TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-jj47-x69x-mxrm
Summary: Buffer Overflow in yajl-ruby
Aliases: CVE-2022-24795
Severity: MODERATE
CWE: CWE-190, CWE-122
Published: 2022-04-05T15:55:51Z

yajl-ruby is a streaming JSON parsing and encoding library for Ruby (C bindings to yajl) based on the YAJL library.
The 1.x branch and the 2.x branch of [yajl](https://github.com/lloyd/yajl) contain an integer overflow which leads to subsequent heap memory corruption when dealing with large (~2GB) inputs.

### Details

The [reallocation logic at yajl_buf.c#L64](https://github.com/brianmario/yajl-ruby/blob/7168bd79b888900aa94523301126f968a93eb3a6/ext/yajl/yajl_buf.c#L64) may result in the `need` 32bit integer wrapping to 0 when `need` approaches a value of 0x80000000 (i.e. ~2GB of data), which results in a reallocation of buf->alloc into a small heap chunk.

These integers are declared as `size_t` in the 2.x branch of `yajl`, which practically prevents the issue from triggering on 64bit platforms, however this does not preclude this issue triggering on 32bit builds on which `size_t` is a 32bit integer.

Subsequent population of this under-allocated heap chunk is based on the original buffer size, leading to heap memory corruption.

### Impact

We rate this as a moderate severity vulnerability which mostly impacts process availability as we believe exploitation for arbitrary code execution to be unlikely.

### Patches

Patched in yajl-ruby 1.4.2

### Workarounds

Avoid passing large inputs to YAJL

### References
https://github.com/brianmario/yajl-ruby/blob/7168bd79b888900aa94523301126f968a93eb3a6/ext/yajl/yajl_buf.c#L64

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [yajl-ruby](https://github.com/brianmario/yajl-ruby/issues)
Vulnerability: GHSA-w37c-q653-qg95
Summary: Moderate severity vulnerability that affects actionpack
Aliases: CVE-2013-6416
Severity: MODERATE
CWE: CWE-79
Published: 2017-10-24T18:33:36Z

Cross-site scripting (XSS) vulnerability in the simple_format helper in actionpack/lib/action_view/helpers/text_helper.rb in Ruby on Rails 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML attribute.
Vulnerability: GHSA-2rqw-v265-jf8c
Summary: Open Redirect in ActionPack
Aliases: CVE-2021-22942
Severity: HIGH
CWE: CWE-601
Published: 2021-08-26T20:36:51Z

# Overview

There is a possible open redirect vulnerability in the Host Authorization
middleware in Action Pack. This vulnerability has been assigned the CVE
identifier CVE-2021-22942.

Versions Affected: >= 6.0.0.
Not affected: < 6.0.0
Fixed Versions: 6.1.4.1, 6.0.4.1

# Impact

Specially crafted “X-Forwarded-Host” headers in combination with certain
“allowed host” formats can cause the Host Authorization middleware in
Action Pack to redirect users to a malicious website.

Impacted applications will have allowed hosts with a leading dot.
For example, configuration files that look like this:

```ruby
config.hosts <<  '.EXAMPLE.com'
```

When an allowed host contains a leading dot, a specially crafted
Host header can be used to redirect to a malicious website.

This vulnerability is similar to CVE-2021-22881, but CVE-2021-22881 did not
take in to account domain name case sensitivity.

# Releases

The fixed releases are available at the normal locations.

# Workarounds

In the case a patch can’t be applied, the following monkey patch can be
used in an initializer:

```ruby
module ActionDispatch
  class HostAuthorization
    HOSTNAME = /[a-z0-9.-]+|\[[a-f0-9]*:[a-f0-9.:]+\]/i
    VALID_ORIGIN_HOST = /\A(#{HOSTNAME})(?::\d+)?\z/
    VALID_FORWARDED_HOST = /(?:\A|,[ ]?)(#{HOSTNAME})(?::\d+)?\z/

    private
      def authorized?(request)
        origin_host =
          request.get_header("HTTP_HOST")&.slice(VALID_ORIGIN_HOST, 1) || ""
        forwarded_host =
          request.x_forwarded_host&.slice(VALID_FORWARDED_HOST, 1) || ""
        @permissions.allows?(origin_host) &&
          (forwarded_host.blank? || @permissions.allows?(forwarded_host))
      end
  end
end
```
Vulnerability: GHSA-c3gv-9cxf-6f57
Summary: Cross-site Scripting in Loofah
Aliases: CVE-2019-15587
Severity: LOW
CWE: CWE-79
Published: 2019-11-05T23:58:25Z

In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.
Vulnerability: GHSA-v5jg-558j-q67c
Summary: Moderate severity vulnerability that affects actionpack
Aliases: CVE-2011-2931
Severity: MODERATE
CWE: CWE-79
Published: 2017-10-24T18:33:38Z

Cross-site scripting (XSS) vulnerability in the strip_tags helper in actionpack/lib/action_controller/vendor/html-scanner/html/node.rb in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a tag with an invalid name.
Vulnerability: GHSA-jmgf-p46x-982h
Summary: Moderate severity vulnerability that affects rails
Aliases: CVE-2008-5189
Severity: MODERATE
CWE: CWE-352
Published: 2017-10-24T18:33:38Z

CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL to the redirect_to function.
Vulnerability: GHSA-pxr8-w3jq-rcwj
Summary: Moderate severity vulnerability that affects rails_admin
Aliases: CVE-2017-12098
Severity: MODERATE
CWE: CWE-79
Published: 2018-03-05T19:37:23Z

An exploitable cross site scripting (XSS) vulnerability exists in the add filter functionality of the rails_admin rails gem version 1.2.0. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim's browser. An attacker can phish an authenticated user to trigger this vulnerability.
Vulnerability: GHSA-9fh3-vh3h-q4g3
Summary: Moderate severity vulnerability that affects activesupport
Aliases: CVE-2011-2932
Severity: MODERATE
CWE: CWE-79
Published: 2017-10-24T18:33:38Z

Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails 2.x before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a malformed Unicode string, related to a "UTF-8 escaping vulnerability."
Vulnerability: GHSA-x457-cw4h-hq5f
Summary: High severity vulnerability that affects json
Aliases: CVE-2013-0269
Severity: HIGH
CWE: CWE-20
Published: 2017-10-24T18:33:37Z

The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."
Vulnerability: GHSA-r8fh-hq2p-7qhq
Summary: High severity vulnerability that affects activerecord
Aliases: CVE-2014-3483
Severity: HIGH
CWE: CWE-89
Published: 2017-10-24T18:33:36Z

SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting.
Vulnerability: GHSA-jppv-gw3r-w3q8
Summary: OS Command Injection in Rake
Aliases: CVE-2020-8130
Severity: MODERATE
CWE: CWE-78
Published: 2020-02-28T16:54:36Z

There is an OS command injection vulnerability in Ruby Rake before 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character `|`.
Vulnerability: GHSA-mgx3-27hr-mfgp
Summary: High severity vulnerability that affects httparty
Aliases: CVE-2013-1801
Severity: HIGH
Published: 2017-10-24T18:33:37Z

The httparty gem 0.9.0 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for YAML type conversion, a similar vulnerability to CVE-2013-0156.
Vulnerability: GHSA-cff7-6h4q-q5pj
Summary: Lacked element count during splitting of JWE string
Aliases: CVE-2019-18848
Severity: HIGH
CWE: CWE-20, CWE-287
Published: 2019-11-14T15:25:51Z

The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string.
Vulnerability: GHSA-959j-5g9v-3fpq
Summary: Low severity vulnerability that affects paratrooper-newrelic
Aliases: CVE-2014-1234
Severity: LOW
CWE: CWE-200
Published: 2017-10-24T18:33:36Z

The paratrooper-newrelic gem 1.0.1 for Ruby allows local users to obtain the X-Api-Key value by listing the curl process.
Vulnerability: GHSA-85r7-w5mv-c849
Summary: Moderate severity vulnerability that affects rack
Aliases: CVE-2013-0262
Severity: MODERATE
CWE: CWE-22
Published: 2017-10-24T18:33:37Z

rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."
Vulnerability: GHSA-wh98-p28r-vrc9
Summary: Exposure of information in Action Pack
Aliases: CVE-2022-23633
Severity: HIGH
CWE: CWE-200
Published: 2022-02-11T20:49:14Z

### Impact

Under certain circumstances response bodies will not be closed, for example a [bug in a webserver](https://github.com/puma/puma/pull/2812) or a bug in a Rack middleware.  In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request.  This can lead to data being leaked to subsequent requests, especially when interacting with `ActiveSupport::CurrentAttributes`.

Upgrading to the FIXED versions of Rails will ensure mitigation of this issue even in the context of a buggy webserver or middleware implementation.

### Patches

This has been fixed in Rails 7.0.2.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2.

### Workarounds

Upgrading is highly recommended, but to work around this problem the following middleware can be used:

```ruby
class GuardedExecutor < ActionDispatch::Executor
  def call(env)
    ensure_completed!
    super
  end

  private

    def ensure_completed!
      @executor.new.complete! if @executor.active?
    end
end

# Ensure the guard is inserted before ActionDispatch::Executor
Rails.application.configure do
  config.middleware.swap ActionDispatch::Executor, GuardedExecutor, executor
end
```
Vulnerability: GHSA-5jcf-c5rg-rmm8
Summary: High severity vulnerability that affects paperclip
Aliases: CVE-2017-0889
Severity: HIGH
CWE: CWE-918
Published: 2018-01-22T13:31:34Z

Paperclip ruby gem version 3.1.4 and later suffers from a Server-SIde Request Forgery (SSRF) vulnerability in the Paperclip::UriAdapter class. Attackers may be able to access information about internal network resources.
Vulnerability: GHSA-84j7-475p-hp8v
Summary: HTTP Response Splitting in Puma
Aliases: CVE-2020-5247
Severity: MODERATE
CWE: CWE-113
Published: 2020-02-28T16:53:55Z

In Puma (RubyGem) before 4.3.2 and 3.12.3, if an application using Puma allows untrusted input in a response header,
an attacker can use newline characters (i.e. `CR`, `LF` or`/r`, `/n`) to end the header and inject malicious content, 
such as additional headers or an entirely new response body. This vulnerability is known as HTTP Response Splitting.

While not an attack in itself, response splitting is a vector for several other attacks, such as cross-site scripting (XSS).

This is related to CVE-2019-16254, which fixed this vulnerability for the WEBrick Ruby web server.

This has been fixed in versions 4.3.2 and 3.12.3 by checking all headers for line endings and rejecting headers with those characters.
Vulnerability: GHSA-gp82-xr77-88f4
Summary: Moderate severity vulnerability that affects radiant
Aliases: CVE-2018-7261
Severity: MODERATE
CWE: CWE-79
Published: 2018-07-27T17:08:29Z

There are multiple Persistent XSS vulnerabilities in Radiant CMS 1.1.4. They affect Personal Preferences (Name and Username) and Configuration (Site Title, Dev Site Domain, Page Parts, and Page Fields).
Vulnerability: GHSA-4q53-fqhc-cr46
Summary: Low severity vulnerability that affects ember-source
Aliases: CVE-2014-0046
Severity: LOW
CWE: CWE-79
Published: 2018-08-28T22:33:42Z

Cross-site scripting (XSS) vulnerability in the link-to helper in Ember.js 1.2.x before 1.2.2, 1.3.x before 1.3.2, and 1.4.x before 1.4.0-beta.6, when used in non-block form, allows remote attackers to inject arbitrary web script or HTML via the title attribute.
Vulnerability: GHSA-6mq2-37j5-w6r6
Summary: Moderate severity vulnerability that affects webrick
Aliases: CVE-2009-4492
Severity: MODERATE
CWE: CWE-20
Published: 2017-10-24T18:33:38Z

WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel 248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.
Vulnerability: GHSA-rwpr-83g3-96g7
Summary: Cross-site scripting in padrino-contrib
Aliases: CVE-2019-16145
Severity: MODERATE
CWE: CWE-79
Published: 2019-09-23T18:33:07Z

The breadcrumbs contributed module through 0.2.0 for Padrino Framework allows XSS via a caption.
Vulnerability: GHSA-f7p5-w2cr-7cp7
Summary: High severity vulnerability that affects puppet
Aliases: CVE-2013-3567
Severity: HIGH
CWE: CWE-20
Published: 2017-10-24T18:33:37Z

Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.
Vulnerability: GHSA-pjj4-w39g-pw54
Summary: Ox gem crashes due to a crafted input
Aliases: CVE-2017-15928
Severity: HIGH
CWE: CWE-20
Published: 2017-11-21T18:26:40Z

In the Ox gem 2.8.0 for Ruby, the process crashes with a segmentation fault when a crafted input is supplied to parse_obj. NOTE: the vendor has stated "Ox should handle the error more gracefully" but has not confirmed a security implication.
Vulnerability: GHSA-7wjx-3g7j-8584
Summary: Denial of Service in Action Controller Token Authentication
Aliases: CVE-2021-22904
Severity: HIGH
CWE: CWE-400
Published: 2021-05-05T19:49:12Z

Impact
------
Impacted code uses `authenticate_or_request_with_http_token` or
`authenticate_with_http_token` for request authentication.  Impacted code will
look something like this:

```
class PostsController < ApplicationController
  before_action :authenticate

  private

  def authenticate
    authenticate_or_request_with_http_token do |token, options|
      # ...
    end
  end
end
```

All users running an affected release should either upgrade or use one of the
workarounds immediately.

Releases
--------
The fixed releases are available at the normal locations.

Workarounds
-----------
The following monkey patch placed in an initializer can be used to work around
the issue:

```ruby
module ActionController::HttpAuthentication::Token
  AUTHN_PAIR_DELIMITERS = /(?:,|;|\t)/
end
```

Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches for
the two supported release series. They are in git-am format and consist of a
single changeset.

* 5-2-http-authentication-dos.patch - Patch for 5.2 series
* 6-0-http-authentication-dos.patch - Patch for 6.0 series
* 6-1-http-authentication-dos.patch - Patch for 6.1 series

Please note that only the 6.1.Z, 6.0.Z, and 5.2.Z series are supported at
present. Users of earlier unsupported releases are advised to upgrade as soon
as possible as we cannot guarantee the continued availability of security
fixes for unsupported releases.

Credits
-------
Thank you to https://hackerone.com/wonda_tea_coffee for reporting this issue!
Vulnerability: GHSA-xwr3-fmgj-mmfr
Summary: Moderate severity vulnerability that affects bio-basespace-sdk
Aliases: CVE-2013-7111
Severity: MODERATE
CWE: CWE-200
Published: 2017-10-24T18:33:36Z

The put_call function in the API client (api/api_client.rb) in the BaseSpace Ruby SDK (aka bio-basespace-sdk) gem 0.1.7 for Ruby uses the API_KEY on the command line, which allows remote attackers to obtain sensitive information by listing the processes.
Vulnerability: GHSA-c7j7-p5jq-26ff
Summary: Low severity vulnerability that affects passenger
Aliases: CVE-2014-1831
Severity: LOW
Published: 2018-10-10T17:29:20Z

Phusion Passenger before 4.0.38 allows local users to write to certain files and directories via a symlink attack on (1) control_process.pid or a (2) generation-* file.
Vulnerability: GHSA-8c56-cpmw-89x7
Summary: Out-of-bounds read in nokogiri
Aliases: CVE-2017-9050
Severity: HIGH
CWE: CWE-125
Published: 2017-12-13T21:38:24Z

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839.  GitHub is notifying on nokogiri as uses libxml2.
Vulnerability: GHSA-33pp-3763-mrfp
Summary: Moderate severity vulnerability that affects sprockets
Aliases: CVE-2014-7819
Severity: MODERATE
CWE: CWE-22
Published: 2017-10-24T18:33:36Z

Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.
Vulnerability: GHSA-w6rc-q387-vpgq
Summary: Moderate severity vulnerability that affects passenger
Aliases: CVE-2013-4136
Severity: MODERATE
CWE: CWE-59
Published: 2017-10-24T18:33:37Z

ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/.
Vulnerability: GHSA-49r3-2549-3633
Summary: omniauth-apple allows attacker to fake their email address during authentication
Aliases: CVE-2020-26254
Severity: LOW
CWE: CWE-290
Published: 2020-12-08T14:18:19Z

### Impact

This vulnerability impacts applications using the [omniauth-apple](https://github.com/nhosoya/omniauth-apple) strategy of OmniAuth and using the `info.email` field of OmniAuth's [Auth Hash Schema](https://github.com/omniauth/omniauth/wiki/Auth-Hash-Schema) for any kind of identification.  The value of this field may be set to any value of the attacker's choice including email addresses of other users.

For example, an application using omniauth-apple with the following code will be impacted:
```ruby
def omniauth_callback
    auth_hash = request.env['omniauth.auth']
    @authenticated_user = User.find_by(email: auth_hash.info.email)
end
```

Applications not using `info.email` for identification but are instead using the `uid` field are not impacted in the same manner.  Note, these applications may still be negatively affected if the value of `info.email` is being used for other purposes.

### Patches

Applications using affected versions of omniauth-apple are advised to upgrade to omniauth-apple version 1.0.1 or later.

### Workarounds

If unable to upgrade to a patched version, monkey patching `OmniAuth::Strategies::Apple#email` as follows is advised as a workaround:

```ruby
module OmniAuth
  module Strategies
    class Apple
      def email
        id_info['email']
      end
    end
  end
end
```
Vulnerability: GHSA-688c-3x49-6rqj
Summary: Moderate severity vulnerability that affects rack-protection
Aliases: CVE-2018-1000119
Severity: MODERATE
CWE: CWE-203
Published: 2018-03-07T22:22:22Z

Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to have been fixed in 1.5.5 and 2.0.0.
Vulnerability: GHSA-fqrr-rrwg-69pv
Summary: Low severity vulnerability that affects paratrooper-pingdom
Aliases: CVE-2014-1233
Severity: LOW
CWE: CWE-200
Published: 2017-10-24T18:33:36Z

The paratrooper-pingdom gem 1.0.0 for Ruby allows local users to obtain the App-Key, username, and password values by listing the curl process.
Vulnerability: GHSA-q97v-764g-r2rp
Summary: High severity vulnerability that affects gollum and gollum-lib
Aliases: CVE-2014-9489
Severity: HIGH
CWE: CWE-284
Published: 2017-11-16T01:47:37Z

The gollum-grit_adapter Ruby gem dependency in gollum before 3.1.1 and the gollum-lib gem dependency in gollum-lib before 4.0.1 when the string "master" is in any of the wiki documents, allows remote authenticated users to execute arbitrary code via the -O or --open-files-in-pager flags.
Vulnerability: GHSA-m2q3-53fq-7h66
Summary: Moderate severity vulnerability that affects gollum
Aliases: CVE-2015-7314
Severity: MODERATE
CWE: CWE-200
Published: 2018-08-28T22:33:51Z

The Precious module in gollum before 4.0.1 allows remote attackers to read arbitrary files by leveraging the lack of a certain temporary-file check.
Vulnerability: GHSA-rfmf-rx8w-935w
Summary: High severity vulnerability that affects sounder
Aliases: CVE-2013-5647
Severity: HIGH
CWE: CWE-94
Published: 2017-10-24T18:33:37Z

lib/sounder/sound.rb in the sounder gem 1.0.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a filename.
Vulnerability: GHSA-cf36-985g-v73c
Summary: Moderate severity vulnerability that affects omniauth-facebook
Aliases: CVE-2013-4562
Severity: MODERATE
CWE: CWE-352
Published: 2017-10-24T18:33:37Z

The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via the state parameter.
Vulnerability: GHSA-fgmx-8h93-26fh
Summary: Moderate severity vulnerability that affects omniauth-oauth2
Aliases: CVE-2012-6134
Severity: MODERATE
CWE: CWE-352
Published: 2017-10-24T18:33:37Z

Cross-site request forgery (CSRF) vulnerability in the omniauth-oauth2 gem 1.1.1 and earlier for Ruby allows remote attackers to hijack the authentication of users for requests that modify session state.
Vulnerability: GHSA-7g65-ghrg-hpf5
Summary: Moderate severity vulnerability that affects actionpack
Aliases: CVE-2012-3465
Severity: MODERATE
CWE: CWE-79
Published: 2017-10-24T18:33:37Z

Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/sanitize_helper.rb in the strip_tags helper in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via malformed HTML markup.
Vulnerability: GHSA-m7fq-cf8q-35q7
Summary: High severity vulnerability that affects crack
Aliases: CVE-2013-1800
Severity: HIGH
Published: 2017-10-24T18:33:37Z

The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
Vulnerability: GHSA-9qj7-jvg4-qr2x
Summary: Moderate severity vulnerability that affects passenger
Aliases: CVE-2013-2119
Severity: MODERATE
Published: 2017-10-24T18:33:37Z

Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary "config" file in a directory with a predictable name in /tmp/ before it is used by the gem.
Vulnerability: GHSA-fr32-gr5c-xq5c
Summary: Escape sequence injection in RubyGems
Aliases: CVE-2019-8321
Severity: HIGH
CWE: CWE-88
Published: 2019-06-20T16:06:04Z

An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteraction#verbose calls say without escaping, escape sequence injection is possible.
Vulnerability: GHSA-3j95-fjv2-3m4p
Summary: CSS Injection in Chartkick gem
Aliases: CVE-2020-16254
Severity: MODERATE
CWE: CWE-74
Published: 2020-08-12T14:29:15Z

The Chartkick gem through 3.3.2 for Ruby allows Cascading Style Sheets (CSS) Injection (without attribute).
Vulnerability: GHSA-mq35-wqvf-r23c
Summary: Sinatra has XSS via 400 Bad Request page via params parser exception
Aliases: CVE-2018-11627
Severity: MODERATE
CWE: CWE-79
Published: 2018-06-05T21:32:06Z

Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception.
Vulnerability: GHSA-7322-9mx6-5j2m
Summary: High severity vulnerability that affects redcarpet
Aliases: CVE-2015-5147
Severity: HIGH
CWE: CWE-119
Published: 2018-08-15T20:04:30Z

Stack-based buffer overflow in the header_anchor function in the HTML renderer in Redcarpet before 3.3.2 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
Vulnerability: GHSA-qv8p-v9qw-wc7g
Summary: Moderate severity vulnerability that affects activesupport
Aliases: CVE-2012-1098
Severity: MODERATE
CWE: CWE-79
Published: 2017-10-24T18:33:38Z

Cross-site scripting (XSS) vulnerability in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving a SafeBuffer object that is manipulated through certain methods.
Vulnerability: GHSA-6fcq-3cm2-j3j5
Summary: Kcapifony gem for Ruby places database user passwords on the command line
Aliases: CVE-2014-5001
Severity: HIGH
CWE: CWE-200
Published: 2018-07-23T19:50:11Z

lib/ksymfony1.rb in the kcapifony gem 2.1.6 for Ruby places database user passwords on the (1) mysqldump, (2) pg_dump, (3) mysql, and (4) psql command lines, which allows local users to obtain sensitive information by listing the processes.
Vulnerability: GHSA-m42x-37p3-fv5w
Summary: Circumvention of file size limits in ActiveStorage
Aliases: CVE-2020-8162
Severity: LOW
CWE: CWE-602
Published: 2020-05-26T15:09:48Z

There is a vulnerability in ActiveStorage's S3 adapter that allows the Content-Length of a
direct file upload to be modified by an end user.

Versions Affected:  rails < 5.2.4.2, rails < 6.0.3.1
Not affected:       Applications that do not use the direct upload functionality of the ActiveStorage S3 adapter.
Fixed Versions:     rails >= 5.2.4.3, rails >= 6.0.3.1

Impact
------

Utilizing this vulnerability, an attacker can control the Content-Length of an S3 direct upload URL without receiving a
new signature from the server. This could be used to bypass controls in place on the server to limit upload size.

Workarounds
-----------

This is a low-severity security issue. As such, no workaround is necessarily
until such time as the application can be upgraded.
Vulnerability: GHSA-8qrh-h9m2-5fvf
Summary: Moderate severity vulnerability that affects rails
Aliases: CVE-2009-3009
Severity: MODERATE
CWE: CWE-79
Published: 2017-10-24T18:33:38Z

Cross-site scripting (XSS) vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject arbitrary web script or HTML by placing malformed Unicode strings into a form helper.
Vulnerability: GHSA-58r4-h6v8-jcvm
Summary: Regression in JWT Signature Validation
Aliases: CVE-2020-15240
Severity: HIGH
CWE: CWE-347, CWE-287
Published: 2020-11-03T02:31:38Z

### Overview
Versions after and including `2.3.0` are improperly validating the JWT token signature when using the `JWTValidator.verify` method.  Improper validation of the JWT token signature when not using the default Authorization Code Flow can allow an attacker to bypass authentication and authorization.

### Am I affected?
You are affected by this vulnerability if all of the following conditions apply:

- You are using `omniauth-auth0`.
- You are using `JWTValidator.verify` method directly OR you are not authenticating using the SDK’s default Authorization Code Flow.

### How to fix that?
Upgrade to version `2.4.1`.

### Will this update impact my users?
The fix provided in this version will not affect your users.
Vulnerability: GHSA-jxjr-5h69-qw3w
Summary: Moderate severity vulnerability that affects nokogiri
Aliases: CVE-2015-7499
Severity: MODERATE
CWE: CWE-119
Published: 2018-09-17T21:57:38Z

Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive process memory information via unspecified vectors.
Vulnerability: GHSA-8727-m6gj-mc37
Summary: Possible Strong Parameters Bypass in ActionPack
Aliases: CVE-2020-8164
Severity: MODERATE
CWE: CWE-502
Published: 2020-05-26T15:09:16Z

There is a strong parameters bypass vector in ActionPack.

Versions Affected:  rails <= 6.0.3
Not affected:       rails < 4.0.0
Fixed Versions:     rails >= 5.2.4.3, rails >= 6.0.3.1

Impact
------
In some cases user supplied information can be inadvertently leaked from
Strong Parameters.  Specifically the return value of `each`, or `each_value`,
or `each_pair` will return the underlying "untrusted" hash of data that was
read from the parameters.  Applications that use this return value may be
inadvertently use untrusted user input.

Impacted code will look something like this:

```
def update
  # Attacker has included the parameter: `{ is_admin: true }`
  User.update(clean_up_params)
end

def clean_up_params
   params.each { |k, v|  SomeModel.check(v) if k == :name }
end
```

Note the mistaken use of `each` in the `clean_up_params` method in the above
example.

Workarounds
-----------
Do not use the return values of `each`, `each_value`, or `each_pair` in your
application.
Vulnerability: GHSA-fcqf-h4h4-695m
Summary: Moderate severity vulnerability that affects actionpack
Aliases: CVE-2011-3186
Severity: MODERATE
CWE: CWE-94
Published: 2017-10-24T18:33:38Z

CRLF injection vulnerability in actionpack/lib/action_controller/response.rb in Ruby on Rails 2.3.x before 2.3.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the Content-Type header.
Vulnerability: GHSA-q6cw-2553-7837
Summary: Moderate severity vulnerability that affects newrelic_rpm
Aliases: CVE-2013-0284
Severity: MODERATE
CWE: CWE-200
Published: 2017-10-24T18:33:37Z

Ruby agent 3.2.0 through 3.5.2 serializes sensitive data when communicating with servers operated by New Relic, which allows remote attackers to obtain sensitive information (database credentials and SQL statements) by sniffing the network and deserializing the data.
Vulnerability: GHSA-29gr-w57f-rpfw
Summary: Moderate severity vulnerability that affects actionpack
Aliases: CVE-2014-7818
Severity: MODERATE
CWE: CWE-22
Published: 2017-10-24T18:33:36Z

Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via a /..%2F sequence.
Vulnerability: GHSA-jrfj-98qg-qjgv
Summary: Denial of service in sidekiq
Aliases: CVE-2022-23837
Severity: HIGH
CWE: CWE-400, CWE-770
Published: 2022-01-27T14:42:37Z

In api.rb in Sidekiq before 6.4.0 and 5.2.10, there is no limit on the number of days when requesting stats for the graph. This overloads the system, affecting the Web UI, and makes it unavailable to users.
Vulnerability: GHSA-g397-v4w5-4m79
Summary: Command injection in cocoapods-downloader
Aliases: CVE-2022-21223
Severity: HIGH
CWE: CWE-74, CWE-88
Published: 2022-04-02T00:00:13Z

The package cocoapods-downloader before 1.6.2 are vulnerable to Command Injection via hg argument injection. When calling the download function (when using hg), the url (and/or revision, tag, branch) is passed to the hg clone command in a way that additional flags can be set. The additional flags can be used to perform a command injection.
Vulnerability: GHSA-7vxr-6cxg-j3x8
Summary: OS Command Injection in ftpd
Aliases: CVE-2013-2512
Severity: CRITICAL
CWE: CWE-78
Published: 2021-10-12T22:33:59Z

The ftpd gem 0.2.1 for Ruby allows remote attackers to execute arbitrary OS commands via shell metacharacters in a LIST or NLST command argument within FTP protocol traffic.
Vulnerability: GHSA-j5rj-g695-342r
Summary: Moderate severity vulnerability that affects fat_free_crm
Aliases: CVE-2018-1000842
Severity: MODERATE
CWE: CWE-79
Published: 2018-12-20T22:01:54Z

FatFreeCRM version <=0.14.1, >=0.15.0 <=0.15.1, >=0.16.0 <=0.16.3, >=0.17.0 <=0.17.2, ==0.18.0 contains a Cross Site Scripting (XSS) vulnerability in commit 6d60bc8ed010c4eda05d6645c64849f415f68d65 that can result in Javascript execution. This attack appear to be exploitable via Content with Javascript payload will be executed on end user browsers when they visit the page. This vulnerability appears to have been fixed in 0.18.1, 0.17.3, 0.16.4, 0.15.2, 0.14.2.
Vulnerability: GHSA-v9v4-7jp6-8c73
Summary: Moderate severity vulnerability that affects rails
Aliases: CVE-2011-2197
Severity: MODERATE
CWE: CWE-79
Published: 2017-10-24T18:33:38Z

The cross-site scripting (XSS) prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does not properly handle mutation of safe buffers, which makes it easier for remote attackers to conduct XSS attacks via crafted strings to an application that uses a problematic string method, as demonstrated by the sub method.
Vulnerability: GHSA-hhwc-8g49-j8jx
Summary: Incorrect Permission Assignment for Critical Resource in ruby_parser-legacy
Aliases: CVE-2019-18409
Severity: HIGH
CWE: CWE-732
Published: 2019-10-25T19:41:34Z

The ruby_parser-legacy (aka legacy) gem 1.0.0 for Ruby allows local privilege escalation because of world-writable files. For example, if the brakeman gem (which has a legacy dependency) 4.5.0 through 4.7.0 is used, a local user can insert malicious code into the ruby_parser-legacy-1.0.0/lib/ruby_parser/legacy/ruby_parser.rb file.
Vulnerability: GHSA-vx9j-46rh-fqr8
Summary: Moderate severity vulnerability that affects actionview
Aliases: CVE-2016-2097
Severity: MODERATE
CWE: CWE-22
Published: 2017-10-24T18:33:35Z

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.2 and 4.x before 4.1.14.2 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-0752.
Vulnerability: GHSA-r53w-g4xm-3gc6
Summary: Cross-site scripting in Haml
Aliases: CVE-2017-1002201
Severity: MODERATE
CWE: CWE-79
Published: 2019-10-21T21:59:13Z

In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like < > " ' must be escaped properly. In this case, the ' character was missed. An attacker can manipulate the input to introduce additional attributes, potentially executing code.
Vulnerability: GHSA-fhj9-cjjh-27vm
Summary: Critical severity vulnerability that affects activerecord
Aliases: CVE-2013-0277
Severity: CRITICAL
Published: 2017-10-24T18:33:37Z

ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML.
Vulnerability: GHSA-pr3h-jjhj-573x
Summary: High severity vulnerability that affects sprockets
Aliases: CVE-2018-3760
Severity: HIGH
CWE: CWE-22, CWE-200
Published: 2018-06-20T22:18:58Z

Specially crafted requests can be used to access files that exist on the filesystem that is outside an application's root directory, when the Sprockets server is used in production.
  
All users running an affected release should either upgrade or use one of the work arounds immediately.
  
Workaround:
  
In Rails applications, work around this issue, set `config.assets.compile = false` and `config.public_file_server.enabled = true` in an initializer and precompile the assets.

This work around will not be possible in all hosting environments and upgrading is advised.
Vulnerability: GHSA-fcjw-8rhj-gwwc
Summary: Authentication Bypass in Devise
Aliases: CVE-2019-16109
Severity: HIGH
CWE: CWE-284
Published: 2019-09-11T23:06:57Z

An issue was discovered in Plataformatec Devise before 4.7.1. It confirms accounts upon receiving a request with a blank confirmation_token, if a database record has a blank value in the confirmation_token column. (However, there is no scenario within Devise itself in which such database records would exist.)
Vulnerability: GHSA-xmgj-5fh3-xjmm
Summary: Path traversal when MessageBus::Diagnostics is enabled
Aliases: CVE-2021-43840
Severity: MODERATE
CWE: CWE-22
Published: 2021-12-17T19:59:13Z

### Impact

Users who deployed message bus with diagnostics features enabled (default off) were vulnerable to a path traversal bug, which could lead to disclosure of secret information on a machine if an unintended user were to gain access to the diagnostic route. The impact is also greater if there is no proxy for your web application as the number of steps up the directories is not bounded. For deployments which uses a proxy, the impact varies. For example, If a request goes through a proxy like Nginx with `merge_slashes` enabled, the number of steps up the directories that can be read is limited to 3 levels. 

### Patches

Patched in 3.3.7.

### Workarounds

Disable MessageBus::Diagnostics in production like environments.
Vulnerability: GHSA-w3j4-76qw-wwjm
Summary: Older releases of better_errors open to Cross-Site Request Forgery attack
Aliases: CVE-2021-39197
Severity: MODERATE
CWE: CWE-352
Published: 2021-09-07T23:08:24Z

### Impact
better_errors prior to 2.8.0 did not implement CSRF protection for its internal requests. It also did not enforce the correct "Content-Type" header for these requests, which allowed a cross-origin "simple request" to be made without CORS protection. These together left an application with better_errors enabled open to cross-origin attacks.

_As a developer tool, better_errors documentation strongly recommends addition only to the `development` bundle group, so this vulnerability should only affect development environments. Please ensure that your project limits better_errors to the `development` group (or the non-Rails equivalent)._

### Patches
Starting with release 2.8.x, CSRF protection is enforced. It is recommended that you upgrade to the latest release, or minimally to "~> 2.8.3".

### Workarounds
There are no known workarounds to mitigate the risk of using older releases of better_errors.

### References
- Chris Moberly provided [an example attack that uses a now-patched vulnerability of webpack-dev-server in conjunction with Better Errors](https://about.gitlab.com/blog/2021/09/07/why-are-developers-vulnerable-to-driveby-attacks/)

### For more information
If you have any questions or comments about this advisory, please
- Add to the [discussion in better_errors](https://github.com/BetterErrors/better_errors/discussions/507)
- Open an issue in [better_errors](https://github.com/BetterErrors/better_errors)
Vulnerability: GHSA-xq5j-gw7f-jgj8
Summary: CSRF Vulnerability in rails-ujs
Aliases: CVE-2020-8167
Severity: MODERATE
CWE: CWE-352
Published: 2020-07-07T16:34:10Z

There is an vulnerability in rails-ujs that allows attackers to send
CSRF tokens to wrong domains.

Versions Affected:  rails <= 6.0.3
Not affected:       Applications which don't use rails-ujs.
Fixed Versions:     rails >= 5.2.4.3, rails >= 6.0.3.1

Impact
------

This is a regression of CVE-2015-1840.

In the scenario where an attacker might be able to control the href attribute of an anchor tag or
the action attribute of a form tag that will trigger a POST action, the attacker can set the
href or action to a cross-origin URL, and the CSRF token will be sent.

Workarounds
-----------

To work around this problem, change code that allows users to control the href attribute of an anchor
tag or the action attribute of a form tag to filter the user parameters.

For example, code like this:

    link_to params

to code like this:

    link_to filtered_params

    def filtered_params
      # Filter just the parameters that you trust
    end
Vulnerability: GHSA-mm33-5vfq-3mm3
Summary: XSS Vulnerability in Action Pack
Aliases: CVE-2022-22577
Severity: HIGH
CWE: CWE-79
Published: 2022-04-27T22:28:59Z

There is a possible XSS vulnerability in Rails / Action Pack. This vulnerability has been
assigned the CVE identifier CVE-2022-22577.

Versions Affected:  >= 5.2.0
Not affected:       < 5.2.0
Fixed Versions:     7.0.2.4, 6.1.5.1, 6.0.4.8, 5.2.7.1

## Impact

CSP headers were only sent along with responses that Rails considered as
"HTML" responses.  This left API requests without CSP headers, which could
possibly expose users to XSS attacks.

## Releases

The FIXED releases are available at the normal locations.

## Workarounds

Set a CSP for your API responses manually.
Vulnerability: GHSA-7627-mp87-jf6q
Summary: Command injection in cocoapods-downloader
Aliases: CVE-2022-24440
Severity: HIGH
CWE: CWE-74, CWE-88
Published: 2022-04-02T00:00:13Z

The package cocoapods-downloader before 1.6.0, from 1.6.2 and before 1.6.3 are vulnerable to Command Injection via git argument injection. When calling the Pod::Downloader.preprocess_options function and using git, both the git and branch parameters are passed to the git ls-remote subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.
Vulnerability: GHSA-333g-rpr4-7hxq
Summary: Backdoor / Malicious code
Aliases: CVE-2019-15224
Severity: CRITICAL
CWE: CWE-94
Published: 2019-08-20T14:29:03Z

The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.
Users of an affected version should consider downgrading to the last non-affected version of 1.6.9, or upgrading to 1.7.x.
Additionally, a set of other minor gems have been partially or completely yanked and are included in this advisory.
These include cron_parser, coin_base, blockchain_wallet, awesome-bot, doge-coin, capistrano-colors, bitcoin_vanity, lita_coin, coming-soon, and omniauth_amazon.
Vulnerability: GHSA-2xvj-j3qh-x8c3
Summary: High severity vulnerability that affects private_address_check
Aliases: CVE-2018-3759
Severity: HIGH
CWE: CWE-362
Published: 2018-07-31T18:13:05Z

private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the socket uses not being checked. DNS entries with a TTL of 0 can trigger this case where the initial resolution is a public address but the subsequent resolution is a private address.
Vulnerability: GHSA-5629-8855-gf4g
Summary: Authentication Bypass by CSRF Weakness 
Severity: CRITICAL
CWE: CWE-352, CWE-305
Published: 2021-11-18T20:12:40Z

### Impact
The actual vulnerability has been discovered on `solidus_auth_devise`. See [GHSA-xm34-v85h-9pg2](https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2) for details.

The security advisory here exists to provide an extra layer of security in the form of a monkey patch for users who don't update `solidus_auth_devise`. For this reason, it has been marked as low impact on this end.

### Patches
For extra security, update `solidus_core` to versions `3.1.3`, `3.0.3` or `2.11.12`.

### Workarounds
Look at the workarounds described at [GHSA-xm34-v85h-9pg2](https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2).

### References
- [GHSA-xm34-v85h-9pg2](https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2).

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [solidus_auth_devise](https://github.com/solidusio/solidus_auth_devise/issues) or a discussion in [solidus](https://github.com/solidusio/solidus/discussions)
* Email us at [security@solidus.io](mailto:security@soliidus.io)
* Contact the core team on [Slack](http://slack.solidus.io/)
Vulnerability: GHSA-23f7-99jx-m54r
Summary: Remote code execution in dependabot-core branch names when cloning
Aliases: CVE-2020-26222
Severity: LOW
CWE: CWE-74
Published: 2020-11-13T15:47:50Z

### Impact
Remote code execution vulnerability in `dependabot-common` and  `dependabot-go_modules` when a source branch name contains malicious injectable bash code.

For example, if Dependabot is configured to use the following source branch name: `"/$({curl,127.0.0.1})"`, Dependabot will make a HTTP request to the following URL: 127.0.0.1 when cloning the source repository.

When Dependabot is configured to clone the source repository during an update, Dependabot runs a shell command to git clone the repository:

```bash
git clone --no-tags --no-recurse-submodules --depth=1 --branch=<BRANCH> --single-branch <GITHUB_REPO_URL> repo/contents/path
```

Dependabot will always clone the source repository for `go_modules` during the file fetching step and can be configured to clone the repository for other package managers using the `FileFetcher` class from `dependabot-common`.

```ruby
source = Dependabot::Source.new(
  provider: "github",
  repo: "repo/name",
  directory: "/",
  branch: "/$({curl,127.0.0.1})",
)

repo_contents_path = "./file/path"
fetcher = Dependabot::FileFetchers.for_package_manager("bundler").
                  new(source: source, credentials: [],
                  repo_contents_path: repo_contents_path)
fetcher.clone_repo_contents
```

### Patches

The fix was applied to version `0.125.1`: https://github.com/dependabot/dependabot-core/pull/2727

### Workarounds
Escape the branch name prior to passing it to the `Dependabot::Source` class.

For example using `shellwords`:

```ruby
require "shellwords"
branch = Shellwords.escape("/$({curl,127.0.0.1})")
source = Dependabot::Source.new(
  provider: "github",
  repo: "repo/name",
  directory: "/",
  branch: branch,
)
```
Vulnerability: GHSA-rxq3-gm4p-5fj4
Summary: High severity vulnerability that affects rails
Aliases: CVE-2009-2422
Severity: HIGH
CWE: CWE-287
Published: 2017-10-24T18:33:38Z

The example code for the digest authentication functionality (http_authentication.rb) in Ruby on Rails before 2.3.3 defines an authenticate_or_request_with_http_digest block that returns nil instead of false when the user does not exist, which allows context-dependent attackers to bypass authentication for applications that are derived from this example by sending an invalid username without a password.
Vulnerability: GHSA-c289-47qf-rvrr
Summary: Low severity vulnerability that affects easymon
Aliases: CVE-2018-1000855
Severity: MODERATE
CWE: CWE-79
Published: 2018-12-21T17:46:03Z

easymon version 1.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in Endpoint where monitoring is mounted that can result in Reflected XSS that affects Firefox. Can be used to steal cookies, depending on the cookie settings.. This attack appear to be exploitable via The victim must click on a crafted URL that contains the XSS payload. This vulnerability appears to have been fixed in 1.4.1 and later.