deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-m46p-ggm5-5j83
Package: rails (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 4.0.0, < 4.0.3
Patched in: 4.0.3

Summary: Rails vulnerable to Cross-site Scripting

Details:
There is an XSS vulnerability in the `number_to_currency`, `number_to_percentage` and `number_to_human` helpers in Ruby on Rails. This vulnerability has been assigned the CVE identifier CVE-2014-0081.

Versions Affected:  All.
Fixed Versions:     4.1.0.beta2, 4.0.3, 3.2.17.

Impact
------
These helpers allows users to nicely format a numeric value. Some of the parameters to the helper (format, negative_format and units) are not escaped correctly. Applications which pass user controlled data as one of these parameters are vulnerable to an XSS attack.

All users passing user controlled data to these parameters of the number helpers should either upgrade or use one of the workarounds immediately.

Releases
--------
The 4.1.0.rc1, 4.0.3 and 3.2.17 releases are available at the normal locations.

Workarounds
-----------

The workaround for this issue is to escape the value passed to the parameter.
For example, replace code like this:

```ruby
<%= number_to_currency(1.02, format: params[:format]) %>
```

With code like this

```ruby
<%= number_to_currency(1.02, format: h(params[:format])) %>
```

Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

* 4-1-beta-number_helpers_xss.patch - Patch for 4.1-beta series
* 4-0-number_helpers_xss.patch - Patch for 4.0 series
* 3-2-number_helpers_xss.patch - Patch for 3.2 series

Please note that only the 4.0.x and 3.2.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

Credits
-------

Thanks to Kevin Reintjes for reporting the issue to us.

-- 
Aaron Patterson
http://tenderlovemaking.com/
GitHub Security Advisory: GHSA-m46p-ggm5-5j83
Package: rails (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 3.0.0, < 3.2.17
Patched in: 3.2.17

Summary: Rails vulnerable to Cross-site Scripting

Details:
There is an XSS vulnerability in the `number_to_currency`, `number_to_percentage` and `number_to_human` helpers in Ruby on Rails. This vulnerability has been assigned the CVE identifier CVE-2014-0081.

Versions Affected:  All.
Fixed Versions:     4.1.0.beta2, 4.0.3, 3.2.17.

Impact
------
These helpers allows users to nicely format a numeric value. Some of the parameters to the helper (format, negative_format and units) are not escaped correctly. Applications which pass user controlled data as one of these parameters are vulnerable to an XSS attack.

All users passing user controlled data to these parameters of the number helpers should either upgrade or use one of the workarounds immediately.

Releases
--------
The 4.1.0.rc1, 4.0.3 and 3.2.17 releases are available at the normal locations.

Workarounds
-----------

The workaround for this issue is to escape the value passed to the parameter.
For example, replace code like this:

```ruby
<%= number_to_currency(1.02, format: params[:format]) %>
```

With code like this

```ruby
<%= number_to_currency(1.02, format: h(params[:format])) %>
```

Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

* 4-1-beta-number_helpers_xss.patch - Patch for 4.1-beta series
* 4-0-number_helpers_xss.patch - Patch for 4.0 series
* 3-2-number_helpers_xss.patch - Patch for 3.2 series

Please note that only the 4.0.x and 3.2.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

Credits
-------

Thanks to Kevin Reintjes for reporting the issue to us.

-- 
Aaron Patterson
http://tenderlovemaking.com/
GitHub Security Advisory: GHSA-7cgp-c3g7-qvrw
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 3.0.0, < 3.2.17
Patched in: 3.2.17

Summary: actionpack Improper Input Validation vulnerability

Details:
`actionpack/lib/action_view/template/text.rb` in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during use of the `:text` option to the `render` method, which allows remote attackers to cause a denial of service (memory consumption) by including these strings in headers.
GitHub Security Advisory: GHSA-6x85-j5j2-27jx
Package: actionpack (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 4.1.0, < 4.1.1
Patched in: 4.1.1

Summary: actionpack Path Traversal vulnerability

Details:
Directory traversal vulnerability in `actionpack/lib/abstract_controller/base.rb` in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.
GitHub Security Advisory: GHSA-6x85-j5j2-27jx
Package: actionpack (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 4.0.0, < 4.0.5
Patched in: 4.0.5

Summary: actionpack Path Traversal vulnerability

Details:
Directory traversal vulnerability in `actionpack/lib/abstract_controller/base.rb` in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.
GitHub Security Advisory: GHSA-6x85-j5j2-27jx
Package: actionpack (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 3.0.0, < 3.2.18
Patched in: 3.2.18

Summary: actionpack Path Traversal vulnerability

Details:
Directory traversal vulnerability in `actionpack/lib/abstract_controller/base.rb` in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.
GitHub Security Advisory: GHSA-fqrr-rrwg-69pv
Package: paratrooper-pingdom (RUBYGEMS)
Severity: LOW (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: <= 1.0.0
Patched in: unpatched

Summary: Local API Login Credentials Disclosure in paratrooper-pingdom

Details:
The paratrooper-pingdom gem 1.0.0 for Ruby allows local users to obtain the App-Key, username, and password values by listing the curl process.

### Vulnerable Code:

From: `paratrooper-pingdom-1.0.0/lib/paratrooper-pingdom.rb`

```ruby
def setup(options = {})
  %x[curl https://api.pingdom.com/api/2.0/checks -X PUT -d "paused=true" -H "App-Key: #{app_key}" -u "#{username}:#{password}"]        
end

def teardown(options = {})
  %x[curl https://api.pingdom.com/api/2.0/checks -X PUT -d "paused=false" -H "App-Key: #{app_key}" -u "#{username}:#{password}"]        
end
```

A malicious user could monitor the process tree to steal the API key, username and password for the API login.
GitHub Security Advisory: GHSA-hgmw-x865-hf9x
Package: arabic-prawn (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
Vulnerable versions: <= 0.0.1
Patched in: unpatched

Summary: Arabic Prawn allows remote attackers to execute arbitrary commands via shell metacharacters

Details:
`lib/string_utf_support.rb` in the Arabic Prawn 0.0.1 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) downloaded_file or (2) url variable.
GitHub Security Advisory: GHSA-92v7-pq4h-58j5
Package: mcollective-client (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 2.5.2
Patched in: 2.5.2

Summary: facter, hiera, mcollective-client, and puppet affected by untrusted search path vulnerability

Details:
Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) `rubygems/defaults/operating_system.rb`, (2) `Win32API.rb`, (3) `Win32API.so`, (4) `safe_yaml.rb`, (5) `safe_yaml/deep.rb`, or (6) `safe_yaml/deep.so`; or (7) `operatingsystem.rb`, (8) `operatingsystem.so`, (9) `osfamily.rb`, or (10) `osfamily.so` in `puppet/confine`.
GitHub Security Advisory: GHSA-92v7-pq4h-58j5
Package: puppet (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 3.0.0, < 3.6.2
Patched in: 3.6.2

Summary: facter, hiera, mcollective-client, and puppet affected by untrusted search path vulnerability

Details:
Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) `rubygems/defaults/operating_system.rb`, (2) `Win32API.rb`, (3) `Win32API.so`, (4) `safe_yaml.rb`, (5) `safe_yaml/deep.rb`, or (6) `safe_yaml/deep.so`; or (7) `operatingsystem.rb`, (8) `operatingsystem.so`, (9) `osfamily.rb`, or (10) `osfamily.so` in `puppet/confine`.
GitHub Security Advisory: GHSA-92v7-pq4h-58j5
Package: puppet (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 2.7.26
Patched in: 2.7.26

Summary: facter, hiera, mcollective-client, and puppet affected by untrusted search path vulnerability

Details:
Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) `rubygems/defaults/operating_system.rb`, (2) `Win32API.rb`, (3) `Win32API.so`, (4) `safe_yaml.rb`, (5) `safe_yaml/deep.rb`, or (6) `safe_yaml/deep.so`; or (7) `operatingsystem.rb`, (8) `operatingsystem.so`, (9) `osfamily.rb`, or (10) `osfamily.so` in `puppet/confine`.
GitHub Security Advisory: GHSA-92v7-pq4h-58j5
Package: hiera (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 1.3.4
Patched in: 1.3.4

Summary: facter, hiera, mcollective-client, and puppet affected by untrusted search path vulnerability

Details:
Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) `rubygems/defaults/operating_system.rb`, (2) `Win32API.rb`, (3) `Win32API.so`, (4) `safe_yaml.rb`, (5) `safe_yaml/deep.rb`, or (6) `safe_yaml/deep.so`; or (7) `operatingsystem.rb`, (8) `operatingsystem.so`, (9) `osfamily.rb`, or (10) `osfamily.so` in `puppet/confine`.
GitHub Security Advisory: GHSA-92v7-pq4h-58j5
Package: facter (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 2.0.0, < 2.0.2
Patched in: 2.0.2

Summary: facter, hiera, mcollective-client, and puppet affected by untrusted search path vulnerability

Details:
Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) `rubygems/defaults/operating_system.rb`, (2) `Win32API.rb`, (3) `Win32API.so`, (4) `safe_yaml.rb`, (5) `safe_yaml/deep.rb`, or (6) `safe_yaml/deep.so`; or (7) `operatingsystem.rb`, (8) `operatingsystem.so`, (9) `osfamily.rb`, or (10) `osfamily.so` in `puppet/confine`.
GitHub Security Advisory: GHSA-92v7-pq4h-58j5
Package: facter (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 1.7.6
Patched in: 1.7.6

Summary: facter, hiera, mcollective-client, and puppet affected by untrusted search path vulnerability

Details:
Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) `rubygems/defaults/operating_system.rb`, (2) `Win32API.rb`, (3) `Win32API.so`, (4) `safe_yaml.rb`, (5) `safe_yaml/deep.rb`, or (6) `safe_yaml/deep.so`; or (7) `operatingsystem.rb`, (8) `operatingsystem.so`, (9) `osfamily.rb`, or (10) `osfamily.so` in `puppet/confine`.
GitHub Security Advisory: GHSA-mhwp-qhpc-h3jm
Package: activerecord (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 2.0.0, < 3.2.19
Patched in: 3.2.19

Summary: SQL Injection in Active Record

Details:
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting.
GitHub Security Advisory: GHSA-33pp-3763-mrfp
Package: sprockets (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 2.12.0, < 2.12.3
Patched in: 2.12.3

Summary: sprockets vulnerable to Path Traversal

Details:
Multiple directory traversal vulnerabilities in `server.rb` in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.
GitHub Security Advisory: GHSA-33pp-3763-mrfp
Package: sprockets (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 2.11.0, < 2.11.3
Patched in: 2.11.3

Summary: sprockets vulnerable to Path Traversal

Details:
Multiple directory traversal vulnerabilities in `server.rb` in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.
GitHub Security Advisory: GHSA-33pp-3763-mrfp
Package: sprockets (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 2.10.0, < 2.10.2
Patched in: 2.10.2

Summary: sprockets vulnerable to Path Traversal

Details:
Multiple directory traversal vulnerabilities in `server.rb` in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.
GitHub Security Advisory: GHSA-33pp-3763-mrfp
Package: sprockets (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 2.9.0, < 2.9.4
Patched in: 2.9.4

Summary: sprockets vulnerable to Path Traversal

Details:
Multiple directory traversal vulnerabilities in `server.rb` in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.
GitHub Security Advisory: GHSA-33pp-3763-mrfp
Package: sprockets (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 2.8.0, < 2.8.3
Patched in: 2.8.3

Summary: sprockets vulnerable to Path Traversal

Details:
Multiple directory traversal vulnerabilities in `server.rb` in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.
GitHub Security Advisory: GHSA-33pp-3763-mrfp
Package: sprockets (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 2.6.0, < 2.7.1
Patched in: 2.7.1

Summary: sprockets vulnerable to Path Traversal

Details:
Multiple directory traversal vulnerabilities in `server.rb` in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.
GitHub Security Advisory: GHSA-33pp-3763-mrfp
Package: sprockets (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 2.5.0, < 2.5.1
Patched in: 2.5.1

Summary: sprockets vulnerable to Path Traversal

Details:
Multiple directory traversal vulnerabilities in `server.rb` in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.
GitHub Security Advisory: GHSA-33pp-3763-mrfp
Package: sprockets (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 2.4.0, < 2.4.6
Patched in: 2.4.6

Summary: sprockets vulnerable to Path Traversal

Details:
Multiple directory traversal vulnerabilities in `server.rb` in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.
GitHub Security Advisory: GHSA-33pp-3763-mrfp
Package: sprockets (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 2.3.0, < 2.3.3
Patched in: 2.3.3

Summary: sprockets vulnerable to Path Traversal

Details:
Multiple directory traversal vulnerabilities in `server.rb` in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.
GitHub Security Advisory: GHSA-33pp-3763-mrfp
Package: sprockets (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 2.2.0, < 2.2.3
Patched in: 2.2.3

Summary: sprockets vulnerable to Path Traversal

Details:
Multiple directory traversal vulnerabilities in `server.rb` in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.
GitHub Security Advisory: GHSA-33pp-3763-mrfp
Package: sprockets (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 2.1.0, < 2.1.4
Patched in: 2.1.4

Summary: sprockets vulnerable to Path Traversal

Details:
Multiple directory traversal vulnerabilities in `server.rb` in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.