deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-h835-75hw-pj89
Package: activesupport (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.3.16
Patched in: 2.3.16

Summary: activesupport Cross-site Scripting vulnerability

Details:
Cross-site scripting (XSS) vulnerability in `activesupport/lib/active_support/core_ext/string/output_safety.rb` in Ruby on Rails before 2.3.16, 3.0.x before , 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a ' (quote) character.
GitHub Security Advisory: GHSA-gh2w-j7cx-2664
Package: activerecord (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 3.0.0.beta, < 3.0.18
Patched in: 3.0.18

Summary: Active Record contains SQL Injection

Details:
SQL injection vulnerability in the Active Record component in Ruby on Rails before 2.3.15, 3.0.x before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain find_by_ method calls.
GitHub Security Advisory: GHSA-7g65-ghrg-hpf5
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.3.16
Patched in: 2.3.16

Summary: actionpack Cross-site Scripting vulnerability

Details:
Cross-site scripting (XSS) vulnerability in `actionpack/lib/action_view/helpers/sanitize_helper.rb` in the `strip_tags` helper in Ruby on Rails before 2.3.16, 3.0.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via malformed HTML markup.
GitHub Security Advisory: GHSA-7g65-ghrg-hpf5
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 3.0.0.beta, < 3.0.17
Patched in: 3.0.17

Summary: actionpack Cross-site Scripting vulnerability

Details:
Cross-site scripting (XSS) vulnerability in `actionpack/lib/action_view/helpers/sanitize_helper.rb` in the `strip_tags` helper in Ruby on Rails before 2.3.16, 3.0.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via malformed HTML markup.
GitHub Security Advisory: GHSA-h835-75hw-pj89
Package: activesupport (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 3.0.0.beta, < 3.0.17
Patched in: 3.0.17

Summary: activesupport Cross-site Scripting vulnerability

Details:
Cross-site scripting (XSS) vulnerability in `activesupport/lib/active_support/core_ext/string/output_safety.rb` in Ruby on Rails before 2.3.16, 3.0.x before , 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a ' (quote) character.
GitHub Security Advisory: GHSA-76wq-xw4h-f8wj
Package: activerecord (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: < 2.3.15
Patched in: 2.3.15

Summary: activerecord vulnerable to SQL Injection

Details:
The Active Record component in Ruby on Rails efore 2.3.15, 3.0.x before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage improper handling of nested hashes, a related issue to CVE-2012-2661.
GitHub Security Advisory: GHSA-76wq-xw4h-f8wj
Package: activerecord (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 3.0.0.beta, < 3.0.14
Patched in: 3.0.14

Summary: activerecord vulnerable to SQL Injection

Details:
The Active Record component in Ruby on Rails efore 2.3.15, 3.0.x before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage improper handling of nested hashes, a related issue to CVE-2012-2661.
GitHub Security Advisory: GHSA-q34c-48gc-m9g8
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 3.0.13, < 3.0.14
Patched in: 3.0.14

Summary: actionpack allows remote attackers to bypass database-query restrictions, perform NULL checks via crafted request

Details:
`actionpack/lib/action_dispatch/http/request.rb` in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain `['xyz', nil]` values, a related issue to CVE-2012-2660.
GitHub Security Advisory: GHSA-q58j-fmvf-9rq6
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 3.0.0.rc, < 3.0.6
Patched in: 3.0.6

Summary: Cross site scripting in actionpack Rubygem

Details:
A cross-site scripting vulnerability flaw was found in the `auto_link` function in Rails before version 3.0.6.
GitHub Security Advisory: GHSA-4fwj-m62q-pp47
Package: pwpush (RUBYGEMS)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-384: Session Fixation
Vulnerable versions: <= 1.50.3
Patched in: unpatched

Summary: Password Pusher Allows Session Token Interception Leading to Potential Hijacking

Details:
### Impact

A vulnerability has been reported in Password Pusher where an attacker can copy the session cookie before a user logs out, potentially allowing session hijacking.

Although the session token is replaced and invalidated upon logout, if an attacker manages to capture the session cookie before this process, they can use the token to gain unauthorized access to the user's session until the token expires or is manually cleared.

This vulnerability hinges on the attacker's ability to access the session cookie during an active session, either through a man-in-the-middle attack, by exploiting another vulnerability like XSS, or via direct access to the victim's device.

### Patches

Although there is no direct resolution to this vulnerability, it is recommended to always use the latest version of Password Pusher to best mitigate risk.

### Workarounds

If self-hosting, ensure Password Pusher is hosted exclusively over SSL connections to encrypt traffic and prevent session cookies from being intercepted in transit. Additionally, implement best practices in local security to safeguard user systems, browsers, and data against unauthorized access.

To further mitigate session hijacking risks, Password Pusher implements the following security measures:

1. **Automatic Session Expiration**: Sessions are automatically expired after 2 hours of inactivity, reducing the window for potential exploitation.
2. **Session Reset on Login and Logout**: Sessions are fully reset both when a user logs in and logs out, ensuring that session tokens are not reusable post-logout. This practice invalidates old session tokens and issues new ones, minimizing the risk of session hijacking.
3. **Encrypted Cookies**: Cookies are encrypted using the value of SECRET_KEY_BASE from the application's configuration. This encryption adds a layer of protection against tampering or reading the session cookie's contents if intercepted, although it doesn't prevent the cookie from being used if stolen.

**Note**: While these measures significantly enhance security, they are part of a broader security strategy.

### References

* https://edgeguides.rubyonrails.org/security.html#session-hijacking

### Credits

Thank you to [Positive Technologies](https://www.ptsecurity.com/ww-en/) for reporting and working with me to bring this CVE to the community.
GitHub Security Advisory: GHSA-vfm5-rmrh-j26v
Package: actionpack (RUBYGEMS)
Severity: LOW (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 8.0.0, < 8.0.0.1
Patched in: 8.0.0.1

Summary: Possible Content Security Policy bypass in Action Dispatch

Details:
There is a possible Cross Site Scripting (XSS) vulnerability  in the `content_security_policy` helper in Action Pack.

Impact
------
Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks.

Releases
--------
The fixed releases are available at the normal locations.

Workarounds
-----------
Applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.

Credits
-------
Thanks to [ryotak](https://hackerone.com/ryotak) for the report!
GitHub Security Advisory: GHSA-vfm5-rmrh-j26v
Package: actionpack (RUBYGEMS)
Severity: LOW (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.2.0, < 7.2.2.1
Patched in: 7.2.2.1

Summary: Possible Content Security Policy bypass in Action Dispatch

Details:
There is a possible Cross Site Scripting (XSS) vulnerability  in the `content_security_policy` helper in Action Pack.

Impact
------
Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks.

Releases
--------
The fixed releases are available at the normal locations.

Workarounds
-----------
Applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.

Credits
-------
Thanks to [ryotak](https://hackerone.com/ryotak) for the report!
GitHub Security Advisory: GHSA-vfm5-rmrh-j26v
Package: actionpack (RUBYGEMS)
Severity: LOW (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.1.0, < 7.1.5.1
Patched in: 7.1.5.1

Summary: Possible Content Security Policy bypass in Action Dispatch

Details:
There is a possible Cross Site Scripting (XSS) vulnerability  in the `content_security_policy` helper in Action Pack.

Impact
------
Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks.

Releases
--------
The fixed releases are available at the normal locations.

Workarounds
-----------
Applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.

Credits
-------
Thanks to [ryotak](https://hackerone.com/ryotak) for the report!
GitHub Security Advisory: GHSA-vfm5-rmrh-j26v
Package: actionpack (RUBYGEMS)
Severity: LOW (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 5.2.0, < 7.0.8.7
Patched in: 7.0.8.7

Summary: Possible Content Security Policy bypass in Action Dispatch

Details:
There is a possible Cross Site Scripting (XSS) vulnerability  in the `content_security_policy` helper in Action Pack.

Impact
------
Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks.

Releases
--------
The fixed releases are available at the normal locations.

Workarounds
-----------
Applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.

Credits
-------
Thanks to [ryotak](https://hackerone.com/ryotak) for the report!
GitHub Security Advisory: GHSA-ffp2-8p2h-4m5j
Package: pwpush (RUBYGEMS)
Severity: LOW (CVSS 5.3)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 1.49.0
Patched in: 1.49.0

Summary: Password Pusher rate limiter can be bypassed by forging proxy headers

Details:
### Impact

Password Pusher comes with a configurable rate limiter.  In versions prior to [v1.49.0](https://github.com/pglombardo/PasswordPusher/releases/tag/v1.49.0), the rate limiter could be bypassed by forging proxy headers allowing bad actors to send unlimited traffic to the site potentially causing a denial of service.

Additionally, with the ability to bypass rate limiting, it also allows attackers to more easily execute brute force attacks.

### Patches

In [v1.49.0](https://github.com/pglombardo/PasswordPusher/releases/tag/v1.49.0), a fix was implemented to only authorize proxies on local IPs which resolves this issue.

If you are running a remote proxy, please see [this documentation](https://docs.pwpush.com/docs/proxies/#trusted-proxies) on how to authorize the IP address of your remote proxy.

### Workarounds

It is highly suggested to upgrade to at least [v1.49.0](https://github.com/pglombardo/PasswordPusher/releases/tag/v1.49.0) to mitigate this risk.

If for some reason you cannot immediately upgrade, the alternative is that you can add rules to your proxy and/or firewall to not accept external proxy headers such as `X-Forwarded-*` from clients.

### References

The new settings are [configurable to authorize remote proxies](https://docs.pwpush.com/docs/proxies/#trusted-proxies).

### Credits

Thank you to [Positive Technologies](https://www.ptsecurity.com/ww-en/) for reporting and working with me to bring this CVE to the community with the associated fix.
GitHub Security Advisory: GHSA-hxx2-7vcw-mqr3
Package: sinatra (RUBYGEMS)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-807: Reliance on Untrusted Inputs in a Security Decision
Vulnerable versions: < 4.1.0
Patched in: 4.1.0

Summary: Sinatra vulnerable to Reliance on Untrusted Inputs in a Security Decision

Details:
Versions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the X-Forwarded-Host (XFH) header. When making a request to a method with redirect applied, it is possible to trigger an Open Redirect Attack by inserting an arbitrary address into this header. If used for caching purposes, such as with servers like Nginx, or as a reverse proxy, without handling the X-Forwarded-Host header, attackers can potentially exploit Cache Poisoning or Routing-based SSRF.
GitHub Security Advisory: GHSA-j4h6-gcj7-7v9v
Package: decidim-meetings (RUBYGEMS)
Severity: MODERATE (CVSS 7.7)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 0.28.0, < 0.28.3
Patched in: 0.28.3

Summary: decidim-meetings Cross-site scripting vulnerability in the online or hybrid meeting embeds

Details:
### Impact

The meeting embeds feature used in the online or hybrid meetings is subject to potential XSS attack through a malformed URL.

### Patches

Not available

### Workarounds

Disable the creation of meetings by participants in the meeting component.

### References

OWASP ASVS v4.0.3-5.1.3

### Credits

This issue was discovered in a security audit organized by mitgestalten Partizipationsbüro against Decidim. The security audit was implemented by the Austrian Institute of Technology.
GitHub Security Advisory: GHSA-cxwf-qc32-375f
Package: decidim-decidim_awesome (RUBYGEMS)
Severity: HIGH (CVSS 9.0)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 0.11.0, < 0.11.2
Patched in: 0.11.2

Summary: Decidim-Awesome has SQL injection in AdminAccountability

Details:
## Vulnerability type: 
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
## Vendor: 
Decidim International Community Environment

### Has vendor conﬁrmed: 
Yes

### Attack type:
Remote

### Impact:
Code Execution
Escalation of Privileges
Information Disclosure

### Aﬀected component:
A raw sql-statement that uses an interpolated variable exists in the admin_role_actions method of the
`papertrail/version-model(app/models/decidim/decidim_awesome/paper_trail_version.rb`).

### Attack vector:

An attacker with admin permissions could manipulate database queries in order to read out the database,
read ﬁles from the ﬁlesystem, write ﬁles from the ﬁlesystem. In the worst case, this could lead to remote code
execution on the server.
Description of the vulnerability for use in the CVE [ℹ] (https://cveproject.github.io/docs/content/key-details-
phrasing.pdf) : An improper neutralization of special elements used in an SQL command in the `papertrail/version-
model` of the decidim_awesome-module <= v0.11.1 (> 0.9.0) allows an authenticated admin user to manipulate sql queries
to disclose information, read and write files or execute commands.

### Discoverer Credits:
Wolfgang Hotwagner

### References:
https://pentest.ait.ac.at/security-advisory/decidim-awesome-sql-injection-in-adminaccountability/
https://portswigger.net/web-security/sql-injection
GitHub Security Advisory: GHSA-cxwf-qc32-375f
Package: decidim-decidim_awesome (RUBYGEMS)
Severity: HIGH (CVSS 9.0)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 0.9.1, < 0.10.3
Patched in: 0.10.3

Summary: Decidim-Awesome has SQL injection in AdminAccountability

Details:
## Vulnerability type: 
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
## Vendor: 
Decidim International Community Environment

### Has vendor conﬁrmed: 
Yes

### Attack type:
Remote

### Impact:
Code Execution
Escalation of Privileges
Information Disclosure

### Aﬀected component:
A raw sql-statement that uses an interpolated variable exists in the admin_role_actions method of the
`papertrail/version-model(app/models/decidim/decidim_awesome/paper_trail_version.rb`).

### Attack vector:

An attacker with admin permissions could manipulate database queries in order to read out the database,
read ﬁles from the ﬁlesystem, write ﬁles from the ﬁlesystem. In the worst case, this could lead to remote code
execution on the server.
Description of the vulnerability for use in the CVE [ℹ] (https://cveproject.github.io/docs/content/key-details-
phrasing.pdf) : An improper neutralization of special elements used in an SQL command in the `papertrail/version-
model` of the decidim_awesome-module <= v0.11.1 (> 0.9.0) allows an authenticated admin user to manipulate sql queries
to disclose information, read and write files or execute commands.

### Discoverer Credits:
Wolfgang Hotwagner

### References:
https://pentest.ait.ac.at/security-advisory/decidim-awesome-sql-injection-in-adminaccountability/
https://portswigger.net/web-security/sql-injection
GitHub Security Advisory: GHSA-j945-c44v-97g6
Package: mpxj (RUBYGEMS)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 8.3.5, < 13.5.1
Patched in: 13.5.1

Summary: MPXJ has a Potential Path Traversal Vulnerability

Details:
### Impact
The patch for the historical vulnerability CVE-2020-35460 in MPXJ is incomplete as there is still a possibility that a malicious path could be constructed which would not be picked up by the original fix and allow files to be written to arbitrary locations.

### Patches
The issue is addressed in MPXJ version 13.5.1

### Workarounds
Do not pass zip files to MPXJ.

### References
N/A

### Credits
Issue report and patch provided by yyjLF and sprinkle
GitHub Security Advisory: GHSA-2rxp-v6pw-ch6m
Package: rexml (RUBYGEMS)
Severity: MODERATE (CVSS 7.5)
CWE: CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: < 3.3.9
Patched in: 3.3.9

Summary: REXML ReDoS vulnerability

Details:
### Impact

The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between `&#` and `x...;` in a hex numeric character reference (`&#x...;`).

This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. Note that Ruby 3.1 will reach EOL on 2025-03.

### Patches

The REXML gem 3.3.9 or later include the patch to fix the vulnerability.

### Workarounds

Use Ruby 3.2 or later instead of Ruby 3.1.

### References

* https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761/: An announce on www.ruby-lang.org
GitHub Security Advisory: GHSA-v46j-h43h-rwrm
Package: Autolab (RUBYGEMS)
Severity: HIGH (CVSS 8.8)
CWE: CWE-287: Improper Authentication, CWE-863: Incorrect Authorization
Vulnerable versions: = 3.0.0
Patched in: 3.0.1

Summary: Autolab Misconfigured Reset Password Permissions

Details:
### Impact
For email-based accounts, users with insufficient privileges could reset and theoretically access privileged users' accounts by resetting their passwords.

### Patches
This is fixed in v3.0.1.

### Workarounds
No workarounds.

### For more information
If you have any questions or comments about this advisory:

Open an issue in https://github.com/autolab/Autolab/
Email us at [autolab-dev@andrew.cmu.edu](mailto:autolab-dev@andrew.cmu.edu)
GitHub Security Advisory: GHSA-hhxg-rvc9-8726
Package: camaleon_cms (RUBYGEMS)
Severity: MODERATE (CVSS 4.8)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 2.7.5
Patched in: unpatched

Summary: camaleon_cms affected by cross site scripting

Details:
Cross Site Scripting vulnerability in camaleon-cms v.2.7.5 allows remote attacker to execute arbitrary code via the content group name field.
GitHub Security Advisory: GHSA-h47h-mwp9-c6q6
Package: actionmailer (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: >= 7.2.0, < 7.2.1.1
Patched in: 7.2.1.1

Summary: Possible ReDoS vulnerability in block_format in Action Mailer

Details:
There is a possible ReDoS vulnerability in the block_format helper in Action Mailer. This vulnerability has been assigned the CVE identifier CVE-2024-47889.

Impact
------

Carefully crafted text can cause the block_format helper to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade or apply the relevant patch immediately.

Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 requires Ruby 3.2 or greater so is unaffected.


Releases
--------
The fixed releases are available at the normal locations.

Workarounds
-----------
Users can avoid calling the `block_format` helper or upgrade to Ruby 3.2

Credits
-------

Thanks to yuki_osaki for the report!