TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-hrqr-hxpp-chr3
Summary: Possible Information Leak / Session Hijack Vulnerability in Rack
Aliases: CVE-2019-16782
Severity: MODERATE
CWE: CWE-208, CWE-203
Published: 2019-12-18T19:01:31Z

There's a possible information leak / session hijack vulnerability in Rack. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a database that uses some kind of scheme for speeding up lookups of that session id. By carefully measuring the amount of time it takes to look up a session, an attacker may be able to find a valid session id and hijack the session.

The session id itself may be generated randomly, but the way the session is indexed by the backing store does not use a secure comparison.

### Impact

The session id stored in a cookie is the same id that is used when querying the backing session storage engine.  Most storage mechanisms (for example a database) use some sort of indexing in order to speed up the lookup of that id.  By carefully timing requests and session lookup failures, an attacker may be able to perform a timing attack to determine an existing session id and hijack that session.

## Releases

The 1.6.12 and 2.0.8 releases are available at the normal locations.

### Workarounds

There are no known workarounds.

### Patches

To aid users who aren't able to upgrade immediately we have provided patches for
the two supported release series. They are in git-am format and consist of a
single changeset.

* 1-6-session-timing-attack.patch - Patch for 1.6 series
* 2-0-session-timing-attack.patch - Patch for 2.6 series

### Credits

Thanks Will Leinweber for reporting this!
Vulnerability: GHSA-m46p-ggm5-5j83
Summary: Moderate severity vulnerability that affects rails
Aliases: CVE-2014-0081
Severity: MODERATE
CWE: CWE-79
Published: 2017-10-24T18:33:36Z

Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the (1) format, (2) negative_format, or (3) units parameter to the (a) number_to_currency, (b) number_to_percentage, or (c) number_to_human helper.
Vulnerability: GHSA-2rr5-8q37-2w7h
Summary: Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby
Aliases: CVE-2021-41098
Severity: HIGH
CWE: CWE-611
Published: 2021-09-27T20:12:47Z

### Severity

The Nokogiri maintainers have evaluated this as [**High Severity** 7.5 (CVSS3.0)](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C/MAV:N/MAC:L) for JRuby users. (This security advisory does not apply to CRuby users.)


### Impact

In Nokogiri v1.12.4 and earlier, **on JRuby only**, the SAX parser resolves external entities by default.

Users of Nokogiri on JRuby who parse untrusted documents using any of these classes are affected:

- Nokogiri::XML::SAX::Parser
- Nokogiri::HTML4::SAX::Parser or its alias Nokogiri::HTML::SAX::Parser
- Nokogiri::XML::SAX::PushParser
- Nokogiri::HTML4::SAX::PushParser or its alias Nokogiri::HTML::SAX::PushParser


### Mitigation

JRuby users should upgrade to Nokogiri v1.12.5 or later. There are no workarounds available for v1.12.4 or earlier.

CRuby users are not affected.
Vulnerability: GHSA-qrgf-jqqm-x7xv
Summary: High severity vulnerability that affects dragonfly
Aliases: CVE-2013-5671
Severity: HIGH
Published: 2017-10-24T18:33:37Z

lib/dragonfly/imagemagickutils.rb in the fog-dragonfly gem 0.8.2 for Ruby allows remote attackers to execute arbitrary commands via unspecified vectors.
Vulnerability: GHSA-882p-jqgm-f45g
Summary: Moderate severity vulnerability that affects nokogiri
Aliases: CVE-2017-18258
Severity: MODERATE
CWE: CWE-770
Published: 2018-04-13T16:17:46Z

The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.
Vulnerability: GHSA-qw8w-2xcp-xg59
Summary: Low severity vulnerability that affects passenger
Aliases: CVE-2014-1832
Severity: LOW
Published: 2018-10-10T17:29:27Z

Phusion Passenger 4.0.37 allows local users to write to certain files and directories via a symlink attack on (1) control_process.pid or a (2) generation-* file.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1831.
Vulnerability: GHSA-36p7-xjw8-h6f2
Summary: Ruby-saml allows attackers to perform XML signature wrapping attacks via unspecified vectors
Aliases: CVE-2016-5697
Severity: HIGH
CWE: CWE-91
Published: 2018-08-21T17:08:30Z

Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors.
Vulnerability: GHSA-vx9g-377x-xwxq
Summary: Server side request forgery in gibbon
Aliases: CVE-2022-27311
Severity: HIGH
CWE: CWE-918
Published: 2022-04-26T00:00:41Z

Gibbon v3.4.3 and below allows attackers to execute a Server-Side Request Forgery (SSRF) via a crafted URL. This issue has been resolved in version 3.4.4
Vulnerability: GHSA-xgr2-v94m-rc9g
Summary: High severity vulnerability that affects activesupport
Aliases: CVE-2013-0333
Severity: HIGH
Published: 2017-10-24T18:33:37Z

lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.
Vulnerability: GHSA-xfhh-rx56-rxcr
Summary: Path Traversal vulnerability that affects yard
Aliases: CVE-2019-1020001
Severity: HIGH
CWE: CWE-22
Published: 2019-07-02T15:28:38Z

## Possible arbitrary path traversal and file access via `yard server`

### Impact

A path traversal vulnerability was discovered in YARD <= 0.9.19 when using `yard server` to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

Thanks to CuongMX from Viettel Cyber Security for discovering this vulnerability.

### Patches

Please upgrade to YARD v0.9.20 immediately if you are relying on yard server to host documentation in any untrusted environments.

### Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via `yard server -s webrick`), as can certain rules in your webserver configuration.
Vulnerability: GHSA-w978-rmpf-qmwg
Summary: Limited header injection when using dynamic overrides with user input in RubyGems secure_headers
Aliases: CVE-2020-5216
Severity: MODERATE
CWE: CWE-113
Published: 2020-01-23T02:27:53Z

### Impact

If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header injection.

Upon seeing a newline in the header, rails will silently create a new `Content-Security-Policy` header with the remaining value of the original string. It will continue to create new headers for each newline.

e.g.

```ruby
override_content_security_directives(script_src: ['mycdn.com', "\ninjected\n"])` 
```

would result in 

```
Content-Security-Policy: ... script-src: mycdn.com
Content-Security-Policy: injected
Content-Security-Policy: rest-of-the-header
```

CSP supports multiple headers and all policies must be satisfied for execution to occur, but a malicious value that reports the current page is fairly trivial:

```ruby
override_content_security_directives(script_src: ["mycdn.com", "\ndefault-src 'none'; report-uri evil.com"]) 
```
```
Content-Security-Policy: ... script-src: mycdn.com
Content-Security-Policy: default-src 'none'; report-uri evil.com
Content-Security-Policy: rest-of-the-header
```

### Patches

This has been fixed in 6.3.0, 5.2.0, and 3.9.0

### Workarounds

```ruby
override_content_security_policy_directives(:frame_src, [user_input.gsub("\n", " ")])
```

### References

https://github.com/twitter/secure_headers/security/advisories/GHSA-xq52-rv6w-397c
[The effect of multiple policies](https://www.w3.org/TR/CSP3/#multiple-policies)

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [this repo](https://github.com/twitter/secure_headers/security/advisories/new)
* DM us at @ndm on twitter
Vulnerability: GHSA-j7vx-8mqj-cqp9
Summary: Exposure of Sensitive Information to an Unauthorized Actor in Doorkeeper
Aliases: CVE-2020-10187
Severity: HIGH
CWE: CWE-862
Published: 2020-05-07T21:11:07Z

### Impact
Information disclosure vulnerability. Allows an attacker to see all `Doorkeeper::Application` model attribute values (including secrets) using authorized applications controller if it's enabled (GET /oauth/authorized_applications.json).

### Patches

These versions have the fix:

* 5.0.3
* 5.1.1
* 5.2.5
* 5.3.2

### Workarounds
Patch `Doorkeeper::Application` model `#as_json(options = {})` method and define only those attributes you want to expose.

Additional recommended hardening is to enable application secrets hashing ([guide](https://doorkeeper.gitbook.io/guides/security/token-and-application-secrets)), available since Doorkeeper 5.1. This would render the exposed secret useless.

### References

- Commit with fix: https://github.com/doorkeeper-gem/doorkeeper/commit/25d038022c2fcad45af5b73f9d003cf38ff491f6
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10187
Vulnerability: GHSA-8877-prq4-9xfw
Summary: Open Redirect in actionpack
Aliases: CVE-2021-22881
Severity: MODERATE
CWE: CWE-601
Published: 2021-03-02T03:44:17Z

The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted `Host` header can be used to redirect to a malicious website.
Vulnerability: GHSA-ch3h-j2vf-95pv
Summary: XSS Vulnerability in Action View tag helpers
Aliases: CVE-2022-27777
Severity: HIGH
CWE: CWE-79
Published: 2022-04-27T22:32:49Z

There is a possible XSS vulnerability in Action View tag helpers.  Passing
untrusted input as hash keys can lead to a possible XSS vulnerability. This
vulnerability has been assigned the CVE identifier CVE-2022-27777.

Versions Affected:  ALL
Not affected:       NONE
Fixed Versions:     7.0.2.4, 6.1.5.1, 6.0.4.8, 5.2.7.1

## Impact

If untrusted data is passed as the hash key for tag attributes, there is a
possibility that the untrusted data may not be properly escaped which can
lead to an XSS vulnerability.

Impacted code will look something like this:

```
check_box_tag('thename', 'thevalue', false, aria: { malicious_input => 'thevalueofaria' })
```

Where the "malicious_input" variable contains untrusted data.

All users running an affected release should either upgrade or use one of the
workarounds immediately.

## Releases

The FIXED releases are available at the normal locations.

## Workarounds

Escape the untrusted data before using it as a key for tag helper methods.
Vulnerability: GHSA-q34c-48gc-m9g8
Summary: Moderate severity vulnerability that affects actionpack
Aliases: CVE-2012-2694
Severity: MODERATE
Published: 2017-10-24T18:33:38Z

actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain "['xyz', nil]" values, a related issue to CVE-2012-2660.
Vulnerability: GHSA-jmgw-6vjg-jjwg
Summary: High severity vulnerability that affects actionpack
Aliases: CVE-2013-0156
Severity: HIGH
CWE: CWE-20
Published: 2017-10-24T18:33:37Z

active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
Vulnerability: GHSA-j96r-xvjq-r9pg
Summary: Moderate severity vulnerability that affects activesupport
Aliases: CVE-2015-3227
Severity: MODERATE
Published: 2017-10-24T18:33:36Z

The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.
Vulnerability: GHSA-xxx9-3xcr-gjj3
Summary: XML Injection in Xerces Java affects Nokogiri
Severity: MODERATE
CWE: CWE-91
Published: 2022-04-11T21:30:00Z

## Summary

Nokogiri v1.13.4 updates the vendored `xerces:xercesImpl` from 2.12.0 to 2.12.2, which addresses [CVE-2022-23437](https://nvd.nist.gov/vuln/detail/CVE-2022-23437). That CVE is scored as CVSS 6.5 "Medium" on the NVD record.

Please note that this advisory only applies to the **JRuby** implementation of Nokogiri `< 1.13.4`.

## Mitigation

Upgrade to Nokogiri `>= v1.13.4`.

## Impact

### [CVE-2022-23437](https://nvd.nist.gov/vuln/detail/CVE-2022-23437) in xerces-J

- **Severity**: Medium
- **Type**: [CWE-91](https://cwe.mitre.org/data/definitions/91.html) XML Injection (aka Blind XPath Injection)
- **Description**: There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.
- **See also**: https://github.com/advisories/GHSA-h65f-jvqw-m9fj
Vulnerability: GHSA-q28m-8xjw-8vr5
Summary: Keepalive Connections Causing Denial Of Service in puma
Aliases: CVE-2021-29509
Severity: HIGH
CWE: CWE-400
Published: 2021-05-18T01:27:15Z

This vulnerability is related to [CVE-2019-16770](https://github.com/puma/puma/security/advisories/GHSA-7xx3-m584-x994).

### Impact

The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same process. However, new connections may still be starved by greedy persistent-connections saturating all threads in all processes in the cluster.

A `puma` server which received more concurrent `keep-alive` connections than the server had threads in its threadpool would service only a subset of connections, denying service to the unserved connections.

### Patches

This problem has been fixed in `puma` 4.3.8 and 5.3.1.

### Workarounds

Setting `queue_requests false` also fixes the issue. This is not advised when using `puma` without a reverse proxy, such as `nginx` or `apache`, because you will open yourself to slow client attacks (e.g. [slowloris](https://en.wikipedia.org/wiki/Slowloris_(computer_security))).

The fix is very small. [A git patch is available here](https://gist.github.com/nateberkopec/4b3ea5676c0d70cbb37c82d54be25837) for those using [unsupported versions](https://github.com/puma/puma/security/policy#supported-versions) of Puma.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [Puma](https://github.com/puma/puma).
* To report problems with this fix or to report another vulnerability, see [our security policy.](https://github.com/puma/puma/security/policy)

### Acknowledgements

Thank you to @MSP-Greg, @wjordan and @evanphx for their review on this issue. 

Thank you to @ioquatix for providing a modified fork of `wrk` which made debugging this issue much easier.
Vulnerability: GHSA-xgj6-pgrm-x4r2
Summary: Moderate severity vulnerability that affects gtk2
Aliases: CVE-2007-6183
Severity: MODERATE
CWE: CWE-134
Published: 2017-10-24T18:33:38Z

Format string vulnerability in the mdiag_initialize function in gtk/src/rbgtkmessagedialog.c in Ruby-GNOME 2 (aka Ruby/Gnome2) 0.16.0, and SVN versions before 20071127, allows context-dependent attackers to execute arbitrary code via format string specifiers in the message parameter.
Vulnerability: GHSA-p65m-qr5x-rrqq
Summary: High severity vulnerability that affects webbynode
Aliases: CVE-2013-7086
Severity: HIGH
CWE: CWE-94
Published: 2017-10-24T18:33:36Z

The message function in lib/webbynode/notify.rb in the Webbynode gem 1.0.5.3 and earlier for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a growlnotify message.
Vulnerability: GHSA-4wm8-fjv7-j774
Summary: Escape sequence injection in RubyGems
Aliases: CVE-2019-8325
Severity: HIGH
CWE: CWE-74
Published: 2019-06-20T16:08:21Z

An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::CommandManager#run calls alert_error without escaping, escape sequence injection is possible. (There are many ways to cause an error.)
Vulnerability: GHSA-jp5v-5gx4-jmj9
Summary: Ability to forge per-form CSRF tokens in Rails
Aliases: CVE-2020-8166
Severity: MODERATE
CWE: CWE-352
Published: 2020-05-26T15:11:13Z

It is possible to possible to, given a global CSRF token such as the one
present in the authenticity_token meta tag, forge a per-form CSRF token for
any action for that session.

Impact
------

Given the ability to extract the global CSRF token, an attacker would be able to
construct a per-form CSRF token for that session.

Workarounds
-----------

This is a low-severity security issue. As such, no workaround is necessarily
until such time as the application can be upgraded.
Vulnerability: GHSA-2p68-f74v-9wc6
Summary: Unintended unmarshalling in ActiveSupport
Aliases: CVE-2020-8165
Severity: HIGH
CWE: CWE-502
Published: 2020-05-26T14:49:24Z

In ActiveSupport, there is potentially unexpected behaviour in the MemCacheStore and RedisCacheStore where, when
untrusted user input is written to the cache store using the `raw: true` parameter, re-reading the result
from the cache can evaluate the user input as a Marshalled object instead of plain text. Vulnerable code looks like:

```
data = cache.fetch("demo", raw: true) { untrusted_string }
```
Versions Affected:  rails < 5.2.5, rails < 6.0.4
Not affected:       Applications not using MemCacheStore or RedisCacheStore. Applications that do not use the `raw` option when storing untrusted user input.
Fixed Versions:     rails >= 5.2.4.3, rails >= 6.0.3.1
  
Impact
------
Unmarshalling of untrusted user input can have impact up to and including RCE. At a minimum,
this vulnerability allows an attacker to inject untrusted Ruby objects into a web application.
In addition to upgrading to the latest versions of Rails, developers should ensure that whenever
they are calling `Rails.cache.fetch` they are using consistent values of the `raw` parameter for both
reading and writing, especially in the case of the RedisCacheStore which does not, prior to these changes,
detect if data was serialized using the raw option upon deserialization.

Workarounds
-----------
It is recommended that application developers apply the suggested patch or upgrade to the latest release as
soon as possible. If this is not possible, we recommend ensuring that all user-provided strings cached using
the `raw` argument should be double-checked to ensure that they conform to the expected format.
Vulnerability: GHSA-gppp-5xc5-wfpx
Summary: Moderate severity vulnerability that affects activerecord
Aliases: CVE-2013-0155
Severity: MODERATE
Published: 2017-10-24T18:33:37Z

Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660 and CVE-2012-2694.
Vulnerability: GHSA-cvw2-xj8r-mjf7
Summary: Activerecord-session_store Timing Attack
Aliases: CVE-2019-25025
Severity: MODERATE
CWE: CWE-208
Published: 2021-03-09T00:45:31Z

The `activerecord-session_store` (aka Active Record Session Store) component through 1.1.3 for Ruby on Rails does not use a constant-time approach when delivering information about whether a guessed session ID is valid. Consequently, remote attackers can leverage timing discrepancies to achieve a correct guess in a relatively short amount of time. This is a related issue to CVE-2019-16782. 

## Recommendation

This has been fixed in version 2.0.0.  All users are advised to update to this version or later.
Vulnerability: GHSA-pxqr-8v54-m2hj
Summary: Moderate severity vulnerability that affects rails_admin
Aliases: CVE-2016-10522
Severity: MODERATE
CWE: CWE-352
Published: 2018-08-08T22:30:35Z

rails_admin ruby gem <v1.1.1 is vulnerable to cross-site request forgery (CSRF) attacks. Non-GET methods were not validating CSRF tokens and, as a result, an attacker could hypothetically gain access to the application administrative endpoints exposed by the gem.
Vulnerability: GHSA-9wrq-xvmp-xjc8
Summary: High severity vulnerability that affects rails.
Aliases: CVE-2006-4112
Severity: HIGH
Published: 2017-10-24T18:33:38Z

Unspecified vulnerability in the "dependency resolution mechanism" in Ruby on Rails 1.1.0 through 1.1.5 allows remote attackers to execute arbitrary Ruby code via a URL that is not properly handled in the routing code, which leads to a denial of service (application hang) or "data loss," a different vulnerability than CVE-2006-4111.
Vulnerability: GHSA-6hrm-jqp3-64cv
Summary: Improper Certificate Validation in TweetStream
Aliases: CVE-2020-24393
Severity: MODERATE
CWE: CWE-295
Published: 2021-04-13T15:42:36Z

TweetStream 2.6.1 uses the library eventmachine in an insecure way that does not have TLS hostname validation. This allows an attacker to perform a man-in-the-middle attack.
Vulnerability: GHSA-x489-jjwm-52g7
Summary: Tinfoil Devise-two-factor does not "burn" a successfully validated one-time password (OTP)
Aliases: CVE-2015-7225
Severity: MODERATE
Published: 2018-08-28T22:34:15Z

Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password (aka OTP), which allows remote or physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP through performing a man-in-the-middle attack between the provider and verifier, or shoulder surfing, and replaying the OTP in the current time-step.
Vulnerability: GHSA-pf6m-fxpq-fg8v
Summary: Nokogiri lacked integer overflow checks
Aliases: CVE-2017-5029
Severity: HIGH
CWE: CWE-787
Published: 2018-07-31T18:21:29Z

The xsltAddTextString function in transform.c in libxslt 1.1.29, as used in Nokogiri prior to 1.7.2, lacked a check for integer overflow during a size calculation, which allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.
Vulnerability: GHSA-gh2w-j7cx-2664
Summary: High severity vulnerability that affects activerecord
Aliases: CVE-2012-6496
Severity: HIGH
CWE: CWE-89
Published: 2017-10-24T18:33:37Z

SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain find_by_ method calls.
Vulnerability: GHSA-c43v-hrmg-56r4
Summary: Moderate severity vulnerability that affects cocaine
Aliases: CVE-2013-4457
Severity: MODERATE
CWE: CWE-78
Published: 2017-10-24T18:33:37Z

The Cocaine gem 0.4.0 through 0.5.2 for Ruby allows context-dependent attackers to execute arbitrary commands via a crafted has object, related to recursive variable interpolation.
Vulnerability: GHSA-gj4p-3wh3-2rmf
Summary: High severity vulnerability that affects yard
Aliases: CVE-2017-17042
Severity: HIGH
CWE: CWE-22
Published: 2017-12-21T00:47:25Z

lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.
Vulnerability: GHSA-h99w-9q5r-gjq9
Summary: HTTP Request Smuggling in puma
Aliases: CVE-2022-24790
Severity: CRITICAL
CWE: CWE-444
Published: 2022-03-30T21:48:50Z

When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on where a request starts and ends. This would allow requests to be smuggled via the front-end proxy to Puma.

The following vulnerabilities are addressed by this advisory:
- Lenient parsing of `Transfer-Encoding` headers, when unsupported encodings should be rejected and the final encoding must be `chunked`.
- Lenient parsing of malformed `Content-Length` headers and chunk sizes, when only digits and hex digits should be allowed.
- Lenient parsing of duplicate `Content-Length` headers, when they should be rejected.
- Lenient parsing of the ending of chunked segments, when they should end with `\r\n`.

The vulnerability has been fixed in 5.6.4 and 4.3.12. When deploying a proxy in front of Puma, turning on any and all functionality to make sure that the request matches the RFC7230 standard. 

These proxy servers are known to have "good" behavior re: this standard and upgrading Puma may not be necessary. Users are encouraged to validate for themselves.

- Nginx (latest)
- Apache (latest)
- Haproxy 2.5+
- Caddy (latest)
- Traefik (latest)
Vulnerability: GHSA-hrj5-qp7x-rpg6
Summary: SQL Injection in marginalia
Aliases: CVE-2019-1010191
Severity: CRITICAL
CWE: CWE-89
Published: 2019-07-26T16:10:15Z

marginalia < 1.6 is affected by: SQL Injection. The impact is: The impact is a injection of any SQL queries when a user controller argument is added as a component. The component is: Affects users that add a component that is user controller, for instance a parameter or a header. The attack vector is: Hacker inputs a SQL to a vulnerable vector(header, http parameter, etc). The fixed version is: 1.6.
Vulnerability: GHSA-r5jw-62xg-j433
Summary: Cross-Site Scripting in Kaminari
Aliases: CVE-2020-11082
Severity: MODERATE
CWE: CWE-79
Published: 2020-05-28T21:10:11Z

### Impact
In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code into pages with pagination links. This has been fixed in 1.2.1.

### Releases
The 1.2.1 gem including the patch has already been released.
All past released versions are affected by this vulnerability.

### Workarounds
Application developers who can't update the gem can workaround by overriding the `PARAM_KEY_EXCEPT_LIST` constant.

```ruby
module Kaminari::Helpers
  PARAM_KEY_EXCEPT_LIST = [:authenticity_token, :commit, :utf8, :_method, :script_name, :original_script_name].freeze
end
```

### Credits
Thanks to Daniel Mircea for finding the issue and sending a patch via GitHub. Also thanks to Aditya Prakash for reporting the vulnerability.
Vulnerability: GHSA-m63j-wh5w-c252
Summary: Critical severity vulnerability that affects actionview
Aliases: CVE-2019-5419
Severity: CRITICAL
CWE: CWE-400
Published: 2019-03-13T17:25:55Z

# Denial of Service Vulnerability in Action View

Impact 
------ 
Specially crafted accept headers can cause the Action View template location 
code to consume 100% CPU, causing the server unable to process requests.  This 
impacts all Rails applications that render views. 

All users running an affected release should either upgrade or use one of the 
workarounds immediately. 

Releases 
-------- 
The 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, and 4.2.11.1 releases are 
available at the normal locations. 

Workarounds 
----------- 
This vulnerability can be mitigated by wrapping `render` calls with 
`respond_to` blocks.  For example, the following example is vulnerable: 

``` 
class UserController < ApplicationController 
  def index 
    render "index" 
  end 
end 
``` 

But the following code is not vulnerable: 

``` 
class UserController < ApplicationController 
  def index 
    respond_to |format| 
      format.html { render "index" } 
    end 
  end 
end 
``` 

Implicit rendering is impacted, so this code is vulnerable: 

``` 
class UserController < ApplicationController 
  def index 
  end 
end 
``` 

But can be changed this this: 

``` 
class UserController < ApplicationController 
  def index 
    respond_to |format| 
      format.html { render "index" } 
    end 
  end 
end 
``` 

Alternatively to specifying the format, the following monkey patch can be 
applied in an initializer: 

``` 
$ cat config/initializers/formats_filter.rb 
# frozen_string_literal: true 

ActionDispatch::Request.prepend(Module.new do 
  def formats 
    super().select do |format| 
      format.symbol || format.ref == "*/*" 
    end 
  end 
end) 
``` 

Please note that only the 5.2.x, 5.1.x, 5.0.x, and 4.2.x series are supported 
at present. Users of earlier unsupported releases are advised to upgrade as 
soon as possible as we cannot guarantee the continued availability of security 
fixes for unsupported releases. 

Also note that the patches for this vulnerability are the same as CVE-2019-5418. 

Credits 
------- 
Thanks to John Hawthorn <john@hawthorn.email> of GitHub
Vulnerability: GHSA-9p3v-wf2w-v29c
Summary: Moderate severity vulnerability that affects rails
Aliases: CVE-2009-4214
Severity: MODERATE
CWE: CWE-79
Published: 2017-10-24T18:33:38Z

Cross-site scripting (XSS) vulnerability in the strip_tags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tokenizer and actionpack/lib/action_controller/vendor/html-scanner/html/node.rb.
Vulnerability: GHSA-c5qq-g673-5p49
Summary: Low severity vulnerability that affects puppet
Aliases: CVE-2012-1989
Severity: LOW
Published: 2017-10-24T18:33:38Z

telnet.rb in Puppet 2.7.x before 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows local users to overwrite arbitrary files via a symlink attack on the NET::Telnet connection log (/tmp/out.log).
Vulnerability: GHSA-9pr6-grf4-x2fr
Summary: Omniauth allows POST parameters to be stored in session
Aliases: CVE-2017-18076
Severity: HIGH
Published: 2018-01-29T15:45:28Z

In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value is improperly protected because POST (in addition to GET) parameters are stored in the session and become available in the environment of the callback phase.
Vulnerability: GHSA-qpg4-4w7w-2mq5
Summary: Authentication and extension bypass in Faye
Aliases: CVE-2020-11020
Severity: HIGH
CWE: CWE-287
Published: 2020-04-29T17:41:15Z

On 20 April 2020 it was reported to me that the potential for authentication
bypass exists in [Faye][1]'s extension system. This vulnerability has existed in
the Node.js and Ruby versions of the server since version 0.5.0, when extensions
were first introduced, in July 2010. It is patched in versions 1.0.4, 1.1.3 and
1.2.5, which we are releasing today.

The vulnerability allows any client to bypass checks put in place by server-side
extensions, by appending extra segments to the message channel. For example, the
Faye [extension docs][2] suggest that users implement access control for
subscriptions by checking incoming messages for the `/meta/subscribe` channel,
for example:

```js
server.addExtension({
  incoming: function(message, callback) {
    if (message.channel === '/meta/subscribe') {
      if (message.ext.authToken !== 'my super secret password') {
        message.error = 'Invalid auth token';
      }
    }
    callback(message);
  }
});
```

A bug in the server's code for recognising the special `/meta/*` channels, which
trigger connection and subscription events, means that a client can bypass this
check by sending a message to `/meta/subscribe/x` rather than `/meta/subscribe`:

```json
{
  "channel": "/meta/subscribe/x",
  "clientId": "3jrc6602npj4gyp6bn5ap2wqzjtb2q3",
  "subscription": "/foo"
}
```

This message will not be checked by the above extension, as it checks the
message's channel is exactly equal to `/meta/subscribe`. But it will still be
processed as a subscription request by the server, so the client becomes
subscribed to the channel `/foo` without supplying the necessary credentials.

The vulnerability is caused by the way the Faye server recognises meta channels.
It will treat a message to any channel that's a prefix-match for one of the
special channels `/meta/handshake`, `/meta/connect`, `/meta/subscribe`,
`/meta/unsubscribe` or `/meta/disconnect`, as though it were an exact match for
that channel. So, a message to `/meta/subscribe/x` is still processed as a
subscription request, for example.

An authentication bypass for subscription requests is the most serious effect of
this but all other meta channels are susceptible to similar manipulation.

This parsing bug in the server is fixed in versions 1.0.4, 1.1.3 and 1.2.5.
These should be drop-in replacements for prior versions and you should upgrade
immediately if you are running any prior version.

If you are unable to install one of these versions, you can make your extensions
catch all messages the server would process by checking the channel _begins_
with the expected channel name, for example:

```js
server.addExtension({
  incoming: function(message, callback) {
    if (message.channel.startsWith('/meta/subscribe')) {
      // authentication logic
    }
    callback(message);
  }
});
```

[1]: https://faye.jcoglan.com/
[2]: https://faye.jcoglan.com/node/extensions.html
Vulnerability: GHSA-mg5p-95m9-rmfp
Summary: Arbitrary file write in actionpack-page_caching gem
Aliases: CVE-2020-8159
Severity: CRITICAL
CWE: CWE-22
Published: 2020-05-13T16:28:46Z

There is a vulnerability in actionpack_page-caching gem < v1.2.1 that allows an attacker to write arbitrary files to a web server, potentially resulting in remote code execution if the attacker can write unescaped ERB to a view.
Vulnerability: GHSA-pc3m-v286-2jwj
Summary: Moderate severity vulnerability that affects actionview
Aliases: CVE-2016-6316
Severity: MODERATE
CWE: CWE-79
Published: 2017-10-24T18:33:35Z

Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers.
Vulnerability: GHSA-jxhw-mg8m-2pj8
Summary: Moderate severity vulnerability that affects devise
Aliases: CVE-2013-0233
Severity: MODERATE
Published: 2017-10-24T18:33:37Z

Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass security checks via unknown vectors, as demonstrated by resetting passwords of arbitrary accounts.
Vulnerability: GHSA-xrr6-3pc4-m447
Summary: Moderate severity vulnerability that affects activerecord
Aliases: CVE-2015-7577
Severity: MODERATE
CWE: CWE-284
Published: 2017-10-24T18:33:36Z

activerecord/lib/active_record/nested_attributes.rb in Active Record in Ruby on Rails 3.1.x and 3.2.x before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly implement a certain destroy option, which allows remote attackers to bypass intended change restrictions by leveraging use of the nested attributes feature.
Vulnerability: GHSA-6jvm-3j5h-79f6
Summary: Moderate severity vulnerability that affects paperclip
Aliases: CVE-2015-2963
Severity: MODERATE
CWE: CWE-79
Published: 2017-10-24T18:33:36Z

The thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type value during media-type validation, which allows remote attackers to upload HTML documents and conduct cross-site scripting (XSS) attacks via a spoofed value, as demonstrated by image/jpeg.
Vulnerability: GHSA-f8cm-364f-q9qh
Summary: Ensure that doorkeeper_token is valid when authenticating requests in API v2 calls
Aliases: CVE-2020-15269
Severity: HIGH
CWE: CWE-613, CWE-287
Published: 2020-10-20T20:03:52Z

### Impact
The perpetrator who previously obtained an old expired user token could use it to access Storefront API v2 endpoints. 

### Patches
Please upgrade to 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. 

### Workarounds
In your project directory create a decorator file `app/controllers/spree/api/v2/base_controller_decotatror.rb` with contents:

```ruby
module Spree
  module Api
    module V2
      module BaseControllerDecorator
        private

        def spree_current_user
          return nil unless doorkeeper_token
          return @spree_current_user if @spree_current_user

          doorkeeper_authorize!

          @spree_current_user ||= ::Spree.user_class.find_by(id: doorkeeper_token.resource_owner_id)
        end
     end
  end
end

Spree::Api::V2::BaseController.prepend(Spree::Api::V2::BaseControllerDecorator)
```

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@spreecommerce.org](mailto:security@spreecommerce.org)
Vulnerability: GHSA-xf96-32q2-9rw2
Summary: High severity vulnerability that affects rails
Aliases: CVE-2008-4094
Severity: HIGH
CWE: CWE-89
Published: 2017-10-24T18:33:38Z

Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) :limit and (2) :offset parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer.
Vulnerability: GHSA-6mqr-q86q-6gwr
Summary: Authentication Bypass by CSRF Weakness
Severity: CRITICAL
CWE: CWE-352
Published: 2021-11-18T20:15:09Z

### Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of `spree_auth_devise` are affected if `protect_from_forgery` method is both:

* Executed whether as:
  * A before_action callback (the default)
  * A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
* Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏 

### Patches

Spree 4.3 users should update to spree_auth_devise 4.4.1
Spree 4.2 users should update to spree_auth_devise 4.2.1
 
### Workarounds

If possible, change your strategy to :exception:

```ruby
class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end
```

Add the following to`config/application.rb `to at least run the `:exception` strategy on the affected controller:

```ruby
config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end
```

### References
https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2
Vulnerability: GHSA-59c7-4xj2-hgvw
Summary: Moderate severity vulnerability that affects rails-html-sanitizer
Aliases: CVE-2015-7578
Severity: MODERATE
CWE: CWE-79
Published: 2017-10-24T18:33:36Z

Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via crafted tag attributes.
Vulnerability: GHSA-ggxm-pgc9-g7fp
Summary: Arbitrary Code Execution in rdoc
Aliases: CVE-2021-31799
Severity: HIGH
CWE: CWE-74, CWE-77
Published: 2021-09-01T18:53:15Z

In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.
Vulnerability: GHSA-qf9q-q4hh-qph3
Summary: SQL injection in blazer
Aliases: CVE-2022-29498
Severity: HIGH
CWE: CWE-89
Published: 2022-04-22T00:00:36Z

Blazer before 2.6.0 allows SQL Injection. In certain circumstances, an attacker could get a user to run a query they would not have normally run.
Vulnerability: GHSA-mp78-r56v-45qc
Summary: Moderate severity vulnerability that affects ember-source
Aliases: CVE-2015-1866
Severity: MODERATE
CWE: CWE-79
Published: 2018-08-28T22:34:31Z

Cross-site scripting (XSS) vulnerability in Ember.js 1.10.x before 1.10.1 and 1.11.x before 1.11.2.
Vulnerability: GHSA-gpqc-4pp7-5954
Summary: Authentication Bypass by CSRF Weakness
Severity: CRITICAL
CWE: CWE-352
Published: 2021-11-18T20:15:35Z

### Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of `spree_auth_devise` are affected if `protect_from_forgery` method is both:

* Executed whether as:
  * A before_action callback (the default)
  * A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
* Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏 

### Patches

Spree 4.3 users should update to spree_auth_devise 4.4.1
Spree 4.2 users should update to spree_auth_devise 4.2.1
Spree 4.1 users should update to spree_auth_devise 4.1.1
Older Spree version users should update to spree_auth_devise 4.0.1
 
### Workarounds

If possible, change your strategy to :exception:

```ruby
class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end
```

Add the following to`config/application.rb `to at least run the `:exception` strategy on the affected controller:

```ruby
config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end
```

### References
https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2
Vulnerability: GHSA-9hx9-w2j6-rw76
Summary: Low severity vulnerability that affects show_in_browser
Aliases: CVE-2013-2105
Severity: LOW
CWE: CWE-59
Published: 2017-10-24T18:33:37Z

The Show In Browser (show_in_browser) gem 0.0.3 for Ruby allows local users to inject arbitrary web script or HTML via a symlink attack on /tmp/browser.html.
Vulnerability: GHSA-fwcm-636p-68r5
Summary: Server-side request forgery in CarrierWave
Aliases: CVE-2021-21288
Severity: LOW
CWE: CWE-918
Published: 2021-02-08T19:16:26Z

### Impact
[CarrierWave download feature](https://github.com/carrierwaveuploader/carrierwave#uploading-files-from-a-remote-location) has an SSRF vulnerability, allowing attacks to provide DNS entries or IP addresses that are intended for internal use and gather information about the Intranet infrastructure of the platform.

### Patches
Upgrade to [2.1.1](https://rubygems.org/gems/carrierwave/versions/2.1.1) or [1.3.2](https://rubygems.org/gems/carrierwave/versions/1.3.2).

### Workarounds
Using proper network segmentation and applying the principle of least privilege to outbound connections from application servers can reduce the severity of SSRF vulnerabilities. Ideally the vulnerable gem should run on an isolated server without access to any internal network resources or cloud metadata access.

### References
[Server-Side Request Forgery Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [CarrierWave repo](https://github.com/carrierwaveuploader/carrierwave)
* Email me at [mit.shibuya@gmail.com](mailto:mit.shibuya@gmail.com)
Vulnerability: GHSA-vm28-mrm7-fpjq
Summary: High severity vulnerability that affects sfpagent
Aliases: CVE-2014-2888
Severity: HIGH
CWE: CWE-77
Published: 2017-10-24T18:33:36Z

lib/sfpagent/bsig.rb in the sfpagent gem before 0.4.15 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the module name in a JSON request.
Vulnerability: GHSA-x7rv-cr6v-4vm4
Summary: Moderate severity vulnerability that affects loofah
Aliases: CVE-2018-8048
Severity: MODERATE
CWE: CWE-79
Published: 2018-03-21T11:57:11Z

Loofah allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments.

Users are affected if running Loofah < 2.2.1, but only:

* when running on MRI or RBX,
* in combination with libxml2 >= 2.9.2.

Please note: JRuby users are not affected.
Vulnerability: GHSA-9p29-94hp-8rvc
Summary: XSS in qiita-markdown
Aliases: CVE-2021-28833
Severity: MODERATE
CWE: CWE-79
Published: 2021-08-02T17:22:07Z

Increments Qiita::Markdown before 0.34.0 allows XSS via a crafted gist link, a different vulnerability than CVE-2021-28796.
Vulnerability: GHSA-mj4x-wcxf-hm8x
Summary: Json-jwt (RubyGems) did not verify, or incorrectly verifies, the cryptographic signature for data
Aliases: CVE-2018-1000539
Severity: MODERATE
CWE: CWE-347
Published: 2018-07-31T18:13:51Z

The json-jwt rubygem version >= 0.5.0 && < 1.9.4 contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability in Decryption of AES-GCM encrypted JSON Web Tokens that can result in Attacker can forge a authentication tag. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 1.9.4 and later.
Vulnerability: GHSA-98mf-8f57-64qf
Summary: Moderate severity vulnerability that affects actionpack
Aliases: CVE-2012-3463
Severity: MODERATE
CWE: CWE-79
Published: 2017-10-24T18:33:37Z

Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_tag_helper.rb in Ruby on Rails 3.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via the prompt field to the select_tag helper.
Vulnerability: GHSA-x3rq-r3cm-5vc4
Summary: Business Logic Errors in Publify
Aliases: CVE-2022-0524
Severity: HIGH
Published: 2022-02-09T00:00:27Z

Publify (formerly known as Typo) prior to version 9.2.7 is vulnerable to business logic errors.
Vulnerability: GHSA-w248-xr37-jx8m
Summary: High severity vulnerability that affects fastreader
Aliases: CVE-2013-2615
Severity: HIGH
CWE: CWE-94
Published: 2017-10-24T18:33:37Z

lib/entry_controller.rb in the fastreader Gem 1.0.8 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.
Vulnerability: GHSA-mvw8-v767-qhjm
Summary: Moderate severity vulnerability that affects radiant
Aliases: CVE-2018-5216
Severity: MODERATE
CWE: CWE-79
Published: 2018-01-06T01:11:52Z

Radiant CMS 1.1.4 has XSS via crafted Markdown input in the part_body_content parameter to an admin/pages/*/edit resource.
Vulnerability: GHSA-g89m-3wjw-h857
Summary: Low severity vulnerability that affects puppet
Aliases: CVE-2012-3865
Severity: LOW
CWE: CWE-22
Published: 2017-10-24T18:33:37Z

Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name.
Vulnerability: GHSA-f599-5m7p-hcpf
Summary: Moderate severity vulnerability that affects grape
Aliases: CVE-2018-3769
Severity: MODERATE
CWE: CWE-79
Published: 2018-08-13T20:45:32Z

The grape rubygem suffers from a cross-site scripting (XSS) vulnerability via "format" parameter.