RubyGems Advisories.

PDFKit vulnerable to Command Injection

• Command injection

<0.8.7.2 · fixed in 0.8.7.2

OmniAuth's `lib/omniauth/failure_endpoint.rb` does not escape `message_key` value

• CWE-116

<1.9.2 || >=2.0.0.pre.rc1, <2.0.0 · fixed in 1.9.2, 2.0.0

update_by_case before 0.1.3 can be vulnerable to sql injection

• SQL injection

<0.1.3 · fixed in 0.1.3

administrate vulnerable to Cross-Site Request Forgery

• Cross-site request forgery (CSRF)

<0.1.5 · fixed in 0.1.5

TZInfo relative path traversal vulnerability allows loading of arbitrary files

• Path traversal

<0.3.61 || >=1.0.0, <1.2.10 · fixed in 0.3.61, 1.2.10

jQuery UI vulnerable to XSS when refreshing a checkboxradio with an HTML-like initial text label

• Cross-site scripting (XSS)

<1.13.2 · fixed in 1.13.2

Gollum Cross-site Scripting vulnerability via filename parameter to New Page dialog

• Cross-site scripting (XSS)

>=5.0, <5.1.2 · fixed in 5.1.2

Active Record RCE bug with Serialized Columns

• Insecure deserialization

<5.2.8.1 || >=6.0.0, <6.0.5.1 || >=6.1.0, <6.1.6.1 || >=7.0.0, <7.0.3.1 · fixed in 5.2.8.1, 6.0.5.1, 6.1.6.1, 7.0.3.1

opensearch-ruby 2.x before 2.0.2 vulnerable to unsafe YAML deserialization

• Insecure deserialization

>=2.0.0, <2.0.2 · fixed in 2.0.2

Ember.js Potential XSS Exploit When Binding `tagName` to User-Supplied Data

• Cross-site scripting (XSS)

<1.0.0.rc1.1 || >=1.0.0.rc2.0, <1.0.0.rc2.1 || >=1.0.0.rc3.0, <1.0.0.rc3.1 || >=1.0.0.rc4.0, <1.0.0.rc4.1 || >=1.0.0.rc5.0, <1.0.0.rc5.1 || >=1.0.0.rc6.0, <1.0.0.rc6.1 · fixed in 1.0.0.rc1.1, 1.0.0.rc2.1, 1.0.0.rc3.1, 1.0.0.rc4.1, 1.0.0.rc5.1, 1.0.0.rc6.1

OS Command Injection in awesome spawn

• Command injection

<1.2.0 · fixed in 1.2.0

Externally Controlled Reference to a Resource in Another Sphere in ruby-mysql

• CWE-610

<2.10.0 · fixed in 2.10.0

Rails::Html::Sanitizer vulnerable to Cross-site Scripting

• Cross-site scripting (XSS)

<1.4.3 · fixed in 1.4.3

Improper handling of double quotes in file name in Diffy in Windows environment

<3.4.1 · fixed in 3.4.1

Octokit gem published with world-writable files

• Broken access control

>=4.23.0, <4.25.0 · fixed in 4.25.0

Octopoller gem published with world-writable files

• Broken access control

>=0.2.0, <0.3.0 · fixed in 0.3.0

Mechanize before v2.8.5 vulnerable to authorization header leak on port redirect

• Information disclosure
• Hard-coded credentials

<2.8.5 · fixed in 2.8.5

JMESPath for Ruby uses unsafe JSON.load when safe JSON.parse is preferable

• Insecure deserialization

<1.6.1 · fixed in 1.6.1

Use of Uninitialized Variable in trilogy

• Memory corruption

<2.1.1 · fixed in 2.1.1

Arbitrary file write in dragonfly

• Command injection

<1.4.0 · fixed in 1.4.0

CSRF allows attacker to finalize/unfinalize order adjustments in solidus_backend

• Cross-site request forgery (CSRF)

<2.11.16 || >=3.0.0, <3.0.6 || >=3.1.0, <3.1.6 · fixed in 2.11.16, 3.0.6, 3.1.6

Denial of Service Vulnerability in Rack Multipart Parsing

• Denial of service

>=1.2, <2.0.9.1 || >=2.1, <2.1.4.1 || >=2.2, <2.2.3.1 · fixed in 2.0.9.1, 2.1.4.1, 2.2.3.1

Possible shell escape sequence injection vulnerability in Rack

• CWE-150

<2.0.9.1 || >=2.1, <2.1.4.1 || >=2.2, <2.2.3.1 · fixed in 2.0.9.1, 2.1.4.1, 2.2.3.1

Camaleon CMS Stored Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

>=0.0.1, <2.6.0.1 · fixed in 2.6.0.1

Cross site scripting in publify

• Cross-site scripting (XSS)

>=8.0, <9.2.5 · fixed in 9.2.5

Camaleon CMS Insufficient Session Expiration vulnerability

• Authentication bypass

>=0.1.7, <2.6.0.1 · fixed in 2.6.0.1

Cross site scripting in publify

• Cross-site scripting (XSS)

>=8.0, <9.2.5 · fixed in 9.2.5

net-ldap has weak salt when generating passwords

• Weak cryptography or TLS

<0.16.2 · fixed in 0.16.2

Camaleon CMS vulnerable to Uncaught Exception

• CWE-248

>=2.0.1, <2.6.0.1 · fixed in 2.6.0.1

Camaleon CMS vulnerable to Server-Side Request Forgery

• Server-side request forgery (SSRF)

>=2.1.2.0, <2.6.0.1 · fixed in 2.6.0.1

apollo_upload_server has Denial of Service vulnerability

<2.1.0 · fixed in 2.1.0

Nokogiri has vulnerable dependencies on libxml2 and libxslt

• Memory corruption

<1.13.2 · fixed in 1.13.2

Smashing Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

<1.3.5 · fixed in 1.3.5

Nokogiri contains libxml Out-of-bounds Write vulnerability

• Memory corruption

<1.11.4 · fixed in 1.11.4

Nokogiri Implements libxml2 version vulnerable to use-after-free

• Memory corruption

<1.11.4 · fixed in 1.11.4

Nokogiri Implements libxml2 version vulnerable to null pointer dereferencing

• Memory corruption

<1.11.4 · fixed in 1.11.4

Metasploit Framework user exposes Metasploit to same deserialization issue that is exploited by that module

• Insecure deserialization

<4.19.0 · fixed in 4.19.0

Gitaly Insufficient Session Expiration vulnerability

• Authentication bypass

>=1.79.0, <13.3.9 || >=13.4, <13.4.5 || >=13.5, <13.5.2 · fixed in 13.3.9, 13.4.5, 13.5.2

WEBRick vulnerable to HTTP Request/Response Smuggling

• HTTP request smuggling

<1.4.4 || >=1.5.0, <1.5.1 || >=1.6.0, <1.6.1 · fixed in 1.4.4, 1.5.1, 1.6.1

omniauth-weibo-oauth2 included a code-execution backdoor inserted by a third party

• Code injection

>=0.4.6, <0.5.1 · fixed in 0.5.1

papercrop does not properly handle crop input

• CWE-20

<0.3.0 · fixed in 0.3.0

Nokogiri implementation of libxslt vulnerable to heap corruption

• Memory corruption

<1.10.5 · fixed in 1.10.5

Katello cleartext password storage issue

• Information disclosure

>=3.0.0.0, <3.12.2 · fixed in 3.12.2

Missing Initialization of Resource in Apache Arrow

• CWE-909

>=0.12.0, <0.15.1 · fixed in 0.15.1

Nokogiri affected by libxslt Use of Uninitialized Resource/Use After Free vulnerability

• Memory corruption

<1.10.5 · fixed in 1.10.5

Devise Token Auth vulnerable to Cross-site Scripting

• Cross-site scripting (XSS)

>=0.1.33, <1.1.3 · fixed in 1.1.3

Elastic APM agent for Ruby vulnerable to Improper Certificate Validation

• Weak cryptography or TLS

<2.9.0 · fixed in 2.9.0

libxslt Type Confusion vulnerability that affects Nokogiri

• Memory corruption

<1.10.5 · fixed in 1.10.5

Uninitialized read in Nokogiri gem

• Memory corruption

<1.10.5 · fixed in 1.10.5

Withdrawn Advisory: Fat Free CRM Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

<=0.19.0 · no fixed version yet

Publify has Improper Access Controls

• Broken access control

<9.2.9 · fixed in 9.2.9

Publify vulnerable to cross site scripting

• Cross-site scripting (XSS)
• Unrestricted file upload

<9.2.9 · fixed in 9.2.9

Nokogiri Improperly Handles Unexpected Data Type

• Memory corruption
• CWE-241

<1.13.6 · fixed in 1.13.6

Insecure PRNG use in random_password_generator

• Weak cryptography or TLS
• CWE-335

<=1.0.0 · no fixed version yet

Integer Overflow or Wraparound in libxml2 affects Nokogiri

• Memory corruption

<1.13.5 · fixed in 1.13.5

Publify vulnerable to DoS attack

• Denial of service

<8.0.1 · fixed in 8.0.1

openshift-origin-node Improper Input Validation vulnerability

• CWE-20

<=1.3.3 · no fixed version yet

Spree does not properly restrict the use of a hash to provide values for a model's attributes

<0.4.0 · fixed in 0.4.0

Spree uses a hardcoded hash value

<0.4.0 · fixed in 0.4.0

Chef Improper Access Control vulnerability

• Broken access control

<0.9.0 · fixed in 0.9.0