RubyGems Advisories.

Duplicate Advisory: govuk_tech_docs vulnerable to unescaped HTML on search results page

• Cross-site scripting (XSS)

>=2.0.2 · no fixed version yet

Duplicate Advisory: encoded_id-rails potential DOS vulnerability due to URIs with extremely long encoded IDs

• Denial of service

* · no fixed version yet

Omniauth::MicrosoftGraph Account takeover (nOAuth)

• Authentication bypass

<2.0.0 · fixed in 2.0.0

ActiveAdmin CSV Injection leading to sensitive information disclosure

• Other injection

<3.2.0 · fixed in 3.2.0

Duplicate Advisory: ActiveAdmin vulnerable to CSV injection

• Other injection

<3.2.0 · fixed in 3.2.0

Resque vulnerable to Reflected Cross Site Scripting through pathnames

• Cross-site scripting (XSS)
• CWE-233

<2.1.0 · fixed in 2.1.0

Resque vulnerable to reflected XSS in resque-web failed and queues lists

• Cross-site scripting (XSS)
• CWE-233

<2.2.1 · fixed in 2.2.1

Resque vulnerable to reflected XSS in Queue Endpoint

• Cross-site scripting (XSS)
• CWE-233

<2.6.0 · fixed in 2.6.0

Resque Scheduler Reflected XSS In Delayed Jobs View

• Cross-site scripting (XSS)

>=1.27.4, <4.10.2 · fixed in 4.10.2

Potential CSV export data leak

• Information disclosure
• Other injection

<2.12.0 · fixed in 2.12.0

pubnub Insufficient Entropy vulnerability

• CWE-331

<0.4.0 · fixed in 0.4.0

CarrierWave Content-Type allowlist bypass vulnerability, possibly leading to XSS

• Cross-site scripting (XSS)

<2.2.5 || >=3.0.0, <3.0.5 · fixed in 2.2.5, 3.0.5

memory leak flaw was found in ruby-magick

• Denial of service

<5.3.0 · fixed in 5.3.0

encoded_id-rails potential DOS vulnerability due to URIs with extremely long encoded IDs

• Denial of service

<1.0.0.beta2 · fixed in 1.0.0.beta2

svg_optimizer rubygem external XML entity (XXE) vulnerability

• XML external entities (XXE)
• Denial of service

>=0.2.6, <0.3.0 · fixed in 0.3.0

Puppet Bolt privilege escalation vulnerability

• Privilege escalation

<3.27.4 · fixed in 3.27.4

geokit-rails Command Injection vulnerability

• Command injection
• Insecure deserialization

<2.5.0 · fixed in 2.5.0

Decidim has broken access control in templates

• Broken access control

>=0.23.2, <0.26.8 || >=0.27.0, <0.27.4 · fixed in 0.26.8, 0.27.4

Foreman Transpilation Enables OS Command Injection

• Command injection

<=3.8.0 · no fixed version yet

sidekiq Denial of Service vulnerability

• Denial of service
• CWE-345

<6.5.10 || >=7.0.0, <7.1.3 · fixed in 6.5.10, 7.1.3

Denial of Service Vulnerability in gRPC TCP Server (Posix-compatible platforms)

• CWE-248

>=1.53.0, <1.53.2 || >=1.54.0, <1.54.3 || >=1.55.0, <1.55.3 · fixed in 1.53.2, 1.54.3, 1.55.3

Active Support Possibly Discloses Locally Encrypted Files

• Broken access control
• CWE-377

>=5.2.0, <6.1.7.5 || >=7.0.0, <7.0.7.1 · fixed in 6.1.7.5, 7.0.7.1

Puma HTTP Request/Response Smuggling vulnerability

• HTTP request smuggling

<5.6.7 || >=6.0.0, <6.3.1 · fixed in 5.6.7, 6.3.1

Excessive Iteration in gRPC

• Denial of service

<1.53.2 || >=1.54.0, <1.54.3 || >=1.55.0, <1.55.2 || >=1.56.0, <1.56.2 · fixed in 1.53.2, 1.54.3, 1.55.2, 1.56.2

Several quadratic complexity bugs may lead to denial of service in Commonmarker

• Denial of service

<0.23.10 · fixed in 0.23.10

protocol-http1 HTTP Request/Response Smuggling vulnerability

• HTTP request smuggling

<0.15.1 · fixed in 0.15.1

rswag vulnerable to arbitrary JSON and YAML file read via directory traversal

• Path traversal

<2.10.1 · fixed in 2.10.1

Decidim Cross-site Scripting vulnerability in the external link redirections

• Cross-site scripting (XSS)

>=0.25.0, <0.26.7 || >=0.27.0, <0.27.3 · fixed in 0.26.7, 0.27.3

Decidim Cross-site Scripting vulnerability in the processes filter

• Cross-site scripting (XSS)

>=0.14.0, <0.26.7 || >=0.27.0, <0.27.3 · fixed in 0.26.7, 0.27.3

Decidim vulnerable to sensitive data disclosure

• Information disclosure

>=0.27.0, <0.27.3 · fixed in 0.27.3

gRPC connection termination issue

• CWE-440

>=1.53.0, <1.53.1 || >=1.54.0, <1.54.2 · fixed in 1.53.1, 1.54.2

gRPC Reachable Assertion issue

• Denial of service

>=1.51.0, <1.53.0 · fixed in 1.53.0

Sanitize vulnerable to Cross-site Scripting via insufficient neutralization of `style` element content

• Cross-site scripting (XSS)

>=3.0.0, <6.0.2 · fixed in 6.0.2

Connection confusion in gRPC

• CWE-440

>=1.53.0, <1.53.1 || >=1.54.0, <1.54.2 · fixed in 1.53.1, 1.54.2

URI gem has ReDoS vulnerability

• Denial of service

<0.10.0.3 || >=0.10.1, <0.10.3 || >=0.11.0, <0.11.2 || >=0.12.0, <0.12.2 · fixed in 0.10.0.3, 0.10.3, 0.11.2, 0.12.2

Actionpack has possible cross-site scripting vulnerability via User Supplied Values to redirect_to

• CWE-116

<6.1.7.4 || >=7.0.0, <7.0.5.1 · fixed in 6.1.7.4, 7.0.5.1

Spina Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

<2.15.1 · fixed in 2.15.1

Duplicate Advisory: jQuery Cross Site Scripting vulnerability

• Cross-site scripting (XSS)

>=1.0.3, <3.5.0 · fixed in 3.5.0

Doorkeeper Improper Authentication vulnerability

• Authentication bypass

<5.6.6 · fixed in 5.6.6

rails-ujs vulnerable to DOM Based Cross-site Scripting contenteditable HTML Elements

• Cross-site scripting (XSS)

>=5.1.0, <6.1.7.3 || >=7.0.0, <7.0.4.3 · fixed in 6.1.7.3, 7.0.4.3

Kredis JSON Possible Deserialization of Untrusted Data Vulnerability

• Insecure deserialization

<1.3.0.1 · fixed in 1.3.0.1

RedCloth Regular Expression Denial of Service issue

• Denial of service

<4.3.3 · fixed in 4.3.3

avo possible unsafe reflection / partial DoS vulnerability

• Code injection
• CWE-20

<2.33.3 || >=3.0.0.pre1, <=3.0.0.pre12 · fixed in 2.33.3

avo vulnerable to Stored XSS (Cross Site Scripting) in html content based fields

• Cross-site scripting (XSS)

<2.33.3 || >=3.0.0.pre1, <=3.0.0.pre12 · fixed in 2.33.3

ruby-saml vulnerable to XPath injection

• Command injection

<1.0.0 · fixed in 1.0.0

Server-Side Template Injection in Camaleon CMS

• Code injection

<2.7.4 · fixed in 2.7.4

Cross Site Scripting (XSS) Vulnerability in Fetlife rollout-ui gem

• Cross-site scripting (XSS)

<0.5.3 · fixed in 0.5.3

Race Condition leading to logging errors

• Race condition

>=4.0.0, <5.3.3 · fixed in 5.3.3

Buffer overflow in sponge queue functions

• Memory corruption

<=1.0.2 · no fixed version yet

Sensitive Terraform Output Values Printed At Info Logging Level In Kitchen-Terraform

• Information disclosure

>=7.0.0, <7.0.1 · fixed in 7.0.1

sidekiq vulnerable to cross-site scripting

• Cross-site scripting (XSS)

>=7.0.4, <7.0.8 · fixed in 7.0.8

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in Pay

• Cross-site scripting (XSS)

<6.3.2 · fixed in 6.3.2

Commonmarker vulnerable to to several quadratic complexity bugs that may lead to denial of service

<0.23.9 · fixed in 0.23.9

Nokogiri updates packaged libxml2 to v2.10.4 to resolve multiple CVEs

<1.14.3 · fixed in 1.14.3

govuk_tech_docs vulnerable to unescaped HTML on search results page

• Cross-site scripting (XSS)

>=2.0.2, <3.3.1 · fixed in 3.3.1

Fluent Fluentd and Fluent-ui use default password

• Broken access control

<=1.2.2 · no fixed version yet

Ruby URI component ReDoS issue

• Denial of service

<0.10.0.1 || >=0.10.1, <0.10.2 || >=0.11.0, <0.11.1 || >=0.12.0, <0.12.1 · fixed in 0.10.0.1, 0.10.2, 0.11.1, 0.12.1

Ruby Time component ReDoS issue

• Denial of service

<0.1.1 || >=0.2.0, <0.2.2 · fixed in 0.1.1, 0.2.2

unpoly-rails Denial of Service vulnerability

• Denial of service

<2.7.2.2 · fixed in 2.7.2.2

Reflective Cross-site Scripting Vulnerability in twitter-bootstrap-rails

• Cross-site scripting (XSS)

<3.2.0 · fixed in 3.2.0