deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-vwfg-qj3r-6v3r
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 4.2.0, <= 4.2.5.0
Patched in: 4.2.5.1

Summary: Moderate severity vulnerability that affects actionpack

Details:
Withdrawn, accidental duplicate publish.

The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to bypass authentication by measuring timing differences.
GitHub Security Advisory: GHSA-m53f-rhq8-q6hf
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 4.2.0, <= 4.2.5.0
Patched in: 4.2.5.1

Summary: Moderate severity vulnerability that affects actionpack

Details:
Withdrawn, accidental duplicate publish.

actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header.
GitHub Security Advisory: GHSA-m53f-rhq8-q6hf
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 4.0.0, <= 4.1.14.0
Patched in: 4.1.14.1

Summary: Moderate severity vulnerability that affects actionpack

Details:
Withdrawn, accidental duplicate publish.

actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header.
GitHub Security Advisory: GHSA-m53f-rhq8-q6hf
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: <= 3.2.22.0
Patched in: 3.2.22.1

Summary: Moderate severity vulnerability that affects actionpack

Details:
Withdrawn, accidental duplicate publish.

actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header.
GitHub Security Advisory: GHSA-6834-r92f-jj42
Package: actionview (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 4.2.0, <= 4.2.5.0
Patched in: 4.2.5.1

Summary: Moderate severity vulnerability that affects actionview

Details:
Withdrawn, accidental duplicate publish.

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.
GitHub Security Advisory: GHSA-6834-r92f-jj42
Package: actionview (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 4.1.0, <= 4.1.14.0
Patched in: 4.1.14.1

Summary: Moderate severity vulnerability that affects actionview

Details:
Withdrawn, accidental duplicate publish.

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.
GitHub Security Advisory: GHSA-r4x3-g983-9g48
Package: sprockets (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 2.6.0, < 2.7.1
Patched in: 2.7.1

Summary: Moderate severity vulnerability that affects sprockets

Details:
Withdrawn, accidental duplicate publish.

Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.
GitHub Security Advisory: GHSA-544j-77x9-h938
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 4.0.0, <= 4.1.14.0
Patched in: 4.1.14.1

Summary: Moderate severity vulnerability that affects actionpack

Details:
Withdrawn, accidental duplicate publish.

actionpack/lib/action_dispatch/routing/route_set.rb in Action Pack in Ruby on Rails 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows remote attackers to cause a denial of service (superfluous caching and memory consumption) by leveraging an application's use of a wildcard controller route.
GitHub Security Advisory: GHSA-544j-77x9-h938
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 4.2.0, <= 4.2.5.0
Patched in: 4.2.5.1

Summary: Moderate severity vulnerability that affects actionpack

Details:
Withdrawn, accidental duplicate publish.

actionpack/lib/action_dispatch/routing/route_set.rb in Action Pack in Ruby on Rails 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows remote attackers to cause a denial of service (superfluous caching and memory consumption) by leveraging an application's use of a wildcard controller route.
GitHub Security Advisory: GHSA-9wv8-jgw4-4g28
Package: festivaltts4r (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
Vulnerable versions: >= 0
Patched in: unpatched

Summary: High severity vulnerability that affects festivaltts4r

Details:
Withdrawn, accidental duplicate publish.

The festivaltts4r gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the (1) to_speech or (2) to_mp3 method in lib/festivaltts4r/festival4r.rb.
GitHub Security Advisory: GHSA-m8h6-m9p5-p2f8
Package: activerecord (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 4.2.0, <= 4.2.7.0
Patched in: 4.2.7.1

Summary: Moderate severity vulnerability that affects activerecord

Details:
Withdrawn, accidental duplicate publish.

Active Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660, CVE-2012-2694, and CVE-2013-0155.
GitHub Security Advisory: GHSA-2pwf-xwr3-hp55
Package: actionview (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 4.0.0, <= 4.1.14.1
Patched in: 4.1.14.2

Summary: Moderate severity vulnerability that affects actionview

Details:
Withdrawn, accidental duplicate publish.

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.2 and 4.x before 4.1.14.2 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-0752.
GitHub Security Advisory: GHSA-2pwf-xwr3-hp55
Package: actionview (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 3.2.0, <= 3.2.22.1
Patched in: 3.2.22.2

Summary: Moderate severity vulnerability that affects actionview

Details:
Withdrawn, accidental duplicate publish.

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.2 and 4.x before 4.1.14.2 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-0752.
GitHub Security Advisory: GHSA-hx46-vwmx-wx95
Package: actionpack (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
Vulnerable versions: >= 4.2.0, <= 4.2.5.1
Patched in: 4.2.5.2

Summary: High severity vulnerability that affects actionpack

Details:
Withdrawn, accidental duplicate publish.

Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.
GitHub Security Advisory: GHSA-hx46-vwmx-wx95
Package: actionpack (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
Vulnerable versions: >= 4.0.0, <= 4.1.14.1
Patched in: 4.1.14.2

Summary: High severity vulnerability that affects actionpack

Details:
Withdrawn, accidental duplicate publish.

Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.
GitHub Security Advisory: GHSA-hx46-vwmx-wx95
Package: actionpack (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
Vulnerable versions: >= 3.2.0, <= 3.2.22.1
Patched in: 3.2.22.2

Summary: High severity vulnerability that affects actionpack

Details:
Withdrawn, accidental duplicate publish.

Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.
GitHub Security Advisory: GHSA-q4g7-jrxv-67r9
Package: puppet (RUBYGEMS)
Severity: MODERATE (CVSS 6.5)
Vulnerable versions: < 6.25.1
Patched in: 6.25.1

Summary: Silent Configuration Failure in Puppet Agent

Details:
A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service condition prior to the first 'pluginsync'.
GitHub Security Advisory: GHSA-q4g7-jrxv-67r9
Package: puppet (RUBYGEMS)
Severity: MODERATE (CVSS 6.5)
Vulnerable versions: >= 7.0.0, < 7.12.1
Patched in: 7.12.1

Summary: Silent Configuration Failure in Puppet Agent

Details:
A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service condition prior to the first 'pluginsync'.
GitHub Security Advisory: GHSA-93j5-g845-9wqp
Package: puppet (RUBYGEMS)
Severity: MODERATE (CVSS 6.5)
Vulnerable versions: < 6.25.1
Patched in: 6.25.1

Summary: Unsafe HTTP Redirect in Puppet Agent and Puppet Server

Details:
A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2[PII_REDACTED]
GitHub Security Advisory: GHSA-93j5-g845-9wqp
Package: puppet (RUBYGEMS)
Severity: MODERATE (CVSS 6.5)
Vulnerable versions: >= 7.0.0, < 7.12.1
Patched in: 7.12.1

Summary: Unsafe HTTP Redirect in Puppet Agent and Puppet Server

Details:
A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2[PII_REDACTED]
GitHub Security Advisory: GHSA-26xx-m4q2-xhq8
Package: spree_auth_devise (RUBYGEMS)
Severity: CRITICAL (CVSS 9.3)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: < 4.0.1
Patched in: 4.0.1

Summary: Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness

Details:
### Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of `spree_auth_devise` are affected if `protect_from_forgery` method is both:

* Executed whether as:
  * A before_action callback (the default)
  * A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
* Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏 

### Patches

Spree 4.3 users should update to spree_auth_devise 4.4.1
Spree 4.2 users should update to spree_auth_devise 4.2.1
Spree 4.1 users should update to spree_auth_devise 4.1.1
Older Spree version users should update to spree_auth_devise 4.0.1
 
### Workarounds

If possible, change your strategy to :exception:

```ruby
class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end
```

Add the following to`config/application.rb `to at least run the `:exception` strategy on the affected controller:

```ruby
config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end
```

### References
https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2
GitHub Security Advisory: GHSA-26xx-m4q2-xhq8
Package: spree_auth_devise (RUBYGEMS)
Severity: CRITICAL (CVSS 9.3)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 4.1.0, < 4.1.1
Patched in: 4.1.1

Summary: Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness

Details:
### Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of `spree_auth_devise` are affected if `protect_from_forgery` method is both:

* Executed whether as:
  * A before_action callback (the default)
  * A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
* Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏 

### Patches

Spree 4.3 users should update to spree_auth_devise 4.4.1
Spree 4.2 users should update to spree_auth_devise 4.2.1
Spree 4.1 users should update to spree_auth_devise 4.1.1
Older Spree version users should update to spree_auth_devise 4.0.1
 
### Workarounds

If possible, change your strategy to :exception:

```ruby
class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end
```

Add the following to`config/application.rb `to at least run the `:exception` strategy on the affected controller:

```ruby
config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end
```

### References
https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2
GitHub Security Advisory: GHSA-26xx-m4q2-xhq8
Package: spree_auth_devise (RUBYGEMS)
Severity: CRITICAL (CVSS 9.3)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 4.2.0, < 4.2.1
Patched in: 4.2.1

Summary: Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness

Details:
### Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of `spree_auth_devise` are affected if `protect_from_forgery` method is both:

* Executed whether as:
  * A before_action callback (the default)
  * A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
* Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏 

### Patches

Spree 4.3 users should update to spree_auth_devise 4.4.1
Spree 4.2 users should update to spree_auth_devise 4.2.1
Spree 4.1 users should update to spree_auth_devise 4.1.1
Older Spree version users should update to spree_auth_devise 4.0.1
 
### Workarounds

If possible, change your strategy to :exception:

```ruby
class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end
```

Add the following to`config/application.rb `to at least run the `:exception` strategy on the affected controller:

```ruby
config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end
```

### References
https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2
GitHub Security Advisory: GHSA-gpqc-4pp7-5954
Package: spree_auth_devise (RUBYGEMS)
Severity: CRITICAL (CVSS 9.3)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: < 4.0.1
Patched in: 4.0.1

Summary: Duplicate Advisory: Authentication Bypass by CSRF Weakness

Details:
## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-26xx-m4q2-xhq8. This link is maintained to preserve external references.

## Original Description

### Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of `spree_auth_devise` are affected if `protect_from_forgery` method is both:

* Executed whether as:
  * A before_action callback (the default)
  * A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
* Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏 

### Patches

Spree 4.3 users should update to spree_auth_devise 4.4.1
Spree 4.2 users should update to spree_auth_devise 4.2.1
Spree 4.1 users should update to spree_auth_devise 4.1.1
Older Spree version users should update to spree_auth_devise 4.0.1
 
### Workarounds

If possible, change your strategy to :exception:

```ruby
class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end
```

Add the following to`config/application.rb `to at least run the `:exception` strategy on the affected controller:

```ruby
config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end
```

### References
https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2
GitHub Security Advisory: GHSA-8xfw-5q82-3652
Package: spree_auth_devise (RUBYGEMS)
Severity: CRITICAL (CVSS 9.3)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: = 4.1.0
Patched in: 4.1.1

Summary: Duplicate Advisory: Authentication Bypass by CSRF Weakness

Details:
## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-26xx-m4q2-xhq8. This link is maintained to preserve external references.

## Original Description

### Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of `spree_auth_devise` are affected if `protect_from_forgery` method is both:

* Executed whether as:
  * A before_action callback (the default)
  * A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
* Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏 

### Patches

Spree 4.1 users should update to spree_auth_devise 4.1.1
 
### Workarounds

If possible, change your strategy to :exception:

```ruby
class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end
```

Add the following to`config/application.rb `to at least run the `:exception` strategy on the affected controller:

```ruby
config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end
```

### References
https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2
GitHub Security Advisory: GHSA-6mqr-q86q-6gwr
Package: spree_auth_devise (RUBYGEMS)
Severity: CRITICAL (CVSS 9.3)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: = 4.2.0
Patched in: 4.2.1

Summary: Duplicate Advisory: Authentication Bypass by CSRF Weakness

Details:
## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-26xx-m4q2-xhq8. This link is maintained to preserve external references.

## Original Description

### Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of `spree_auth_devise` are affected if `protect_from_forgery` method is both:

* Executed whether as:
  * A before_action callback (the default)
  * A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
* Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏 

### Patches

Spree 4.3 users should update to spree_auth_devise 4.4.1
Spree 4.2 users should update to spree_auth_devise 4.2.1
 
### Workarounds

If possible, change your strategy to :exception:

```ruby
class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end
```

Add the following to`config/application.rb `to at least run the `:exception` strategy on the affected controller:

```ruby
config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end
```

### References
https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2