RubyGems Advisories.

request_store has Incorrect Default Permissions

• Broken access control

>=1.3.2, <1.4.0 · fixed in 1.4.0

REXML denial of service vulnerability

• Denial of service

<3.3.6 · fixed in 3.3.6

fugit parse and parse_nat stall on lengthy input

• Denial of service

<1.11.1 · fixed in 1.11.1

Command Injection in sequenceserver

• Command injection

<3.1.2 · fixed in 3.1.2

REXML DoS vulnerability

• Denial of service

<3.3.3 · fixed in 3.3.3

REXML DoS vulnerability

• Denial of service

<3.3.3 · fixed in 3.3.3

Cross-Site Request Forgery in Spina

• Cross-site request forgery (CSRF)

<=2.18.0 · no fixed version yet

REXML denial of service vulnerability

• Denial of service

<3.3.2 · fixed in 3.3.2

Withdrawn Advisory: Bootstrap Cross-Site Scripting (XSS) vulnerability

• Cross-site scripting (XSS)

>=4.0.0, <5.0.0 · fixed in 5.0.0

Withdrawn Advisory: Bootstrap Cross-Site Scripting (XSS) vulnerability

• Cross-site scripting (XSS)

>=2.0.0, <=3.4.1 · no fixed version yet

Decidim cross-site scripting (XSS) in the admin panel

• Cross-site scripting (XSS)

<0.27.6 || >=0.28.0.rc1, <0.28.1 · fixed in 0.27.6, 0.28.1

Decidim cross-site scripting (XSS) in the pagination

• Cross-site scripting (XSS)

<0.27.6 || >=0.28.0.rc1, <0.28.1 · fixed in 0.27.6, 0.28.1

Decidim vulnerable to data disclosure through the embed feature

• Information disclosure

<0.27.6 · fixed in 0.27.6

RailsAdmin Cross-site Scripting vulnerability in the list view

• Cross-site scripting (XSS)

>=3.0.0.beta, <3.1.3 · fixed in 3.1.3

Rack ReDoS Vulnerability in HTTP Accept Headers Parsing

• Denial of service

>=3.1.0, <3.1.5 · fixed in 3.1.5

Missing security headers in Action Pack on non-HTML responses

• CWE-20

>=6.1.0, <6.1.7.8 || >=7.0.0, <7.0.8.4 || >=7.1.0, <7.1.3.4 || >=7.2.0.beta1, <7.2.0.beta2 · fixed in 6.1.7.8, 7.0.8.4, 7.1.3.4, 7.2.0.beta2

ActionText ContentAttachment can Contain Unsanitized HTML

• Cross-site scripting (XSS)

>=7.1.0, <7.1.3.4 || >=7.2.0.beta1, <7.2.0.beta2 · fixed in 7.1.3.4, 7.2.0.beta2

activeadmin vulnerable to stored persistent cross-site scripting (XSS) in dynamic form legends

• Cross-site scripting (XSS)

<3.2.2 || >=4.0.0.beta1, <4.0.0.beta7 · fixed in 3.2.2, 4.0.0.beta7

rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter

• Denial of service

<2.5.0 · fixed in 2.5.0

Kaminari Insecure File Permissions Vulnerability

• Broken access control

>=0.15.0, <0.16.2 · fixed in 0.16.2

REXML contains a denial of service vulnerability

• Denial of service

<3.2.7 · fixed in 3.2.7

Duplicate Advisory: Nokogiri updates packaged libxml2 to v2.12.7 to resolve CVE-2024-34459

• Memory corruption

<1.16.5 · fixed in 1.16.5

Nokogiri updates packaged libxml2 to v2.12.7 to resolve CVE-2024-34459

• Memory corruption

<1.16.5 · fixed in 1.16.5

Trix Editor Arbitrary Code Execution Vulnerability

• Cross-site scripting (XSS)

>=0.9.0, <1.3.2 || >=2.0.0, <2.1.1 · fixed in 1.3.2, 2.1.1

Phlex vulnerable to Cross-site Scripting (XSS) via maliciously formed HTML attribute names and values

• Cross-site scripting (XSS)

<1.9.3 || >=1.10.0, <1.10.2 · fixed in 1.9.3, 1.10.2

Sidekiq vulnerable to a Reflected XSS in Queues Web Page

• Cross-site scripting (XSS)

>=7.2.0, <7.2.4 · fixed in 7.2.4

Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `<a>` tags

• Cross-site scripting (XSS)

<1.4.2 || >=1.5.0, <1.5.3 || >=1.6.0, <1.6.3 || >=1.7.0, <1.7.2 || >=1.8.0, <1.8.3 || >=1.9.0, <1.9.2 || >=1.10.0, <1.10.1 · fixed in 1.4.2, 1.5.3, 1.6.3, 1.7.2, 1.8.3, 1.9.2, 1.10.1

CarrierWave content-Type allowlist bypass vulnerability which possibly leads to XSS remained

• Cross-site scripting (XSS)
• CWE-436

<2.2.6 || >=3.0.0, <3.0.7 · fixed in 2.2.6, 3.0.7

RDoc RCE vulnerability with .rdoc_options

• Other injection
• Insecure deserialization

>=6.3.3, <6.3.4.1 || >=6.4.0, <6.4.1.1 || >=6.5.0, <6.5.1.1 || >=6.6.0, <6.6.3.1 · fixed in 6.3.4.1, 6.4.1.1, 6.5.1.1, 6.6.3.1

StringIO buffer overread vulnerability

• Memory corruption
• CWE-126

<3.0.1.1 · fixed in 3.0.1.1

Duplicate Advisory: Use-after-free in libxml2 via Nokogiri::XML::Reader

• Memory corruption

<1.15.6 || >=1.16.0, <1.16.2 · fixed in 1.15.6, 1.16.2

ROTP 6.2.2 and 6.2.1 has 0666 permissions for the .rb files.

• Broken access control

>=6.2.1, <6.3.0 · fixed in 6.3.0

TurboBoost Commands vulnerable to arbitrary method invocation

• Other injection

<0.1.3 || >=0.2.0, <0.2.2 · fixed in 0.1.3, 0.2.2

discordrb OS Command Injection vulnerability

• Command injection

<3.4.3 · fixed in 3.4.3

StimulusReflex arbitrary method call

• Code injection

<3.4.2 || >=3.5.0-pre0, <3.5.0-rc4 · fixed in 3.4.2, 3.5.0-rc4

Cross-site Scripting (XSS) possible with maliciously formed HTML attribute names and values in Phlex

• Cross-site scripting (XSS)

<1.0.1 || >=1.1.0, <1.1.1 || >=1.2.0, <1.2.2 || >=1.3.0, <1.3.3 || >=1.4.0, <1.4.1 || >=1.5.0, <1.5.2 || >=1.6.0, <1.6.2 || >=1.7.0, <1.7.1 || >=1.8.0, <1.8.2 || >=1.9.0, <1.9.1 · fixed in 1.0.1, 1.1.1, 1.2.2, 1.3.3, 1.4.1, 1.5.2, 1.6.2, 1.7.1, 1.8.2, 1.9.1

json-jwt allows bypass of identity checks via a sign/encryption confusion attack

• Broken access control

<1.15.3.1 || >=1.16.0, <1.16.6 · fixed in 1.15.3.1, 1.16.6

Rack vulnerable to ReDoS in content type parsing (2nd degree polynomial)

• Denial of service

>=0.4, <2.2.8.1 || >=3.0.0, <3.0.9.1 · fixed in 2.2.8.1, 3.0.9.1

Rack has possible DoS Vulnerability with Range Header

• Denial of service

>=1.3.0, <2.2.8.1 || >=3.0.0, <3.0.9.1 · fixed in 2.2.8.1, 3.0.9.1

Rack Header Parsing leads to Possible Denial of Service Vulnerability

• Denial of service

<2.0.9.4 || >=2.1.0, <2.1.4.4 || >=2.2.0, <2.2.8.1 || >=3.0.0, <3.0.9.1 · fixed in 2.0.9.4, 2.1.4.4, 2.2.8.1, 3.0.9.1

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

• Cross-site scripting (XSS)

<0.9.36 · fixed in 0.9.36

Rails has possible Sensitive Session Information Leak in Active Storage

• Information disclosure

>=5.2.0, <6.1.7.7 || >=7.0.0, <7.0.8.1 · fixed in 6.1.7.7, 7.0.8.1

Rails has possible XSS Vulnerability in Action Controller

• Cross-site scripting (XSS)

>=7.0.0, <7.0.8.1 || >=7.1.0, <7.1.3.1 · fixed in 7.0.8.1, 7.1.3.1

Rails has possible ReDoS vulnerability in Accept header parsing in Action Dispatch

• Denial of service

>=7.1.0, <7.1.3.1 · fixed in 7.1.3.1

Rack CORS Middleware has Insecure File Permissions

• Information disclosure

>=2.0.1, <2.0.2 · fixed in 2.0.2

Cross-site scripting (XSS) in the dynamic file uploads

• Cross-site scripting (XSS)

>=0.27.0, <0.27.5 · fixed in 0.27.5

Possibility to circumvent the invitation token expiry period

• CWE-672

>=0.0.1.alpha3, <0.26.9 || >=0.27.0, <0.27.5 · fixed in 0.26.9, 0.27.5

Possible CSRF attack at questionnaire templates preview

• Cross-site request forgery (CSRF)
• Server-side request forgery (SSRF)

>=0.23.0, <0.27.5 · fixed in 0.27.5

Race condition in Endorsements

• Race condition

>=0.10.0, <0.26.9 || >=0.27.0, <0.27.5 · fixed in 0.26.9, 0.27.5

XSS sidekiq-unique-jobs UI server vulnerability

• Cross-site scripting (XSS)
• Denial of service

>=6.0.0.rc7, <7.1.33 || >=8.0.0, <8.0.7 · fixed in 7.1.33, 8.0.7

Nokogiri update packaged libxml2 to v2.12.5 to resolve CVE-2024-25062

• Memory corruption

<1.15.6 || >=1.16.0, <1.16.2 · fixed in 1.15.6, 1.16.2

Cross-site scripting (XSS) in Action messages on Avo

• Cross-site scripting (XSS)

<2.47.0 || >=3.0.0.beta1, <3.3.0 · fixed in 2.47.0, 3.3.0

avo vulnerable to stored cross-site scripting (XSS) in key_value field

• Cross-site scripting (XSS)

<2.47.0 || >=3.0.0.beta1, <3.2.4 · fixed in 2.47.0, 3.2.4

Devise-Two-Factor vulnerable to brute force attacks

• Authentication bypass

>=1.0.0, <=5.0.0 · no fixed version yet

Puma HTTP Request/Response Smuggling vulnerability

• HTTP request smuggling

<5.6.8 || >=6.0.0, <6.4.2 · fixed in 5.6.8, 6.4.2

view_component Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

<2.83.0 || >=3.0.0, <3.9.0 · fixed in 2.83.0, 3.9.0

Duplicate Advisory: Race Condition leading to logging errors

• Race condition

>=4.0.0 · no fixed version yet

Duplicate Advisory: Malicious URL drafting attack against iodines static file server may allow path traversal

• Path traversal

* · no fixed version yet

Duplicate Advisory: httparty has multipart/form-data request tampering vulnerability

• Information disclosure
• CWE-472

<=0.20.0 · no fixed version yet

Duplicate Advisory: Integer overflow in cmark-gfm table parsing extension leads to heap memory corruption

• Memory corruption

* · no fixed version yet