deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-pf9w-gvcf-gv7m
Package: nokogiri (RUBYGEMS)
Severity: LOW (CVSS 3.3)
CWE: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Vulnerable versions: = 0
Patched in: unpatched

Summary: sparklemotion nokogiri hashmap.c hashmap_set_with_hash heap-based overflow

Details:
### Withdrawn Advisory

This advisory has been withdrawn because the affected code was never included in a release. This link has been maintained to preserve external references.

### Original Description

A vulnerability was found in sparklemotion nokogiri c29c920907366cb74af13b4dc2230e9c9e23b833 and classified as problematic. This issue affects the function hashmap_set_with_hash of the file gumbo-parser/src/hashmap.c. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The identifier of the patch is ada4708e5a67114402cd3feb70a4e1d1d7cf773a. It is recommended to apply a patch to fix this issue. The project maintainer explains that the affected code was merged into the main branch but the commit never appeared in an official release.
GitHub Security Advisory: GHSA-jc9r-qcgw-fxq9
Package: nokogiri (RUBYGEMS)
Severity: LOW (CVSS 3.3)
CWE: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Vulnerable versions: = 0
Patched in: unpatched

Summary: sparklemotion nokogiri hashmap.c hashmap_get_with_hash heap-based overflow

Details:
### Withdrawn Advisory

This advisory has been withdrawn because the affected code was never included in a release. This link has been maintained to preserve external references.

### Original Description

A vulnerability was found in sparklemotion nokogiri c29c920907366cb74af13b4dc2230e9c9e23b833. It has been classified as problematic. This affects the function hashmap_get_with_hash of the file gumbo-parser/src/hashmap.c. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The patch is named ada4708e5a67114402cd3feb70a4e1d1d7cf773a. It is recommended to apply a patch to fix this issue. The project maintainer explains that the affected code was merged into the main branch but the commit never appeared in an official release.
GitHub Security Advisory: GHSA-r995-q44h-hr64
Package: webrick (RUBYGEMS)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Vulnerable versions: < 1.8.2
Patched in: 1.8.2

Summary: Ruby WEBrick read_headers method can lead to HTTP Request/Response Smuggling

Details:
Ruby WEBrick read_header HTTP Request Smuggling Vulnerability. This vulnerability allows remote attackers to smuggle arbitrary HTTP requests on affected installations of Ruby WEBrick. This issue is exploitable when the product is deployed behind an HTTP proxy that fulfills specific conditions.

The specific flaw exists within the read_headers method. The issue results from the inconsistent parsing of terminators of HTTP headers. An attacker can leverage this vulnerability to smuggle arbitrary HTTP requests. Was ZDI-CAN-21876.
GitHub Security Advisory: GHSA-h6gj-6jjq-h8g9
Package: jquery-ui-rails (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 8.0.0
Patched in: 8.0.0

Summary: jQuery UI vulnerable to XSS when refreshing a checkboxradio with an HTML-like initial text label

Details:
### Impact
Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. If you call `.checkboxradio( "refresh" )` on such a widget and the initial HTML contained encoded HTML entities, they will erroneously get decoded. This can lead to potentially executing JavaScript code.

For example, starting with the following initial secure HTML:
```html
<label>
	<input id="test-input">
	&lt;img src=x onerror="alert(1)"&gt;
</label>
```
and calling:
```js
$( "#test-input" ).checkboxradio();
$( "#test-input" ).checkboxradio( "refresh" );
```
will turn the initial HTML into:
```html
<label>
	<!-- some jQuery UI elements -->
	<input id="test-input">
	<img src=x onerror="alert(1)">
</label>
```
and the alert will get executed.

### Patches
The bug has been patched in jQuery UI 1.13.2.

### Workarounds
To remediate the issue, if you can change the initial HTML, you can wrap all the non-input contents of the `label` in a `span`:
```html
<label>
	<input id="test-input">
	<span>&lt;img src=x onerror="alert(1)"&gt;</span>
</label>
```

### References
https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/

### For more information
If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery UI repo](https://github.com/jquery/jquery-ui/issues?q=is%3Aissue+is%3Aopen+sort%3Aupdated-desc). If you don't find an answer, open a new issue.
GitHub Security Advisory: GHSA-cf8v-5mrc-jv7f
Package: openc3-cosmos-tool-iframe (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: = 6.0.0
Patched in: unpatched

Summary: OpenC3 COSMOS Vulnerable to Directory Traversal via openc3-api/tables endpoint

Details:
An issue in the openc3-api/tables endpoint of OpenC3 COSMOS 6.0.0 allows attackers to execute a directory traversal.
GitHub Security Advisory: GHSA-p67j-387g-75wc
Package: openc3-cosmos-tool-iframe (RUBYGEMS)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: = 6.0.0
Patched in: unpatched

Summary: OpenC3 COSMOS Vulnerable to Directory Traversal via /script-api/scripts/ endpoint

Details:
An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS 6.0.0 allows attackers to execute a directory traversal.
GitHub Security Advisory: GHSA-47m2-26rw-j2jw
Package: rack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 3.1.0, < 3.1.16
Patched in: 3.1.16

Summary: ReDoS Vulnerability in Rack::Multipart handle_mime_head

Details:
### Summary
There is a denial of service vulnerability in the Content-Disposition parsing component of Rack. This is very similar to the previous security issue CVE-2022-44571.

### Details

Carefully crafted input can cause Content-Disposition header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is used typically used in multipart parsing. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.

### Credits

Thanks to [scyoon](https://hackerone.com/scyoon) for reporting this to the Rails security team
GitHub Security Advisory: GHSA-gwfg-cqmg-cf8f
Package: webrick (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Vulnerable versions: < 1.4.4
Patched in: 1.4.4

Summary: WEBRick vulnerable to HTTP Request/Response Smuggling

Details:
An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.
GitHub Security Advisory: GHSA-gwfg-cqmg-cf8f
Package: webrick (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Vulnerable versions: = 1.5.0
Patched in: 1.5.1

Summary: WEBRick vulnerable to HTTP Request/Response Smuggling

Details:
An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.
GitHub Security Advisory: GHSA-gwfg-cqmg-cf8f
Package: webrick (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Vulnerable versions: = 1.6.0
Patched in: 1.6.1

Summary: WEBRick vulnerable to HTTP Request/Response Smuggling

Details:
An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.
GitHub Security Advisory: GHSA-2c47-m757-32g6
Package: ejson2env (RUBYGEMS)
Severity: MODERATE (CVSS 6.6)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: < 2.0.8
Patched in: 2.0.8

Summary: Insufficient input sanitization in ejson2env 

Details:
### Summary
The `ejson2env` tool has a vulnerability related to how it writes to `stdout`. Specifically, the tool is intended to write an export statement for environment variables and their values. However, due to inadequate output sanitization, there is a potential risk where variable names or values may include malicious content, resulting in additional unintended commands being output to `stdout`. If this output is improperly utilized in further command execution, it could lead to command injection vulnerabilities, allowing an attacker to execute arbitrary commands on the host system.

### Details
The vulnerability exists because environment variables are not properly sanitized during the decryption phase, which enables malicious keys or encrypted values to inject commands.

### Impact
An attacker with control over  `.ejson` files can inject commands in the environment where `source $(ejson2env)`  or `eval ejson2env` are executed.


### Mitigation
- Update to a version of `ejson2env` that sanitizes the output during decryption or
- Do not use `ejson2env` to decrypt untrusted user secrets or
- Do not evaluate or execute the direct output from `ejson2env` without removing nonprintable characters.

### Credit
Thanks to security researcher [Demonia](https://hackerone.com/demonia?type=user) for reporting this issue.
GitHub Security Advisory: GHSA-gjh7-p2fx-99vx
Package: rack (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 3.1, < 3.1.14
Patched in: 3.1.14

Summary: Rack has an Unbounded-Parameter DoS in Rack::QueryParser

Details:
## Summary

`Rack::QueryParser` parses query strings and `application/x-www-form-urlencoded` bodies into Ruby data structures without imposing any limit on the number of parameters, allowing attackers to send requests with extremely large numbers of parameters.

## Details

The vulnerability arises because `Rack::QueryParser` iterates over each `&`-separated key-value pair and adds it to a Hash without enforcing an upper bound on the total number of parameters. This allows an attacker to send a single request containing hundreds of thousands (or more) of parameters, which consumes excessive memory and CPU during parsing.

## Impact

An attacker can trigger denial of service by sending specifically crafted HTTP requests, which can cause memory exhaustion or pin CPU resources, stalling or crashing the Rack server. This results in full service disruption until the affected worker is restarted.

## Mitigation

- Update to a version of Rack that limits the number of parameters parsed, or
- Use middleware to enforce a maximum query string size or parameter count, or
- Employ a reverse proxy (such as Nginx) to limit request sizes and reject oversized query strings or bodies.

Limiting request body sizes and query string lengths at the web server or CDN level is an effective mitigation.
GitHub Security Advisory: GHSA-gjh7-p2fx-99vx
Package: rack (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 3.0, < 3.0.16
Patched in: 3.0.16

Summary: Rack has an Unbounded-Parameter DoS in Rack::QueryParser

Details:
## Summary

`Rack::QueryParser` parses query strings and `application/x-www-form-urlencoded` bodies into Ruby data structures without imposing any limit on the number of parameters, allowing attackers to send requests with extremely large numbers of parameters.

## Details

The vulnerability arises because `Rack::QueryParser` iterates over each `&`-separated key-value pair and adds it to a Hash without enforcing an upper bound on the total number of parameters. This allows an attacker to send a single request containing hundreds of thousands (or more) of parameters, which consumes excessive memory and CPU during parsing.

## Impact

An attacker can trigger denial of service by sending specifically crafted HTTP requests, which can cause memory exhaustion or pin CPU resources, stalling or crashing the Rack server. This results in full service disruption until the affected worker is restarted.

## Mitigation

- Update to a version of Rack that limits the number of parameters parsed, or
- Use middleware to enforce a maximum query string size or parameter count, or
- Employ a reverse proxy (such as Nginx) to limit request sizes and reject oversized query strings or bodies.

Limiting request body sizes and query string lengths at the web server or CDN level is an effective mitigation.
GitHub Security Advisory: GHSA-gjh7-p2fx-99vx
Package: rack (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 2.2.14
Patched in: 2.2.14

Summary: Rack has an Unbounded-Parameter DoS in Rack::QueryParser

Details:
## Summary

`Rack::QueryParser` parses query strings and `application/x-www-form-urlencoded` bodies into Ruby data structures without imposing any limit on the number of parameters, allowing attackers to send requests with extremely large numbers of parameters.

## Details

The vulnerability arises because `Rack::QueryParser` iterates over each `&`-separated key-value pair and adds it to a Hash without enforcing an upper bound on the total number of parameters. This allows an attacker to send a single request containing hundreds of thousands (or more) of parameters, which consumes excessive memory and CPU during parsing.

## Impact

An attacker can trigger denial of service by sending specifically crafted HTTP requests, which can cause memory exhaustion or pin CPU resources, stalling or crashing the Rack server. This results in full service disruption until the affected worker is restarted.

## Mitigation

- Update to a version of Rack that limits the number of parameters parsed, or
- Use middleware to enforce a maximum query string size or parameter count, or
- Employ a reverse proxy (such as Nginx) to limit request sizes and reject oversized query strings or bodies.

Limiting request body sizes and query string lengths at the web server or CDN level is an effective mitigation.
GitHub Security Advisory: GHSA-9j94-67jr-4cqj
Package: rack-session (RUBYGEMS)
Severity: MODERATE (CVSS 4.2)
CWE: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'), CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition, CWE-613: Insufficient Session Expiration
Vulnerable versions: >= 2.0.0, < 2.1.1
Patched in: 2.1.1

Summary: Rack session gets restored after deletion

Details:
## Summary

When using the `Rack::Session::Pool` middleware, simultaneous rack requests can restore a deleted rack session, which allows the unauthenticated user to occupy that session.

## Details

[Rack session middleware](https://github.com/rack/rack-session/blob/v2.1.0/lib/rack/session/abstract/id.rb#L271-L278) prepares the session at the beginning of request, then saves is back to the store with possible changes applied by host rack application. This way the session becomes to be a subject of race conditions in general sense over concurrent rack requests.

## Impact

When using the `Rack::Session::Pool` middleware, and provided the attacker can acquire a session cookie (already a major issue), the session may be restored if the attacker can trigger a long running request (within that same session) adjacent to the user logging out, in order to retain illicit access even after a user has attempted to logout.

## Mitigation

- Update to the latest version of `rack-session`, or
- Ensure your application invalidates sessions atomically by marking them as logged out e.g., using a `logged_out` flag, instead of deleting them, and check this flag on every request to prevent reuse, or
- Implement a custom session store that tracks session invalidation timestamps and refuses to accept session data if the session was invalidated after the request began.

## Related

This code was previously part of `rack` in Rack < 3, see <https://github.com/rack/rack/security/advisories/GHSA-vpfw-47h7-xj4g> for the equivalent advisory in `rack` (affecting Rack < 3 only).
GitHub Security Advisory: GHSA-vpfw-47h7-xj4g
Package: rack (RUBYGEMS)
Severity: MODERATE (CVSS 4.2)
CWE: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'), CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition, CWE-613: Insufficient Session Expiration
Vulnerable versions: <= 2.2.13
Patched in: 2.2.14

Summary: Rack session gets restored after deletion

Details:
### Summary

When using the `Rack::Session::Pool` middleware, simultaneous rack requests can restore a deleted rack session, which allows the unauthenticated user to occupy that session.

### Details

[Rack session middleware](https://github.com/rack/rack/blob/v2.2.13/lib/rack/session/abstract/id.rb#L263-L270) prepares the session at the beginning of request, then saves is back to the store with possible changes applied by host rack application. This way the session becomes to be a subject of race conditions in general sense over concurrent rack requests.

### Impact

When using the `Rack::Session::Pool` middleware, and provided the attacker can acquire a session cookie (already a major issue), the session may be restored if the attacker can trigger a long running request (within that same session) adjacent to the user logging out, in order to retain illicit access even after a user has attempted to logout.

## Mitigation

- Update to the latest version of `rack`, or
- Ensure your application invalidates sessions atomically by marking them as logged out e.g., using a `logged_out` flag, instead of deleting them, and check this flag on every request to prevent reuse, or
- Implement a custom session store that tracks session invalidation timestamps and refuses to accept session data if the session was invalidated after the request began.

### Related

As this code was moved to `rack-session` in Rack 3+, see <https://github.com/rack/rack-session/security/advisories/GHSA-9j94-67jr-4cqj> for the equivalent advisory in `rack-session` (affecting Rack 3+ only).
GitHub Security Advisory: GHSA-fjfg-q662-gm6j
Package: rails (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: < 1.2.4
Patched in: 1.2.4

Summary: Moderate severity vulnerability that affects rails

Details:
Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.from_xml (Hash#from_xml) method, which uses XmlSimple (XML::Simple) unsafely, as demonstrated by reading passwords from the Pidgin (Gaim) .purple/accounts.xml file.
GitHub Security Advisory: GHSA-5w6v-399v-w3cc
Package: nokogiri (RUBYGEMS)
Severity: LOW (CVSS 0.0)
CWE: CWE-1395: Dependency on Vulnerable Third-Party Component
Vulnerable versions: < 1.18.8
Patched in: 1.18.8

Summary: Nokogiri updates packaged libxml2 to v2.13.8 to resolve CVE-2025-32414 and CVE-2025-32415

Details:
## Summary

Nokogiri v1.18.8 upgrades its dependency libxml2 to [v2.13.8](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.8).

libxml2 v2.13.8 addresses:

- CVE-2025-32414
  - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/889
- CVE-2025-32415
  - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/890

## Impact

### CVE-2025-32414: No impact

In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an incorrect return value. This occurs in xmlPythonFileRead and xmlPythonFileReadRaw because of a difference between bytes and characters.

**There is no impact** from this CVE for Nokogiri users.


### CVE-2025-32415: Low impact

In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.

In the upstream issue, further context is provided by the maintainer:

> The bug affects validation against untrusted XML Schemas (.xsd) and validation of untrusted
> documents against trusted Schemas if they make use of xsd:keyref in combination with recursively
> defined types that have additional identity constraints.

MITRE has published a severity score of 2.9 LOW (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) for this CVE.
GitHub Security Advisory: GHSA-8qhq-rq4j-8prj
Package: logstash (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: >= 1.0.14, < 1.4.2
Patched in: 1.4.2

Summary: Elasticsearch Logstash allows remote attackers to execute arbitrary commands

Details:
Elasticsearch Logstash 1.0.14 through 1.4.x before 1.4.2 allows remote attackers to execute arbitrary commands via a crafted event in (1) `zabbix.rb` or (2) `nagios_nsca.rb` in `outputs/`.
GitHub Security Advisory: GHSA-j96r-xvjq-r9pg
Package: activesupport (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 3.2.22
Patched in: 3.2.22

Summary: activesupport vulnerable to Denial of Service via large XML document depth

Details:
The (1) `jdom.rb` and (2) `rexml.rb` components in Active Support in Ruby on Rails before 3.2.22, 4.1.x before 4.1.11, and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.
GitHub Security Advisory: GHSA-j96r-xvjq-r9pg
Package: activesupport (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 4.2.0.beta1, < 4.2.2
Patched in: 4.2.2

Summary: activesupport vulnerable to Denial of Service via large XML document depth

Details:
The (1) `jdom.rb` and (2) `rexml.rb` components in Active Support in Ruby on Rails before 3.2.22, 4.1.x before 4.1.11, and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.
GitHub Security Advisory: GHSA-j96r-xvjq-r9pg
Package: activesupport (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 4.0.0.beta1, < 4.1.11
Patched in: 4.1.11

Summary: activesupport vulnerable to Denial of Service via large XML document depth

Details:
The (1) `jdom.rb` and (2) `rexml.rb` components in Active Support in Ruby on Rails before 3.2.22, 4.1.x before 4.1.11, and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.