deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-fr52-4hqw-p27f
Package: nokogiri (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Vulnerable versions: < 1.7.1
Patched in: 1.7.1

Summary: Nokogiri does not forbid namespace nodes in XPointer ranges

Details:
xpointer.c in libxml2 before 2.9.5 (as used in nokogiri before 1.7.1 amongst other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document.
GitHub Security Advisory: GHSA-cqxw-3p7v-p9gr
Package: passenger (RUBYGEMS)
Severity: HIGH (CVSS 7.8)
Vulnerable versions: < 5.1.0
Patched in: 5.1.0

Summary: Phusion Passenger uses a known /tmp filename

Details:
In Phusion Passenger before 5.1.0, a known /tmp filename was used during passenger-install-nginx-module execution, which could allow local attackers to gain the privileges of the passenger user
GitHub Security Advisory: GHSA-w655-w578-99pq
Package: espeak-ruby (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
Vulnerable versions: < 1.0.3
Patched in: 1.0.3

Summary: High severity vulnerability that affects espeak-ruby

Details:
Withdrawn, accidental duplicate publish.

The espeak-ruby gem before 1.0.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the speak, save, bytes or bytes_wav method in lib/espeak/speech.rb.
GitHub Security Advisory: GHSA-cwp3-834g-x79g
Package: archive-tar-minitar (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 0.6
Patched in: 0.6

Summary: Moderate severity vulnerability that affects archive-tar-minitar and minitar

Details:
Withdrawn, accidental duplicate publish.

Directory traversal vulnerability in the minitar before 0.6 and archive-tar-minitar 0.5.2 gems for Ruby allows remote attackers to write to arbitrary files via a .. (dot dot) in a TAR archive entry.
GitHub Security Advisory: GHSA-cwp3-834g-x79g
Package: minitar (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 0.6
Patched in: 0.6

Summary: Moderate severity vulnerability that affects archive-tar-minitar and minitar

Details:
Withdrawn, accidental duplicate publish.

Directory traversal vulnerability in the minitar before 0.6 and archive-tar-minitar 0.5.2 gems for Ruby allows remote attackers to write to arbitrary files via a .. (dot dot) in a TAR archive entry.
GitHub Security Advisory: GHSA-hm48-76wh-q86v
Package: activerecord (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
Vulnerable versions: >= 4.1.0, < 4.1.5
Patched in: 4.1.5

Summary: High severity vulnerability that affects activerecord

Details:
Withdrawn, accidental duplicate publish.

activerecord/lib/active_record/relation/query_methods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows remote attackers to bypass the strong parameters protection mechanism via crafted input to an application that makes create_with calls.
GitHub Security Advisory: GHSA-hm48-76wh-q86v
Package: activerecord (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
Vulnerable versions: >= 4.0.0, < 4.0.9
Patched in: 4.0.9

Summary: High severity vulnerability that affects activerecord

Details:
Withdrawn, accidental duplicate publish.

activerecord/lib/active_record/relation/query_methods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows remote attackers to bypass the strong parameters protection mechanism via crafted input to an application that makes create_with calls.
GitHub Security Advisory: GHSA-7322-9mx6-5j2m
Package: redcarpet (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Vulnerable versions: >= 3.3.0, < 3.3.2
Patched in: 3.3.2

Summary: redcarpet Buffer Overflow vulnerability

Details:
Stack-based buffer overflow in the `header_anchor` function in the HTML renderer in Redcarpet before 3.3.2 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
GitHub Security Advisory: GHSA-9wcm-rrvh-qjc8
Package: colorscore (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
Vulnerable versions: < 0.0.5
Patched in: 0.0.5

Summary: High severity vulnerability that affects colorscore

Details:
Withdrawn, accidental duplicate publish.

The initialize method in the Histogram class in lib/colorscore/histogram.rb in the colorscore gem before 0.0.5 for Ruby allows context-dependent attackers to execute arbitrary code via shell metacharacters in the (1) image_path, (2) colors, or (3) depth variable.
GitHub Security Advisory: GHSA-694m-jhr9-pf77
Package: doorkeeper (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-732: Incorrect Permission Assignment for Critical Resource
Vulnerable versions: >= 4.2.0, < 4.4.0
Patched in: 4.4.0

Summary: Doorkeeper subject to Incorrect Permission Assignment

Details:
Doorkeeper version 4.2.0 and later contains a Incorrect Access Control vulnerability in Token revocation API's authorized method that can result in Access tokens are not revoked for public OAuth apps, leaking access until expiry.
GitHub Security Advisory: GHSA-8474-rc7c-wrhp
Package: safemode (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
Vulnerable versions: < 1.3.3
Patched in: 1.3.3

Summary: High severity vulnerability that affects safemode

Details:
Withdrawn, accidental duplicate publish.

The safemode rubygem, as used in Foreman, versions 1.3.2 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax. This can lead to deletion of objects for which the user does not have delete permissions or possibly to privilege escalation.
GitHub Security Advisory: GHSA-5p9f-55j8-922m
Package: doorkeeper (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 1.2.0, < 4.2.0
Patched in: 4.2.0

Summary: Moderate severity vulnerability that affects doorkeeper

Details:
Withdrawn, accidental duplicate publish.

The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging failure to implement the OAuth 2.0 Token Revocation specification.
GitHub Security Advisory: GHSA-44vc-fpcg-5cc5
Package: safemode (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 1.2.4
Patched in: 1.2.4

Summary: Moderate severity vulnerability that affects safemode

Details:
Withdrawn, accidental duplicate publish.

The Safemode gem before 1.2.4 for Ruby, when initialized with a delegate object that is a Rails controller, allows context-dependent attackers to obtain sensitive information via the inspect method.
GitHub Security Advisory: GHSA-pxqr-8v54-m2hj
Package: rails_admin (RUBYGEMS)
Severity: HIGH (CVSS 8.8)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 1.0.0, < 1.1.1
Patched in: 1.1.1

Summary: Cross-site request forgery in rails_admin

Details:
rails_admin ruby gem <v1.1.1 is vulnerable to cross-site request forgery (CSRF) attacks. Non-GET methods were not validating CSRF tokens and, as a result, an attacker could hypothetically gain access to the application administrative endpoints exposed by the gem.
GitHub Security Advisory: GHSA-82x2-g7vr-39wq
Package: web-console (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 2.1.3
Patched in: 2.1.3

Summary: Moderate severity vulnerability that affects web-console

Details:
Withdrawn, accidental duplicate publish.

request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request.
GitHub Security Advisory: GHSA-phmw-pv3f-vvx7
Package: paperclip (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 4.2.2
Patched in: 4.2.2

Summary: Moderate severity vulnerability that affects paperclip

Details:
Withdrawn, accidental duplicate publish.

The thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type value during media-type validation, which allows remote attackers to upload HTML documents and conduct cross-site scripting (XSS) attacks via a spoofed value, as demonstrated by image/jpeg.
GitHub Security Advisory: GHSA-995j-587r-259w
Package: rack-mini-profiler (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 0.10.1
Patched in: 0.10.1

Summary: Moderate severity vulnerability that affects rack-mini-profiler

Details:
Withdrawn, accidental duplicate publish.

The rack-mini-profiler gem before 0.10.1 for Ruby allows remote attackers to obtain sensitive information about allocated strings and objects by leveraging incorrect ordering of security checks.
GitHub Security Advisory: GHSA-534w-937m-v7x3
Package: restforce (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-20: Improper Input Validation, CWE-172: Encoding Error
Vulnerable versions: < 3.0.0
Patched in: 3.0.0

Summary: restforce vulnerable to Improper Input Validation

Details:
A flaw in how restforce constructs URLs may allow an attacker to inject additional parameters into Salesforce API requests.   

Impact
------
This flaw is only exploitable in applications that pass user input directly to restforce's select, find, describe, update, upsert, and destroy methods. 

Vulnerable code might look like:
```ruby
  client.select('SomeSalesForceObject', params[:some-id],
     ...)
```

In such an application, attackers could pass `[PII_REDACTED]MRatd/describe`  as a request parameter, causing the server to make a request to a different endpoint than the server is designed to handle. Since the Salesforce REST API supports overriding HTTP methods via a request parameter, an attacker could also cause the client's `select()` method to modify data, by passing `[PII_REDACTED]MRatd/?_HttpMethod=PATCH&other-query-params=...`.

Workarounds
------
If possible, applications should track salesforce IDs internally, rather than passing user-supplied IDs to salesforce. Such practice mitigates this vulnerability, and in general is desirable for ensuring strong access control.
GitHub Security Advisory: GHSA-pf6m-fxpq-fg8v
Package: nokogiri (RUBYGEMS)
Severity: HIGH (CVSS 8.8)
CWE: CWE-787: Out-of-bounds Write
Vulnerable versions: < 1.7.2
Patched in: 1.7.2

Summary: Nokogiri implementation of libxslt lacks integer overflow checks

Details:
The xsltAddTextString function in transform.c in libxslt 1.1.29, as used in Nokogiri prior to 1.7.2, lacked a check for integer overflow during a size calculation, which allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.
GitHub Security Advisory: GHSA-3q5q-f79q-7hr2
Package: rubyzip (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
Vulnerable versions: < 1.2.1
Patched in: 1.2.1

Summary: High severity vulnerability that affects rubyzip

Details:
Withdrawn, accidental duplicate publish.

The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses "../" pathname substrings to write arbitrary files to the filesystem.
GitHub Security Advisory: GHSA-69mv-3642-wj3w
Package: sensu (RUBYGEMS)
Severity: LOW (CVSS 0.0)
Vulnerable versions: < 1.2.1
Patched in: 1.2.1

Summary: Low severity vulnerability that affects sensu

Details:
The sensu rubygem prior to version 1.2.0 contains a CWE-522 (Insufficiently Protected Credentials) flaw that can result in sensitive configuration data (e.g. passwords) being logged in clear-text. 

Users are advised to upgrade to rubygem version 1.2.1 or later.
GitHub Security Advisory: GHSA-px3r-jm9g-c8w8
Package: rails-html-sanitizer (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.0.4
Patched in: 1.0.4

Summary: rails-html-sanitizer Cross-site Scripting vulnerability

Details:
There is a possible XSS vulnerability in all rails-html-sanitizer gem versions below 1.0.4 for Ruby. The gem allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments, and these attributes can lead to an XSS attack on target applications. This issue is similar to CVE-2018-8048 in Loofah. All users running an affected release should either upgrade or use one of the workarounds immediately.
GitHub Security Advisory: GHSA-882p-jqgm-f45g
Package: nokogiri (RUBYGEMS)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 1.8.2
Patched in: 1.8.2

Summary: Uncontrolled resource consumption in nokogiri

Details:
The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.
GitHub Security Advisory: GHSA-x7rv-cr6v-4vm4
Package: loofah (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.2.1
Patched in: 2.2.1

Summary: Cross-site Scripting in loofah

Details:
Loofah allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments.

Users are affected if running Loofah < 2.2.1, but only:

* when running on MRI or RBX,
* in combination with libxml2 >= 2.9.2.

JRuby users are not affected.
GitHub Security Advisory: GHSA-hwhh-2fwm-cfgw
Package: doorkeeper (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.1.0, <= 4.2.5
Patched in: 4.2.6

Summary: Doorkeeper is vulnerable to stored XSS and code execution

Details:
Doorkeeper version 2.1.0 through 4.2.5 contains a Cross Site Scripting (XSS) vulnerability in web view's OAuth app form, user authorization prompt web view that can result in Stored XSS on the OAuth Client's name will cause users interacting with it will execute payload. This attack appear to be exploitable via The victim must be tricked to click an opaque link to the web view that runs the XSS payload. A malicious version virtually indistinguishable from a normal link. This vulnerability appears to have been fixed in 4.2.6, 4.3.0.
GitHub Security Advisory: GHSA-pxr8-w3jq-rcwj
Package: rails_admin (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.3.0
Patched in: 1.3.0

Summary: rails_admin ruby gem XSS

Details:
An exploitable cross site scripting (XSS) vulnerability exists in the add filter functionality of the rails_admin rails gem version 1.2.0. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim's browser. An attacker can phish an authenticated user to trigger this vulnerability.
GitHub Security Advisory: GHSA-5jcf-c5rg-rmm8
Package: paperclip (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 3.1.4, < 5.2.0
Patched in: 5.2.0

Summary: paperclip Server-Side Request Forgery vulnerability

Details:
Paperclip ruby gem version 3.1.4 and later suffers from a Server-SIde Request Forgery (SSRF) vulnerability in the `Paperclip::UriAdapter` class. Attackers may be able to access information about internal network resources.
GitHub Security Advisory: GHSA-m7p8-9w66-9frm
Package: net-ldap (RUBYGEMS)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-295: Improper Certificate Validation
Vulnerable versions: < 0.16.0
Patched in: 0.16.0

Summary: net-ldap Improper Certificate Validation vulnerability

Details:
The Net::LDAP (aka net-ldap) gem before 0.16.0 for Ruby has Missing SSL Certificate Validation.
GitHub Security Advisory: GHSA-gj4p-3wh3-2rmf
Package: yard (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 0.9.11
Patched in: 0.9.11

Summary: Arbitrary file read vulnerability in yard server

Details:
`lib/yard/core_ext/file.rb` in the server in YARD before 0.9.11 does not block relative paths with an initial `../` sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.
GitHub Security Advisory: GHSA-8c56-cpmw-89x7
Package: nokogiri (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-125: Out-of-bounds Read
Vulnerable versions: < 1.8.1
Patched in: 1.8.1

Summary: Out-of-bounds read in nokogiri

Details:
libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839.  GitHub is notifying on nokogiri as uses libxml2.
GitHub Security Advisory: GHSA-3v3c-r5v2-68ph
Package: private_address_check (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-184: Incomplete List of Disallowed Inputs
Vulnerable versions: < 0.4.1
Patched in: 0.4.1

Summary: private_address_check contains Incomplete List of Disallowed Inputs

Details:
The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete blacklist of common private/local network addresses used to prevent server-side request forgery.
GitHub Security Advisory: GHSA-hxhj-hp9m-qwc4
Package: private_address_check (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-242: Use of Inherently Dangerous Function
Vulnerable versions: < 0.4.0
Patched in: 0.4.0

Summary: private_address_check vulnerable to bypass of Resolv.getaddresses method

Details:
The private_address_check ruby gem before 0.4.0 is vulnerable to a bypass due to use of Ruby's `Resolv.getaddresses` method, which is OS-dependent and should not be relied upon for security measures, such as when used to blacklist private network addresses to prevent server-side request forgery.
GitHub Security Advisory: GHSA-653m-r33x-39ff
Package: geminabox (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 0.13.10
Patched in: 0.13.10

Summary: Geminabox contains Cross-site Scripting

Details:
Stored cross-site scripting (XSS) vulnerability in "geminabox" (Gem in a Box) before 0.13.10 allows attackers to inject arbitrary web script via the "homepage" value of a ".gemspec" file, related to views/gem.erb and views/index.erb.
GitHub Security Advisory: GHSA-q97v-764g-r2rp
Package: gollum-lib (RUBYGEMS)
Severity: HIGH (CVSS 8.8)
CWE: CWE-284: Improper Access Control
Vulnerable versions: < 4.0.1
Patched in: 4.0.1

Summary: gollum and gollum-lib allow remote authenticated users to execute arbitrary code

Details:
The gollum-grit_adapter Ruby gem dependency in gollum before 3.1.1 and the gollum-lib gem dependency in gollum-lib before 4.0.1 when the string `master` is in any of the wiki documents, allows remote authenticated users to execute arbitrary code via the `-O` or `--open-files-in-pager` flags.
GitHub Security Advisory: GHSA-q97v-764g-r2rp
Package: gollum (RUBYGEMS)
Severity: HIGH (CVSS 8.8)
CWE: CWE-284: Improper Access Control
Vulnerable versions: < 3.1.1
Patched in: 3.1.1

Summary: gollum and gollum-lib allow remote authenticated users to execute arbitrary code

Details:
The gollum-grit_adapter Ruby gem dependency in gollum before 3.1.1 and the gollum-lib gem dependency in gollum-lib before 4.0.1 when the string `master` is in any of the wiki documents, allows remote authenticated users to execute arbitrary code via the `-O` or `--open-files-in-pager` flags.
GitHub Security Advisory: GHSA-574q-fxfj-wv6h
Package: puppet (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 2.7.0, < 2.7.21
Patched in: 2.7.21

Summary: Puppet Improper Input Validation vulnerability

Details:
Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "serialized attributes."
GitHub Security Advisory: GHSA-wwmf-6p58-6vj2
Package: rwiki (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
Vulnerable versions: >= 2.1.0pre1, < 2.1.1
Patched in: 2.1.1

Summary: Remote code execution in rwiki

Details:
The editing form in RWiki 2.1.0pre1 through 2.1.0 allows remote attackers to execute arbitrary Ruby code via unknown attack vectors.
GitHub Security Advisory: GHSA-rvpq-5xqx-pfpp
Package: rails (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 1.1.0, < 1.1.6
Patched in: 1.1.6

Summary: Ruby on Rails vulnerable to code injection

Details:
Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with "severe" or "serious" impact via a File Upload request with an HTTP header that modifies the LOAD_PATH variable, a different vulnerability than CVE-2006-4112.
GitHub Security Advisory: GHSA-9wrq-xvmp-xjc8
Package: rails (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
Vulnerable versions: >= 1.1.0, < 1.1.6
Patched in: 1.1.6

Summary: Rails Denial of Service vulnerability

Details:
Unspecified vulnerability in the "dependency resolution mechanism" in Ruby on Rails 1.1.0 through 1.1.5 allows remote attackers to execute arbitrary Ruby code via a URL that is not properly handled in the routing code, which leads to a denial of service (application hang) or "data loss," a different vulnerability than CVE-2006-4111.
GitHub Security Advisory: GHSA-gm25-fpmr-43fj
Package: rails (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.2.5
Patched in: 1.2.5

Summary: Moderate severity vulnerability that affects rails

Details:
Cross-site scripting (XSS) vulnerability in the to_json (ActiveRecord::Base#to_json) function in Ruby on Rails before edge 9606 allows remote attackers to inject arbitrary web script via the input values.
GitHub Security Advisory: GHSA-jwhv-rgqc-fqj5
Package: rails (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-384: Session Fixation
Vulnerable versions: < 1.2.4
Patched in: 1.2.4

Summary: Session fixation vulnerability in Rails 

Details:
Session fixation vulnerability in Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers to hijack web sessions via unspecified vectors related to "URL-based sessions."
GitHub Security Advisory: GHSA-p4c6-77gc-694x
Package: rails (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Vulnerable versions: < 1.2.6
Patched in: 1.2.6

Summary: session fixation protection mechanism in cgi_process.rb in Rails

Details:
The session fixation protection mechanism in cgi_process.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookie_only attribute from the DEFAULT_SESSION_OPTIONS constant, which effectively causes cookie_only to be applied only to the first instantiation of CgiRequest, which allows remote attackers to conduct session fixation attacks.  NOTE: this is due to an incomplete fix for CVE-2007-5380.
GitHub Security Advisory: GHSA-xgj6-pgrm-x4r2
Package: gtk2 (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-134: Use of Externally-Controlled Format String
Vulnerable versions: < 0.17.0
Patched in: 0.17.0

Summary: gtk2 vulnerable to Use of Externally-Controlled Format String

Details:
Format string vulnerability in the `mdiag_initialize` function in `gtk/src/rbgtkmessagedialog.c` in Ruby-GNOME 2 (aka Ruby/Gnome2) 0.16.0, and SVN versions before 20071127, allows context-dependent attackers to execute arbitrary code via format string specifiers in the message parameter.