TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-vqcm-7f7f-r539
Summary: brbackup exposes database password to unauthorized users
Aliases: CVE-2014-5004
Severity: HIGH
CWE: CWE-200
Published: 2018-03-05T19:32:06Z

lib/brbackup.rb in the brbackup gem 0.1.1 for Ruby places the database password on the mysql command line, which allows local users to obtain sensitive information by listing the process.
Vulnerability: GHSA-jm35-h8q2-73mp
Summary: Improper one time password handling in devise-two-factor
Aliases: CVE-2021-43177
Severity: MODERATE
Published: 2022-04-07T22:09:03Z

### Impact
As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password (OTP) for one (and only one) immediately trailing interval.
 
### Patches
This vulnerability has been patched in version 4.0.2 which was released on March 24th, 2022. Individuals using this package are strongly encouraged to upgrade as soon as possible.

### Credit for discovery
Benoit Côté-Jodoin
Michael Nipper - https://github.com/tinfoil/devise-two-factor/issues/106
Vulnerability: GHSA-4ww3-3rxj-8v6q
Summary: High severity vulnerability that affects actionpack
Aliases: CVE-2011-0449
Severity: HIGH
Published: 2017-10-24T18:33:38Z

actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is used, does not properly implement filters associated with the list of available templates, which allows remote attackers to bypass intended access restrictions via an action name that uses an unintended case for alphabetic characters.
Vulnerability: GHSA-5h5r-ffc4-c455
Summary: strong_password Ruby gem malicious version causing Remote Code Execution vulnerability
Aliases: CVE-2019-13354
Severity: CRITICAL
CWE: CWE-94
Published: 2019-07-08T20:32:35Z

The strong_password gem 0.0.7 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 0.0.6.
Vulnerability: GHSA-xq52-rv6w-397c
Summary: Directive injection when using dynamic overrides with user input
Aliases: CVE-2020-5217
Severity: MODERATE
CWE: CWE-95
Published: 2020-01-23T02:28:11Z

### Impact

If user-supplied input was passed into `append/override_content_security_policy_directives`, a semicolon could be injected leading to directive injection.

This could be used to e.g. override a `script-src` directive. Duplicate directives are ignored and the first one wins. The directives in `secure_headers` are sorted alphabetically so they pretty much all come before `script-src`. A previously undefined directive would receive a value even if `SecureHeaders::OPT_OUT` was supplied.

The fixed versions will silently convert the semicolons to spaces and emit a deprecation warning when this happens. This will result in innocuous browser console messages if being exploited/accidentally used. In future releases, we will raise application errors resulting in 500s.

> Duplicate script-src directives detected.  All but the first instance will be ignored.

See https://www.w3.org/TR/CSP3/#parse-serialized-policy

> Note: In this case, the user agent SHOULD notify developers that a duplicate directive was ignored. A console warning might be appropriate, for example.

### Patches

Depending on what major version you are using, the fixed versions are 6.2.0, 5.1.0, 3.8.0.

### Workarounds

If you are passing user input into the above methods, you could filter out the input:

```ruby
override_content_security_policy_directives(:frame_src, [user_input.gsub(";", " ")])
```

### References

Reported in https://github.com/twitter/secure_headers/issues/418
https://www.w3.org/TR/CSP3/#parse-serialized-policy

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [this repo](https://github.com/twitter/secure_headers/issues/new)
* DM @ndm on twitter
Vulnerability: GHSA-24fg-p96v-hxh8
Summary: Moderate severity vulnerability that affects rails
Aliases: CVE-2011-0447
Severity: MODERATE
CWE: CWE-352
Published: 2017-10-24T18:33:38Z

Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged (1) AJAX or (2) API requests that leverage "combinations of browser plugins and HTTP redirects," a related issue to CVE-2011-0696.
Vulnerability: GHSA-v3rr-cph9-2g2q
Summary: Moderate severity vulnerability that affects rack-ssl
Aliases: CVE-2014-2538
Severity: MODERATE
CWE: CWE-79
Published: 2017-10-24T18:33:36Z

Cross-site scripting (XSS) vulnerability in lib/rack/ssl.rb in the rack-ssl gem before 1.4.0 for Ruby allows remote attackers to inject arbitrary web script or HTML via a URI, which might not be properly handled by third-party adapters such as JRuby-Rack.
Vulnerability: GHSA-q58g-455p-8vw9
Summary: In RubyGem excon, interrupted Persistent Connections May Leak Response Data
Aliases: CVE-2019-16779
Severity: MODERATE
CWE: CWE-362, CWE-664
Published: 2019-12-16T19:30:17Z

### Impact
There was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition window appears to be short, and it would be difficult to purposefully exploit this.

### Patches
The problem has been patched in 0.71.0, users should upgrade to this or a newer version (if one exists).

### Workarounds
Users can workaround the problem by disabling persistent connections, though this may cause performance implications.

### References
See the [patch](https://github.com/excon/excon/commit/ccb57d7a422f020dc74f1de4e8fb505ab46d8a29) for further details.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [excon/issues](https://github.com/excon/excon/issues)
* Email us at [geemus+github@gmail.com](mailto:geemus+github@gmail.com)
Vulnerability: GHSA-fr52-4hqw-p27f
Summary: Nokogiri does not forbid namespace nodes in XPointer ranges
Aliases: CVE-2016-4658
Severity: CRITICAL
CWE: CWE-119
Published: 2018-08-21T19:03:26Z

xpointer.c in libxml2 before 2.9.5 (as used in nokogiri before 1.7.1 amongst other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document.
Vulnerability: GHSA-685w-vc84-wxcx
Summary: Moderate severity vulnerability that affects doorkeeper
Aliases: CVE-2014-8144
Severity: MODERATE
CWE: CWE-352
Published: 2018-09-17T21:55:22Z

Cross-site request forgery (CSRF) vulnerability in doorkeeper before 1.4.1 allows remote attackers to hijack the authentication of unspecified victims for requests that read a user OAuth authorization code via unknown vectors.
Vulnerability: GHSA-5hq2-xf89-9jxq
Summary: Open Redirect in Action Pack
Aliases: CVE-2021-22903
Severity: MODERATE
CWE: CWE-601
Published: 2021-05-05T19:48:29Z

Impact
------
This is similar to CVE-2021-22881. Specially crafted Host headers in
combination with certain "allowed host" formats can cause the Host
Authorization middleware in Action Pack to redirect users to a malicious
website.

Since rails/rails@9bc7ea5, strings in config.hosts that do not have a leading
dot are converted to regular expressions without proper escaping. This causes,
for example, config.hosts << "sub.example.com" to permit a request with a Host
header value of sub-example.com.


Releases
--------
The fixed releases are available at the normal locations.

Workarounds
-----------
The following monkey patch put in an initializer can be used as a workaround.

```ruby
class ActionDispatch::HostAuthorization::Permissions
  def sanitize_string(host)
    if host.start_with?(".")
      /\A(.+\.)?#{Regexp.escape(host[1..-1])}\z/i
    else
      /\A#{Regexp.escape host}\z/i
    end
  end
end
```

Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches for
the two supported release series. They are in git-am format and consist of a
single changeset.

* 6-1-open-redirect.patch - Patch for 6.1 series

Please note that only the 6.1.Z, 6.0.Z, and 5.2.Z series are supported at
present. Users of earlier unsupported releases are advised to upgrade as soon
as possible as we cannot guarantee the continued availability of security
fixes for unsupported releases.

Credits
-------

Thanks Jonathan Hefner (https://hackerone.com/jonathanhefner) for reporting this bug!
Vulnerability: GHSA-hj56-84jw-67h6
Summary: Potential Denial-of-Service in bindata
Aliases: CVE-2021-32823
Severity: LOW
CWE: CWE-400
Published: 2021-06-23T23:42:04Z

In the bindata RubyGem before version 2.4.10 there is a potential denial-of-service vulnerability. In affected versions it is very slow for certain classes in BinData to be created. For example BinData::Bit100000, BinData::Bit100001, BinData::Bit100002, BinData::Bit<N>. In combination with <user_input>.constantize there is a potential for a CPU-based DoS. In version 2.4.10 bindata improved the creation time of Bits and Integers.
Vulnerability: GHSA-864j-6qpp-cmrr
Summary: SQL Injection in Geocoder
Aliases: CVE-2020-7981
Severity: CRITICAL
CWE: CWE-89
Published: 2020-06-10T20:03:02Z

sql.rb in Geocoder before 1.6.1 allows Boolean-based SQL injection when within_bounding_box is used in conjunction with untrusted sw_lat, sw_lng, ne_lat, or ne_lng data.
Vulnerability: GHSA-wwh7-4jw9-33x6
Summary: High severity vulnerability that affects yajl-ruby
Aliases: CVE-2017-16516
Severity: HIGH
CWE: CWE-134
Published: 2017-11-28T22:44:42Z

In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the whole ruby process crashes with a SIGABRT in the yajl_string_decode function in yajl_encode.c. This results in the whole ruby process terminating and potentially a denial of service.
Vulnerability: GHSA-78vq-9j56-wrfr
Summary: Cross-site Scripting in gon
Aliases: CVE-2020-25739
Severity: MODERATE
CWE: CWE-79
Published: 2021-04-30T17:29:15Z

An issue was discovered in the gon gem before gon-6.4.0 for Ruby. MultiJson does not honor the escape_mode parameter to escape fields as an XSS protection mechanism. To mitigate, json_dumper.rb in gon now does escaping for XSS by default without relying on MultiJson.
Vulnerability: GHSA-5r2p-j47h-mhpg
Summary: Moderate severity vulnerability that affects rack
Aliases: CVE-2018-16471
Severity: MODERATE
CWE: CWE-79
Published: 2018-11-15T15:59:08Z

There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the `scheme` method on `Rack::Request`. Applications that expect the scheme to be limited to 'http' or 'https' and do not escape the return value could be vulnerable to an XSS attack. Note that applications using the normal escaping mechanisms provided by Rails may not impacted, but applications that bypass the escaping mechanisms, or do not use them may be vulnerable.
Vulnerability: GHSA-j5hj-fhc9-g24m
Summary: Moderate severity vulnerability that affects rack-mini-profiler
Aliases: CVE-2016-4442
Severity: MODERATE
CWE: CWE-200
Published: 2017-10-24T18:33:35Z

The rack-mini-profiler gem before 0.10.1 for Ruby allows remote attackers to obtain sensitive information about allocated strings and objects by leveraging incorrect ordering of security checks.
Vulnerability: GHSA-5vx5-9q73-wgp4
Summary: High severity vulnerability that affects safemode
Aliases: CVE-2017-7540
Severity: HIGH
CWE: CWE-184
Published: 2017-10-24T18:33:35Z

rubygem-safemode, as used in Foreman, versions 1.3.1 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax. This can lead to deletion of objects for which the user does not have delete permissions or possibly to privilege escalation.
Vulnerability: GHSA-8jxj-9r5f-w3m2
Summary: Low severity vulnerability that affects puppet
Aliases: CVE-2012-3866
Severity: LOW
Published: 2017-10-24T18:33:37Z

lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for last_run_report.yaml, which allows local users to obtain sensitive configuration information by leveraging access to the puppet master server to read this file.
Vulnerability: GHSA-cr5j-953j-xw5p
Summary: Arbitrary execution of code in Nokogiri
Aliases: CVE-2019-5477
Severity: HIGH
CWE: CWE-78
Published: 2019-08-19T19:27:23Z

A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input as the filename. This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.
Vulnerability: GHSA-ww4x-rwq6-qpgf
Summary: Cross-site Request Forgery in OmniAuth
Aliases: CVE-2015-9284
Severity: HIGH
CWE: CWE-352
Published: 2019-05-29T19:11:31Z

The request phase of the OmniAuth Ruby gem is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, allowing accounts to be connected without user intent, user interaction, or feedback to the user. This permits a secondary account to be able to sign into the web application as the primary account.

There is currently no fixed version of this package, however there is a recommended remediation described [here](https://github.com/omniauth/omniauth/wiki/Resolving-CVE-2015-9284).
Vulnerability: GHSA-8fqx-7pv4-3jwm
Summary: Moderate severity vulnerability that affects rails
Aliases: CVE-2008-7248
Severity: MODERATE
CWE: CWE-20
Published: 2017-10-24T18:33:38Z

Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery (CSRF) protection for requests to applications that rely on this protection, as demonstrated using text/plain.
Vulnerability: GHSA-4f68-49qq-h392
Summary: Improper certificate validation in em-map
Aliases: CVE-2020-13163
Severity: MODERATE
CWE: CWE-295
Published: 2021-05-24T18:12:20Z

em-imap 0.5 and earlier use the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The hostname in a TLS server certificate is not verified.
Vulnerability: GHSA-69p3-xp37-f692
Summary: Improper Certificate Validation in kubeclient
Aliases: CVE-2022-0759
Severity: HIGH
CWE: CWE-295
Published: 2022-03-26T00:00:29Z

A flaw was found in all versions of kubeclient up to (but not including) v4.9.3, the Ruby client for Kubernetes REST API, in the way it parsed kubeconfig files. When the kubeconfig file does not configure custom CA to verify certs, kubeclient ends up accepting any certificate (it wrongly returns VERIFY_NONE). Ruby applications that leverage kubeclient to parse kubeconfig files are susceptible to Man-in-the-middle attacks (MITM).
Vulnerability: GHSA-h29f-7f56-j8wh
Summary: Moderate severity vulnerability that affects sinatra
Aliases: CVE-2018-7212
Severity: MODERATE
CWE: CWE-22
Published: 2018-02-20T19:23:20Z

An issue was discovered in rack-protection/lib/rack/protection/path_traversal.rb in Sinatra 2.x before 2.0.1 on Windows. Path traversal is possible via backslash characters.
Vulnerability: GHSA-4g4c-8gqh-m4vm
Summary: Inclusion of Functionality from Untrusted Control Sphere in Ruby
Aliases: CVE-2019-13589
Severity: CRITICAL
CWE: CWE-829
Published: 2019-07-16T00:41:55Z

The paranoid2 gem 1.1.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1.1.5.
Vulnerability: GHSA-p692-7mm3-3fxg
Summary: actionpack is vulnerable to remote bypass authentication
Aliases: CVE-2015-7576
Severity: LOW
Published: 2017-10-24T18:33:36Z

The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to bypass authentication by measuring timing differences.
Vulnerability: GHSA-rvpq-5xqx-pfpp
Summary: High severity vulnerability that affects rails
Aliases: CVE-2006-4111
Severity: HIGH
CWE: CWE-94
Published: 2017-10-24T18:33:38Z

Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with "severe" or "serious" impact via a File Upload request with an HTTP header that modifies the LOAD_PATH variable, a different vulnerability than CVE-2006-4112.
Vulnerability: GHSA-2gw2-8q9w-cw8p
Summary: Ruby-ffi has a DLL loading issue 
Aliases: CVE-2018-1000201
Severity: HIGH
CWE: CWE-426
Published: 2018-08-31T14:55:43Z

ruby-ffi version 1.9.23 and earlier has a DLL loading issue which can be hijacked on Windows OS, when a Symbol is used as DLL name instead of a String This vulnerability appears to have been fixed in v1.9.24 and later.
Vulnerability: GHSA-j6w9-fv6q-3q52
Summary: Percent-encoded cookies can be used to overwrite existing prefixed cookie names
Aliases: CVE-2020-8184
Severity: HIGH
CWE: CWE-784
Published: 2020-06-24T17:15:00Z

A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it is possible for an attacker to forge a secure or host-only cookie prefix.
Vulnerability: GHSA-6x46-7rrv-m4h8
Summary: Low severity vulnerability that affects sqlite3-ruby
Aliases: CVE-2011-0995
Severity: LOW
Published: 2017-10-24T18:33:38Z

The sqlite3-ruby gem in the rubygem-sqlite3 package before 1.2.4-0.5.1 in SUSE Linux Enterprise (SLE) 11 SP1 uses weak permissions for unspecified files, which allows local users to gain privileges via unknown vectors.
Vulnerability: GHSA-mh37-8c3g-3fgc
Summary: Escape sequence injection in RubyGems
Aliases: CVE-2019-8322
Severity: HIGH
Published: 2019-06-20T16:06:00Z

An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur.
Vulnerability: GHSA-jwhv-rgqc-fqj5
Summary: Moderate severity vulnerability that affects rails
Aliases: CVE-2007-5380
Severity: MODERATE
CWE: CWE-384
Published: 2017-10-24T18:33:38Z

Session fixation vulnerability in Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers to hijack web sessions via unspecified vectors related to "URL-based sessions."
Vulnerability: GHSA-gwrj-88fp-5m36
Summary: Code injection in Narou
Aliases: CVE-2021-35514
Severity: HIGH
CWE: CWE-94
Published: 2021-07-02T18:36:01Z

Narou (aka Narou.rb) before 3.8.0 allows Ruby Code Injection via the title name or author name of a novel.
Vulnerability: GHSA-4936-rj25-6wm6
Summary: High severity vulnerability that affects nori
Aliases: CVE-2013-0285
Severity: HIGH
CWE: CWE-20
Published: 2017-10-24T18:33:37Z

The nori gem 2.0.x before 2.0.2, 1.1.x before 1.1.4, and 1.0.x before 1.0.3 for Ruby does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
Vulnerability: GHSA-c6qr-h5vq-59jc
Summary: Untrusted users can run pending migrations in production in Rails
Aliases: CVE-2020-8185
Severity: MODERATE
CWE: CWE-400
Published: 2020-06-24T17:40:33Z

There is a vulnerability in versions of Rails prior to 6.0.3.2 that allowed
an untrusted user to run any pending migrations on a Rails app running in
production.

This vulnerability has been assigned the CVE identifier CVE-2020-8185.

Versions Affected:  6.0.0 < rails < 6.0.3.2
Not affected:       Applications with `config.action_dispatch.show_exceptions = false` (this is not a default setting in production)
Fixed Versions:     rails >= 6.0.3.2

Impact
------

Using this issue, an attacker would be able to execute any migrations that
are pending for a Rails app running in production mode. It is important to
note that an attacker is limited to running migrations the application
developer has already defined in their application and ones that have not
already ran.

Workarounds
-----------

Until such time as the patch can be applied, application developers should
disable the ActionDispatch middleware in their production environment via
a line such as this one in their config/environment/production.rb:

`config.middleware.delete ActionDispatch::ActionableExceptions`
Vulnerability: GHSA-p4x4-rw2p-8j8m
Summary: Cross-site Scripting in Sanitize 
Aliases: CVE-2020-4054
Severity: HIGH
CWE: CWE-79
Published: 2020-06-16T22:08:06Z

When HTML is sanitized using Sanitize's "relaxed" config or a custom config that allows certain elements, some content in a `<math>` or `<svg>` element may not be sanitized correctly even if `math` and `svg` are not in the allowlist.

You are likely to be vulnerable to this issue if you use Sanitize's relaxed config or a custom config that allows one or more of the following HTML elements:

- `iframe`
- `math`
- `noembed`
- `noframes`
- `noscript`
- `plaintext`
- `script`
- `style`
- `svg`
- `xmp`

### Impact

Using carefully crafted input, an attacker may be able to sneak arbitrary HTML through Sanitize, potentially resulting in XSS (cross-site scripting) or other undesired behavior when that HTML is rendered in a browser.

### Releases

This problem has been fixed in Sanitize 5.2.1.

### Workarounds

If upgrading is not possible, a workaround is to override the default value of Sanitize's `:remove_contents` config option with the following value, which ensures that the contents of `math` and `svg` elements (among others) are removed entirely when those elements are not in the allowlist:

```ruby
%w[iframe math noembed noframes noscript plaintext script style svg xmp]
```

For example, if you currently use Sanitize's relaxed config, you can create a custom config object that overrides the default value of `:remove_contents` like this:

```ruby
custom_config = Sanitize::Config.merge(
  Sanitize::Config::RELAXED,
  :remove_contents => %w[iframe math noembed noframes noscript plaintext script style svg xmp]
)
```

You would then pass this custom config to Sanitize when sanitizing HTML.

### For more information

If you have any questions or comments about this advisory:

- Open an issue in the [Sanitize repo](https://github.com/rgrove/sanitize).
- See Sanitize's [security policy](https://github.com/rgrove/sanitize/security/policy).

### Credits

Many thanks to Michal Bentkowski of Securitum for reporting this bug and helping to verify the fix.

### References

- [GHSA-p4x4-rw2p-8j8m](https://github.com/rgrove/sanitize/security/advisories/GHSA-p4x4-rw2p-8j8m)
- [CVE-2020-4054](https://nvd.nist.gov/vuln/detail/CVE-2020-4054)
- https://github.com/rgrove/sanitize/releases/tag/v5.2.1
Vulnerability: GHSA-rprj-g6xc-p5gq
Summary: Moderate severity vulnerability that affects wicked
Aliases: CVE-2013-4413
Severity: MODERATE
CWE: CWE-22
Published: 2017-10-24T18:33:37Z

Directory traversal vulnerability in controller/concerns/render_redirect.rb in the Wicked gem before 1.0.1 for Ruby allows remote attackers to read arbitrary files via a %2E%2E%2F (encoded dot dot slash) in the step.
Vulnerability: GHSA-wg9m-gw3h-hg83
Summary: Injection in field_test
Aliases: CVE-2019-13146
Severity: MODERATE
CWE: CWE-74
Published: 2019-07-16T00:42:27Z

The field_test gem 0.3.0 for Ruby has unvalidated input. A method call that is expected to return a value from a certain set of inputs can be made to return any input, which can be dangerous depending on how applications use it. If an application treats arbitrary variants as trusted, this can lead to a variety of potential vulnerabilities like SQL injection or cross-site scripting (XSS).
Vulnerability: GHSA-qphc-hf5q-v8fc
Summary: Open Redirect in actionpack
Aliases: CVE-2021-44528
Severity: MODERATE
CWE: CWE-601
Published: 2021-12-14T21:19:08Z

Specially crafted "X-Forwarded-Host" headers in combination with certain
"allowed host" formats can cause the Host Authorization middleware in Action
Pack to redirect users to a malicious website.

Impacted applications will have allowed hosts with a leading dot. For example,
configuration files that look like this:

```
config.hosts <<  '.EXAMPLE.com'
```

When an allowed host contains a leading dot, a specially crafted Host header
can be used to redirect to a malicious website.

This vulnerability is similar to CVE-2021-22881 and CVE-2021-22942.

Releases
--------
The fixed releases are available at the normal locations.

Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches for
the two supported release series. They are in git-am format and consist of a
single changeset.

* 6-0-host-authorzation-open-redirect.patch - Patch for 6.0 series
* 6-1-host-authorzation-open-redirect.patch - Patch for 6.1 series
* 7-0-host-authorzation-open-redirect.patch - Patch for 7.0 series

Please note that only the 6.1.Z, 6.0.Z, and 5.2.Z series are supported at
present. Users of earlier unsupported releases are advised to upgrade as soon
as possible as we cannot guarantee the continued availability of security
fixes for unsupported releases.
Vulnerability: GHSA-hgmw-x865-hf9x
Summary: High severity vulnerability that affects arabic-prawn
Aliases: CVE-2014-2322
Severity: HIGH
Published: 2017-10-24T18:33:36Z

lib/string_utf_support.rb in the Arabic Prawn 0.0.1 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) downloaded_file or (2) url variable.
Vulnerability: GHSA-r5hc-9xx5-97rw
Summary: Moderate severity vulnerability that affects i18n
Aliases: CVE-2013-4492
Severity: MODERATE
CWE: CWE-79
Published: 2017-10-24T18:33:37Z

Cross-site scripting (XSS) vulnerability in exceptions.rb in the i18n gem before 0.6.6 for Ruby allows remote attackers to inject arbitrary web script or HTML via a crafted I18n::MissingTranslationData.new call.
Vulnerability: GHSA-j858-xp5v-f8xx
Summary: Remote code execution in Dragonfly
Aliases: CVE-2021-33564
Severity: CRITICAL
CWE: CWE-94, CWE-88
Published: 2021-06-02T21:42:49Z

An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL when the verify_url option is disabled. This may lead to code execution. The problem occurs because the generate and process features mishandle use of the ImageMagick convert utility.
Vulnerability: GHSA-844m-cpr9-jcmh
Summary: Secure/signed cookies share secrets between sites in a multi-site application
Aliases: CVE-2021-41263
Severity: MODERATE
CWE: CWE-200, CWE-565
Published: 2021-11-15T17:54:01Z

### Impact
This vulnerability impacts any Rails applications using `rails_multisite` alongside Rails' signed/encrypted cookies. Depending on how the application makes use of these cookies, it may be possible for an attacker to re-use cookies on different 'sites' within a multi-site Rails application.

### Patches
The issue has been patched in v4 of the `rails_multisite` gem. Note that this upgrade will invalidate all previous signed/encrypted cookies. The impact of this invalidation will vary based on the application architecture.
Vulnerability: GHSA-25f5-gc4h-hc22
Summary: Improper Privilege Management in devise_masquerade
Aliases: CVE-2021-28680
Severity: HIGH
CWE: CWE-269
Published: 2021-12-08T19:55:30Z

The devise_masquerade gem before 1.3 allows certain attacks when a password's salt is unknown. An application that uses this gem to let administrators masquerade/impersonate users loses one layer of security protection compared to a situation where Devise (without this extension) is used. If the server-side secret_key_base value became publicly known (for instance if it is committed to a public repository by mistake), there are still other protections in place that prevent an attacker from impersonating any user on the site. When masquerading is not used in a plain Devise application, one must know the password salt of the target user if one wants to encrypt and sign a valid session cookie. When devise_masquerade is used, however, an attacker can decide which user the "back" action will go back to without knowing that user's password salt and simply knowing the user ID, by manipulating the session cookie and pretending that a user is already masqueraded by an administrator.
Vulnerability: GHSA-5v3f-73gv-x7x5
Summary: cairo is vulnerable to denial of service due to a null pointer dereference
Aliases: CVE-2017-7475
Severity: MODERATE
CWE: CWE-476
Published: 2017-11-15T20:41:14Z

Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash.
Vulnerability: GHSA-9h6g-gp95-x3q5
Summary: actionpack is vulnerable to denial of service because of a wildcard controller route
Aliases: CVE-2015-7581
Severity: HIGH
Published: 2017-10-24T18:33:36Z

actionpack/lib/action_dispatch/routing/route_set.rb in Action Pack in Ruby on Rails 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows remote attackers to cause a denial of service (superfluous caching and memory consumption) by leveraging an application's use of a wildcard controller route.
Vulnerability: GHSA-5pm8-492c-92p5
Summary: Prototype Pollution in chartkick
Aliases: CVE-2019-18841
Severity: HIGH
Published: 2019-12-02T18:04:11Z

Affected versions of `@polymer/polymer` are vulnerable to prototype pollution. The package fails to prevent modification of object prototypes through chart options containing a payload such as `{"__proto__": {"polluted": true}}`. It is possible to achieve the same results if a chart loads data from a malicious server.


## Recommendation

Upgrade to version 3.2.0 or later.
Vulnerability: GHSA-699m-mcjm-9cw8
Summary: Moderate severity vulnerability that affects actionpack
Aliases: CVE-2013-4491
Severity: MODERATE
CWE: CWE-79
Published: 2017-10-24T18:33:37Z

Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/translation_helper.rb in the internationalization component in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted string that triggers generation of a fallback string by the i18n gem.
Vulnerability: GHSA-r7j3-vvh2-xrpj
Summary: OS Command Injection in MiniMagick
Aliases: CVE-2019-13574
Severity: HIGH
CWE: CWE-78
Published: 2019-07-18T13:19:22Z

In lib/mini_magick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because Image.open input is directly passed to Kernel#open, which accepts a '|' character followed by a command.
Vulnerability: GHSA-534w-937m-v7x3
Summary: High severity vulnerability that affects restforce
Aliases: CVE-2018-3777
Severity: HIGH
CWE: CWE-20
Published: 2018-08-03T21:04:02Z

A flaw in how restforce constructs URLs may allow an attacker to inject additional parameters into Salesforce API requests.   

Impact
------
This flaw is only exploitable in applications that pass user input directly to restforce's select, find, describe, update, upsert, and destroy methods.

Vulnerable code might look like:
```ruby
  client.select('SomeSalesForceObject', params[:some-id],
     ...)
```

In such an application, attackers could pass `0016000000MRatd/describe`  as a request parameter, causing the server to make a request to a different endpoint than the server is designed to handle. Since the Salesforce REST API supports overriding HTTP methods via a request parameter, an attacker could also cause the client's `select()` method to modify data, by passing `0016000000MRatd/?_HttpMethod=PATCH&other-query-params=...`.

Workarounds
------
If possible, applications should track salesforce IDs internally, rather than passing user-supplied IDs to salesforce. Such practice mitigates this vulnerability, and in general is desirable for ensuring strong access control.
Vulnerability: GHSA-x7p2-x2j6-mwhr
Summary: Moderate severity vulnerability that affects gemirro
Aliases: CVE-2017-16833
Severity: MODERATE
CWE: CWE-79
Published: 2017-11-29T23:19:51Z

Stored cross-site scripting (XSS) vulnerability in Gemirro before 0.16.0 allows attackers to inject arbitrary web script via a crafted javascript: URL in the "homepage" value of a ".gemspec" file.
Vulnerability: GHSA-76wq-xw4h-f8wj
Summary: High severity vulnerability that affects activerecord
Aliases: CVE-2012-2695
Severity: HIGH
CWE: CWE-89
Published: 2017-10-24T18:33:38Z

The Active Record component in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage improper handling of nested hashes, a related issue to CVE-2012-2661.
Vulnerability: GHSA-73qw-ww62-m54x
Summary: Critical severity vulnerability that affects colorscore
Aliases: CVE-2015-7541
Severity: CRITICAL
CWE: CWE-77
Published: 2017-10-24T18:33:36Z

The initialize method in the Histogram class in lib/colorscore/histogram.rb in the colorscore gem before 0.0.5 for Ruby allows context-dependent attackers to execute arbitrary code via shell metacharacters in the (1) image_path, (2) colors, or (3) depth variable.
Vulnerability: GHSA-jmm9-2p29-vh2w
Summary: High severity vulnerability that affects activerecord
Aliases: CVE-2011-0448
Severity: HIGH
CWE: CWE-89
Published: 2017-10-24T18:33:38Z

Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit function specify integer values, which makes it easier for remote attackers to conduct SQL injection attacks via a non-numeric argument.
Vulnerability: GHSA-2xjj-5x6h-8vmf
Summary: Moderate severity vulnerability that affects actionpack
Aliases: CVE-2012-1099
Severity: MODERATE
CWE: CWE-79
Published: 2017-10-24T18:33:38Z

Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_options_helper.rb in the select helper in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving certain generation of OPTION elements within SELECT elements.
Vulnerability: GHSA-pchc-949f-53m5
Summary: High severity vulnerability that affects multi_xml
Aliases: CVE-2013-0175
Severity: HIGH
CWE: CWE-20
Published: 2017-10-24T18:33:37Z

multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
Vulnerability: GHSA-vxvp-4xwc-jpp6
Summary: Moderate severity vulnerability that affects activesupport
Aliases: CVE-2015-3226
Severity: MODERATE
CWE: CWE-79
Published: 2017-10-24T18:33:36Z

Cross-site scripting (XSS) vulnerability in json/encoding.rb in Active Support in Ruby on Rails 3.x and 4.1.x before 4.1.11 and 4.2.x before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted Hash that is mishandled during JSON encoding.
Vulnerability: GHSA-fh39-v733-mxfr
Summary: Moderate severity vulnerability that affects activerecord
Aliases: CVE-2012-2661
Severity: MODERATE
CWE: CWE-89
Published: 2017-10-24T18:33:38Z

The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage unintended recursion, a related issue to CVE-2012-2695.
Vulnerability: GHSA-5m2v-hc64-56h6
Summary: A crafted ZIP file can cause a denial of service in Rubyzip
Aliases: CVE-2019-16892
Severity: MODERATE
CWE: CWE-400
Published: 2019-09-30T16:05:32Z

In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption).
Vulnerability: GHSA-q3wr-qw3g-3p4h
Summary: Injection/XSS in Redcarpet
Aliases: CVE-2020-26298
Severity: MODERATE
CWE: CWE-79
Published: 2021-01-11T19:06:10Z

Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the `:escape_html` option was being used.  This is fixed in version 3.5.1 by the referenced commit.
Vulnerability: GHSA-26xx-m4q2-xhq8
Summary: Authentication Bypass by CSRF Weakness
Aliases: CVE-2021-41275
Severity: CRITICAL
CWE: CWE-352
Published: 2021-11-18T20:14:19Z

### Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of `spree_auth_devise` are affected if `protect_from_forgery` method is both:

* Executed whether as:
  * A before_action callback (the default)
  * A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
* Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏 

### Patches

Spree 4.3 users should update to spree_auth_devise 4.4.1
Spree 4.2 users should update to spree_auth_devise 4.2.1
Spree 4.1 users should update to spree_auth_devise 4.1.1
Older Spree version users should update to spree_auth_devise 4.0.1
 
### Workarounds

If possible, change your strategy to :exception:

```ruby
class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end
```

Add the following to`config/application.rb `to at least run the `:exception` strategy on the affected controller:

```ruby
config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end
```

### References
https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2
Vulnerability: GHSA-g4xq-jx4w-4cjv
Summary: Moderate severity vulnerability that affects loofah
Aliases: CVE-2018-16468
Severity: MODERATE
CWE: CWE-79
Published: 2018-11-01T14:46:01Z

In the Loofah gem for Ruby, through version 2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished. Users are advised to upgrade to version 2.2.3.

See https://github.com/flavorjones/loofah/issues/154 for more details.
Vulnerability: GHSA-9h36-4jf2-hx53
Summary: High severity vulnerability that affects extlib
Aliases: CVE-2013-1802
Severity: HIGH
Published: 2017-10-24T18:33:37Z

The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
Vulnerability: GHSA-gjxw-5w2q-7grf
Summary: Moderate severity vulnerability that affects rails
Aliases: CVE-2010-3933
Severity: MODERATE
CWE: CWE-20
Published: 2017-10-24T18:33:38Z

Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs.
Vulnerability: GHSA-j24p-r6wx-r79w
Summary: High severity vulnerability that affects thin
Aliases: CVE-2009-3287
Severity: HIGH
CWE: CWE-20
Published: 2017-10-24T18:33:38Z

lib/thin/connection.rb in Thin web server before 1.2.4 relies on the X-Forwarded-For header to determine the IP address of the client, which allows remote attackers to spoof the IP address and hide activities via a modified X-Forwarded-For header.
Vulnerability: GHSA-x7jg-6pwg-fx5h
Summary: HTTP Smuggling via Transfer-Encoding Header in Puma
Aliases: CVE-2020-11076
Severity: HIGH
CWE: CWE-444
Published: 2020-05-22T14:55:05Z

### Impact

By using an invalid transfer-encoding header, an attacker could [smuggle an HTTP response.](https://portswigger.net/web-security/request-smuggling)

Originally reported by @ZeddYu, who has our thanks for the detailed report.

### Patches

The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [Puma](https://github.com/puma/puma)
* See our [security policy](https://github.com/puma/puma/security/policy)
Vulnerability: GHSA-jphg-qwrw-7w9g
Summary: Unsafe object creation in json RubyGem
Aliases: CVE-2020-10663
Severity: HIGH
CWE: CWE-20
Published: 2020-07-27T18:08:21Z

The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269/GHSA-x457-cw4h-hq5f, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.
Vulnerability: GHSA-vqqv-v9m2-48p2
Summary: Critical severity vulnerability that affects bootstrap-sass
Aliases: CVE-2019-10842
Severity: CRITICAL
CWE: CWE-94
Published: 2019-04-04T16:28:47Z

Arbitrary code execution (via backdoor code) was discovered in bootstrap-sass 3.2.0.3, when downloaded from rubygems.org. An unauthenticated attacker can craft the ___cfduid cookie value with base64 arbitrary code to be executed via eval(), which can be leveraged to execute arbitrary code on the target system. Note that there are three underscore characters in the cookie name. This is unrelated to the __cfduid cookie that is legitimately used by Cloudflare.
Vulnerability: GHSA-qp49-3pvw-x4m5
Summary: sinatra does not validate expanded path matches
Aliases: CVE-2022-29970
Severity: MODERATE
CWE: CWE-426
Published: 2022-05-03T00:00:43Z

Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.
Vulnerability: GHSA-hwhh-2fwm-cfgw
Summary: Doorkeeper is vulnerable to stored XSS and code execution
Aliases: CVE-2018-1000088
Severity: MODERATE
CWE: CWE-79
Published: 2018-03-13T20:44:48Z

Doorkeeper version 2.1.0 through 4.2.5 contains a Cross Site Scripting (XSS) vulnerability in web view's OAuth app form, user authorization prompt web view that can result in Stored XSS on the OAuth Client's name will cause users interacting with it will execute payload. This attack appear to be exploitable via The victim must be tricked to click an opaque link to the web view that runs the XSS payload. A malicious version virtually indistinguishable from a normal link. This vulnerability appears to have been fixed in 4.2.6, 4.3.0.
Vulnerability: GHSA-v6fx-752r-ccp2
Summary: CSRF on PgHero gem
Aliases: CVE-2020-16253
Severity: HIGH
CWE: CWE-352
Published: 2020-08-05T14:53:43Z

The PgHero gem through 2.6.0 for Ruby allows CSRF.
Vulnerability: GHSA-xjqg-9jvg-fgx2
Summary: High severity vulnerability that affects nokogiri
Aliases: CVE-2015-5312
Severity: HIGH
Published: 2018-08-21T19:03:04Z

The xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.3 (as used in nokogiri before 1.6.7.1) does not properly prevent entity expansion, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data, a different vulnerability than CVE-2014-3660.
Vulnerability: GHSA-76wm-422q-92mq
Summary: Code injection in RubyGems
Aliases: CVE-2019-8324
Severity: HIGH
CWE: CWE-94
Published: 2019-06-20T16:06:11Z

An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could inject arbitrary code to the stub line of gemspec, which is eval-ed by code in ensure_loadable_spec during the preinstall check.
Vulnerability: GHSA-7hp2-xwpj-95jq
Summary: Nokogiri, dict.c in libxml2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash)
Aliases: CVE-2015-8806
Severity: HIGH
CWE: CWE-125
Published: 2018-09-17T21:53:42Z

dict.c in libxml2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via an unexpected character immediately after the "<!DOCTYPE html" substring in a crafted HTML document.
Vulnerability: GHSA-h6w6-xmqv-7q78
Summary: High severity vulnerability that affects activerecord
Aliases: CVE-2011-2930
Severity: HIGH
CWE: CWE-89
Published: 2017-10-24T18:33:38Z

Multiple SQL injection vulnerabilities in the quote_table_name method in the ActiveRecord adapters in activerecord/lib/active_record/connection_adapters/ in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allow remote attackers to execute arbitrary SQL commands via a crafted column name.
Vulnerability: GHSA-fxwv-953p-7qpf
Summary: Phusion Passenger allows remote attackers to spoof headers passed to applications by using an _ (underscore) character instead of a - (dash) character in an HTTP header
Aliases: CVE-2015-7519
Severity: LOW
CWE: CWE-20
Published: 2018-10-10T17:29:13Z

agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to applications by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X_User header.
Vulnerability: GHSA-8r6h-7x9g-xmw9
Summary: Moderate severity vulnerability that affects will_paginate
Aliases: CVE-2013-6459
Severity: MODERATE
CWE: CWE-79
Published: 2017-10-24T18:33:36Z

Cross-site scripting (XSS) vulnerability in the will_paginate gem before 3.0.5 for Ruby allows remote attackers to inject arbitrary web script or HTML via vectors involving generated pagination links.