv-8jv5` · RubyGems `exiftool_vendored`: affected `<12.25.0`, fixed in `12.25.0` · CVSS 7.8 High · Not analysed yet · Published 20 Jan 2023 · Tags: Other injection - [jruby-openssl gem for JRuby fails to do proper certificate validation](https://agentprime.io/advisories/GHSA-xgv7-pqqh-h2w9.md) `GHSA-xgv7-pqqh-h2w9`, `CVE-2009-4123` · RubyGems `jruby-openssl`: affected `<0.6`, fixed in `0.6` · CVSS 7.5 High · Not analysed yet · Published 19 Jan 2023 · Tags: Weak cryptography or TLS - [Denial of Service Vulnerability in Rack Content-Disposition parsing](https://agentprime.io/advisories/GHSA-93pm-5p5f-3ghx.md) `GHSA-93pm-5p5f-3ghx`, `CVE-2022-44571` · RubyGems `rack`: affected `>=2.0.0, <2.0.9.2 || >=2.1.0, <2.1.4.2 || >=2.2.0, <2.2.6.1 || >=3.0.0.0, <3.0.4.1`, fixed in `2.0.9.2`, `2.1.4.2`, `2.2.6.1`, `3.0.4.1` · No CVSS score · Not analysed yet · Published 18 Jan 2023 · Tags: Denial of service - [ReDoS based DoS vulnerability in Action Dispatch](https://agentprime.io/advisories/GHSA-p84v-45xj-wwqj.md) `GHSA-p84v-45xj-wwqj`, `CVE-2023-22792` · RubyGems `actionpack`: affected `>=3.0.0, <5.2.8.15 || >=6.0.0, <6.1.7.1 || >=7.0.0, <7.0.4.1`, fixed in `5.2.8.15`, `6.1.7.1`, `7.0.4.1` · CVSS 7.5 High · Not analysed yet · Published 18 Jan 2023 · Tags: Denial of service - [ReDoS based DoS vulnerability in Active Support's underscore](https://agentprime.io/advisories/GHSA-j6gc-792m-qgm2.md) `GHSA-j6gc-792m-qgm2`, `CVE-2023-22796` · RubyGems `activesupport`: affected `<6.1.7.1 || >=7.0.0, <7.0.4.1`, fixed in `6.1.7.1`, `7.0.4.1` · No CVSS score · Not analysed yet · Published 18 Jan 2023 · Tags: Denial of service - [Open Redirect Vulnerability in Action Pack](https://agentprime.io/advisories/GHSA-9445-4cr6-336r.md) `GHSA-9445-4cr6-336r`, `CVE-2023-22797` · RubyGems `actionpack`: affected `>=7.0.0, <7.0.4.1`, fixed in `7.0.4.1` · CVSS 6.1 Medium · Not analysed yet · Published 18 Jan 2023 · Tags: Open redirect - [Denial of Service Vulnerability in ActiveRecord's PostgreSQL adapter](https://agentprime.io/advisories/GHSA-579w-22j4-4749.md) `GHSA-579w-22j4-4749`, `CVE-2022-44566` · RubyGems `activerecord`: affected `<6.1.7.1 || >=7.0.0, <7.0.4.1`, fixed in `6.1.7.1`, `7.0.4.1` · CVSS 7.5 High · Not analysed yet · Published 18 Jan 2023 · Tags: Denial of service - [ReDoS based DoS vulnerability in Action Dispatch](https://agentprime.io/advisories/GHSA-8xww-x3g3-6jcv.md) `GHSA-8xww-x3g3-6jcv`, `CVE-2023-22795` · RubyGems `actionpack`: affected `>=4.0.0.beta1, <6.1.7.1 || >=7.0.0, <7.0.4.1`, fixed in `6.1.7.1`, `7.0.4.1` · No CVSS score · Not analysed yet · Published 18 Jan 2023 · Tags: Denial of service - [SQL Injection Vulnerability via ActiveRecord comments](https://agentprime.io/advisories/GHSA-hq7p-j377-6v63.md) `GHSA-hq7p-j377-6v63`, `CVE-2023-22794` · RubyGems `activerecord`: affected `>=6.0.0, <6.0.6.1 || >=6.1.0, <6.1.7.1 || >=7.0.0, <7.0.4.1`, fixed in `6.0.6.1`, `6.1.7.1`, `7.0.4.1` · CVSS 8.8 High · Not analysed yet · Published 18 Jan 2023 · Tags: SQL injection - [Denial of service via header parsing in Rack](https://agentprime.io/advisories/GHSA-65f5-mfpf-vfhj.md) `GHSA-65f5-mfpf-vfhj`, `CVE-2022-44570` · RubyGems `rack`: affected `>=1.5.0, <2.0.9.2 || >=2.1.0.0, <2.1.4.2 || >=2.2.0.0, <2.2.6.2 || >=3.0.0.0, <3.0.4.1`, fixed in `2.0.9.2`, `2.1.4.2`, `2.2.6.2`, `3.0.4.1` · CVSS 7.5 High · Not analysed yet · Published 18 Jan 2023 · Tags: Denial of service - [Denial of service via multipart parsing in Rack](https://agentprime.io/advisories/GHSA-rqv2-275x-2jq5.md) `GHSA-rqv2-275x-2jq5`, `CVE-2022-44572` · RubyGems `rack`: affected `>=2.0.0, <2.0.9.2 || >=2.1.0.0, <2.1.4.2 || >=2.2.0.0, <2.2.6.1 || >=3.0.0.0, <3.0.4.1`, fixed in `2.0.9.2`, `2.1.4.2`, `2.2.6.1`, `3.0.4.1` · No CVSS score · Not analysed yet · Published 18 Jan 2023 · Tags: Denial of service - [ReDoS based DoS vulnerability in GlobalID](https://agentprime.io/advisories/GHSA-23c2-gwp5-pxw9.md) `GHSA-23c2-gwp5-pxw9`, `CVE-2023-22799` · RubyGems `globalid`: affected `>=0.2.1, <1.0.1`, fixed in `1.0.1` · No CVSS score · Not analysed yet · Published 18 Jan 2023 · Tags: Denial of service - [Sisimai Inefficient Regular Expression Complexity vulnerability](https://agentprime.io/advisories/GHSA-vm74-j4wq-82xj.md) `GHSA-vm74-j4wq-82xj`, `CVE-2022-4891` · RubyGems `sisimai`: affected `<4.25.14p12`, fixed in `4.25.14p12` · CVSS 3.5 Low · Not analysed yet · Published 17 Jan 2023 · Tags: Denial of service - [Code injection in ruby git](https://agentprime.io/advisories/GHSA-pphf-gfrm-v32r.md) `GHSA-pphf-gfrm-v32r`, `CVE-2022-47318` · RubyGems `git`: affected `<1.13.0`, fixed in `1.13.0` · CVSS 8.0 High · Not analysed yet · Published 17 Jan 2023 · Tags: Code injection - [curupira is vulnerable to SQL injection](https://agentprime.io/advisories/GHSA-85gf-wr67-f83w.md) `GHSA-85gf-wr67-f83w`, `CVE-2015-10053` · RubyGems `curupira`: affected `<0.1.4`, fixed in `0.1.4` · CVSS 5.5 Medium · Not analysed yet · Published 16 Jan 2023 · Tags: SQL injection - [Integer overflow in publify_core](https://agentprime.io/advisories/GHSA-rc42-jghf-vr8f.md) `GHSA-rc42-jghf-vr8f`, `BIT-publify-2022-1812`, `CVE-2022-1812` · RubyGems `publify_core`: affected `<9.2.10`, fixed in `9.2.10` · CVSS 7.6 High · Critical (CVSS 7+ and EPSS) · EPSS 0.31 · Not analysed yet · Published 14 Jan 2023 · Tags: Memory corruption - [Publify Improper Input Validation vulnerability](https://agentprime.io/advisories/GHSA-q3rm-f527-ghxj.md) `GHSA-q3rm-f527-ghxj`, `BIT-publify-2023-0299`, `CVE-2023-0299` · RubyGems `publify_core`: affected `<9.2.10`, fixed in `9.2.10` · CVSS 8.4 High · Not analysed yet · Published 14 Jan 2023 · Tags: CWE-20 - [Publify Core does not strip metadata from images](https://agentprime.io/advisories/GHSA-79wq-g4v9-gfj4.md) `GHSA-79wq-g4v9-gfj4`, `BIT-publify-2022-2815`, `CVE-2022-2815` · RubyGems `publify_core`: affected `<9.2.10`, fixed in `9.2.10` · CVSS 4.6 Medium · Not analysed yet · Published 14 Jan 2023 · Tags: Information disclosure - [ruby-git has potential remote code execution vulnerability](https://agentprime.io/advisories/GHSA-pfpr-3463-c6jh.md) `GHSA-pfpr-3463-c6jh`, `CVE-2022-46648` · RubyGems `git`: affected `>=1.2.0, <1.13.0`, fixed in `1.13.0` · CVSS 8.0 High · Not analysed yet · Published 9 Jan 2023 · Tags: Code injection - [Inline SVG vulnerable to Cross-site Scripting](https://agentprime.io/advisories/GHSA-p33q-4h4m-j994.md) `GHSA-p33q-4h4m-j994`, `CVE-2020-36644` · RubyGems `inline_svg`: affected `<1.7.2`, fixed in `1.7.2` · CVSS 3.5 Low · Not analysed yet · Published 7 Jan 2023 · Tags: Cross-site scripting (XSS) - [PgHero Allows Information Disclosure Through EXPLAIN Feature](https://agentprime.io/advisories/GHSA-vf99-xw26-86g5.md) `GHSA-vf99-xw26-86g5`, `CVE-2023-22626` · RubyGems `pghero`: affected `<3.1.0`, fixed in `3.1.0` · CVSS 7.5 High · Not analysed yet · Published 5 Jan 2023 · Tags: Information disclosure - [httparty has multipart/form-data request tampering vulnerability](https://agentprime.io/advisories/GHSA-5pq7-52mg-hr42.md) `GHSA-5pq7-52mg-hr42`, `CVE-2024-22049` · RubyGems `httparty`: affected `<0.21.0`, fixed in `0.21.0` · CVSS 6.5 Medium · Not analysed yet · Published 3 Jan 2023 · Tags: CWE-472 - [keynote Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-399p-vq28-5hg8.md) `GHSA-399p-vq28-5hg8`, `CVE-2017-20159` · RubyGems `keynote`: affected `<1.0.0`, fixed in `1.0.0` · CVSS 3.5 Low · Not analysed yet · Published 31 Dec 2022 · Tags: Cross-site scripting (XSS) - [Oxidized Web vulnerable to Cross-site Scripting](https://agentprime.io/advisories/GHSA-8qwh-rm6c-jv96.md) `GHSA-8qwh-rm6c-jv96`, `CVE-2019-25088` · RubyGems `oxidized-web`: affected `<=0.13.1`, no fixed version yet · CVSS 3.5 Low · Not analysed yet · Published 27 Dec 2022 · Tags: Cross-site scripting (XSS) - [text_helpers uses web link to untrusted target with window.opener access](https://agentprime.io/advisories/GHSA-74hc-57m5-83ch.md) `GHSA-74hc-57m5-83ch`, `CVE-2020-36624` · RubyGems `text_helpers`: affected `>=1.1.0, <1.2.0`, fixed in `1.2.0` · CVSS 6.3 Medium · Not analysed yet · Published 22 Dec 2022 · Tags: Privilege escalation, CWE-1022 - [active_attr Improper Resource Shutdown or Release vulnerability](https://agentprime.io/advisories/GHSA-4whf-rmx5-8frv.md) `GHSA-4whf-rmx5-8frv`, `CVE-2021-4250` · RubyGems `active_attr`: affected `<0.15.4`, fixed in `0.15.4` · CVSS 3.5 Low · Not analysed yet · Published 19 Dec 2022 · Tags: Denial of service - [Possible XSS vulnerability with certain configurations of rails-html-sanitizer](https://agentprime.io/advisories/GHSA-rrfc-7g8p-99q8.md) `GHSA-rrfc-7g8p-99q8`, `CVE-2022-23520` · RubyGems `rails-html-sanitizer`: affected `<1.4.4`, fixed in `1.4.4` · CVSS 6.1 Medium · Not analysed yet · Published 13 Dec 2022 · Tags: Cross-site scripting (XSS) - [Possible XSS vulnerability with certain configurations of rails-html-sanitizer](https://agentprime.io/advisories/GHSA-9h9g-93gc-623h.md) `GHSA-9h9g-93gc-623h`, `CVE-2022-23519` · RubyGems `rails-html-sanitizer`: affected `<1.4.4`, fixed in `1.4.4` · CVSS 7.2 High · Not analysed yet · Published 13 Dec 2022 · Tags: Cross-site scripting (XSS) - [Improper neutralization of data URIs may allow XSS in rails-html-sanitizer](https://agentprime.io/advisories/GHSA-mcvf-2q2m-x72m.md) `GHSA-mcvf-2q2m-x72m`, `CVE-2022-23518` · RubyGems `rails-html-sanitizer`: affected `>=1.0.3, <1.4.4`, fixed in `1.4.4` · CVSS 6.1 Medium · Not analysed yet · Published 13 Dec 2022 · Tags: Cross-site scripting (XSS) - [Inefficient Regular Expression Complexity in rails-html-sanitizer](https://agentprime.io/advisories/GHSA-5x79-w82f-gw8w.md) `GHSA-5x79-w82f-gw8w`, `CVE-2022-23517` · RubyGems `rails-html-sanitizer`: affected `<1.4.4`, fixed in `1.4.4` · CVSS 7.5 High · Not analysed yet · Published 13 Dec 2022 · Tags: Denial of service - [Uncontrolled Recursion in Loofah](https://agentprime.io/advisories/GHSA-3x8r-x6xp-q4vm.md) `GHSA-3x8r-x6xp-q4vm`, `CVE-2022-23516` · RubyGems `loofah`: affected `>=2.2.0, <2.19.1`, fixed in `2.19.1` · CVSS 7.5 High · Not analysed yet · Published 13 Dec 2022 · Tags: Denial of service - [Improper neutralization of data URIs may allow XSS in Loofah](https://agentprime.io/advisories/GHSA-228g-948r-83gx.md) `GHSA-228g-948r-83gx`, `CVE-2022-23515` · RubyGems `loofah`: affected `>=2.1.0, <2.19.1`, fixed in `2.19.1` · CVSS 6.1 Medium · Not analysed yet · Published 13 Dec 2022 · Tags: Cross-site scripting (XSS) - [Inefficient Regular Expression Complexity in Loofah](https://agentprime.io/advisories/GHSA-486f-hjj9-9vhh.md) `GHSA-486f-hjj9-9vhh`, `CVE-2022-23514` · RubyGems `loofah`: affected `<2.19.1`, fixed in `2.19.1` · CVSS 7.5 High · Not analysed yet · Published 13 Dec 2022 · Tags: Denial of service - [Duplicate Advisory: Resque Scheduler Reflected XSS In Delayed Jobs View](https://agentprime.io/advisories/GHSA-q7jc-v6f2-q9jr.md) `GHSA-q7jc-v6f2-q9jr` · RubyGems `resque-scheduler`: affected `>=1.27.4, <4.10.2`, fixed in `4.10.2` · CVSS 6.1 Medium · Withdrawn · Not analysed yet · Published 13 Dec 2022 · Tags: Cross-site scripting (XSS) - [Unchecked return value from xmlTextReaderExpand](https://agentprime.io/advisories/GHSA-qv4q-mr5r-qprj.md) `GHSA-qv4q-mr5r-qprj`, `CVE-2022-23476` · RubyGems `nokogiri`: affected `>=1.13.8, <1.13.10`, fixed in `1.13.10` · CVSS 7.5 High · Not analysed yet · Published 8 Dec 2022 · Tags: Memory corruption, CWE-252 - [Sinatra vulnerable to Reflected File Download attack](https://agentprime.io/advisories/GHSA-2x8x-jmrp-phxw.md) `GHSA-2x8x-jmrp-phxw`, `CVE-2022-45442` · RubyGems `sinatra`: affected `>=2.0.0, <2.2.3 || >=3.0, <3.0.4`, fixed in `2.2.3`, `3.0.4` · CVSS 8.8 High · Not analysed yet · Published 30 Nov 2022 · Tags: CWE-494 - [Unsanitized input leading to code injection in Dalli](https://agentprime.io/advisories/GHSA-3xg8-cc8f-9wv2.md) `GHSA-3xg8-cc8f-9wv2`, `CVE-2022-4064` · RubyGems `dalli`: affected `<3.2.3`, fixed in `3.2.3` · CVSS 6.3 Medium · Not analysed yet · Published 19 Nov 2022 · Tags: Other injection, CWE-707 - [HTTP response splitting in CGI](https://agentprime.io/advisories/GHSA-vc47-6rqg-c7f5.md) `GHSA-vc47-6rqg-c7f5`, `BIT-ruby-2021-33621`, `BIT-ruby-min-2021-33621`, `CVE-2021-33621` · RubyGems `cgi`: affected `<0.1.0.2 || >=0.2.0, <0.2.2 || >=0.3.0, <0.3.5`, fixed in `0.1.0.2`, `0.2.2`, `0.3.5` · CVSS 8.8 High · Not analysed yet · Published 19 Nov 2022 · Tags: Other injection, CWE-436 - [fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration)](https://agentprime.io/advisories/GHSA-fppq-mj76-fpj2.md) `GHSA-fppq-mj76-fpj2`, `BIT-fluentd-2022-39379`, `CVE-2022-39379` · RubyGems `fluentd`: affected `>=1.13.2, <1.15.3`, fixed in `1.15.3` · CVSS 3.1 Low · EPSS 0.45 · Not analysed yet · Published 2 Nov 2022 · Tags: Insecure deserialization - [Cross-site Scripting in actionpack](https://agentprime.io/advisories/GHSA-9chr-4fjh-5rgw.md) `GHSA-9chr-4fjh-5rgw`, `CVE-2022-3704` · RubyGems `actionpack`: affected `<=7.0.4`, no fixed version yet · CVSS 3.5 Low · Withdrawn · Not analysed yet · Published 27 Oct 2022 · Tags: Cross-site scripting (XSS), CWE-707 - [Update bundled libxml2 to v2.10.3 to resolve multiple CVEs](https://agentprime.io/advisories/GHSA-2qc6-mcvw-92cw.md) `GHSA-2qc6-mcvw-92cw`, `CVE-2022-50998` · RubyGems `nokogiri`: affected `<1.13.9`, fixed in `1.13.9` · No CVSS score · Not analysed yet · Published 18 Oct 2022 - [Fat Free CRM vulnerable to Remote Denial of Service via Tasks endpoint](https://agentprime.io/advisories/GHSA-p75c-5x3h-cxcg.md) `GHSA-p75c-5x3h-cxcg`, `CVE-2022-39281` · RubyGems `fat_free_crm`: affected `<0.20.1`, fixed in `0.20.1` · CVSS 6.5 Medium · Not analysed yet · Published 7 Oct 2022 · Tags: CWE-20 - [protobuf-java has a potential Denial of Service issue](https://agentprime.io/advisories/GHSA-h4h5-3hr4-j3g2.md) `GHSA-h4h5-3hr4-j3g2`, `CVE-2022-3171` · Maven `com.google.protobuf:protobuf-java` and 4 more: affected `>=3.21.0-rc-1, <3.21.7 || >=3.20.0-rc-1, <3.20.3 || >=3.17.0-rc-1, <3.19.6 || <3.16.3`, fixed in `3.21.7`, `3.20.3`, `3.19.6`, `3.16.3` · CVSS 4.3 Medium · Not analysed yet · Published 4 Oct 2022 · Tags: CWE-20 - [SQLite3 addresses vulnerability in packaged version of libsqlite](https://agentprime.io/advisories/GHSA-mgvv-5mxp-xq67.md) `GHSA-mgvv-5mxp-xq67` · RubyGems `sqlite3`: affected `>=1.5.0, <1.5.1`, fixed in `1.5.1` · No CVSS score · Not analysed yet · Published 3 Oct 2022 - [Unbounded resource exhaustion in cmark-gfm autolink extension may lead to denial of service](https://agentprime.io/advisories/GHSA-4qw4-jpp4-8gvp.md) `GHSA-4qw4-jpp4-8gvp` · RubyGems `commonmarker`: affected `<0.23.6`, fixed in `0.23.6` · No CVSS score · Not analysed yet · Published 21 Sept 2022 · Tags: Denial of service - [arr-pm vulnerable to arbitrary shell execution when extracting or listing files contained in a malicious rpm.](https://agentprime.io/advisories/GHSA-88cv-mj24-8w3q.md) `GHSA-88cv-mj24-8w3q`, `CVE-2022-39224` · RubyGems `arr-pm`: affected `<0.0.12`, fixed in `0.0.12` · CVSS 7.0 High · Not analysed yet · Published 21 Sept 2022 · Tags: Command injection - [Pageflow vulnerable to insecure direct object reference in membership update endpoint](https://agentprime.io/advisories/GHSA-qcqv-38jg-2r43.md) `GHSA-qcqv-38jg-2r43` · RubyGems `pageflow`: affected `<14.5.2 || >=15.0.0, <15.7.1`, fixed in `14.5.2`, `15.7.1` · No CVSS score · Not analysed yet · Published 15 Sept 2022 - [Pageflow vulnerable to sensitive user data extraction via Ransack query injection](https://agentprime.io/advisories/GHSA-wrrw-crp8-979q.md) `GHSA-wrrw-crp8-979q` · RubyGems `pageflow`: affected `<14.5.2 || >=15.0.0, <15.7.1`, fixed in `14.5.2`, `15.7.1` · No CVSS score · Not analysed yet · Published 15 Sept 2022 Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .