deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-pj73-v5mw-pm9j
Package: activesupport (RUBYGEMS)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.0.0, < 7.0.4.3
Patched in: 7.0.4.3

Summary: Possible XSS Security Vulnerability in SafeBuffer#bytesplice

Details:
There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input.
This vulnerability has been assigned the CVE identifier CVE-2023-28120.

Versions Affected: All. Not affected: None Fixed Versions: 7.0.4.3, 6.1.7.3

# Impact

ActiveSupport uses the SafeBuffer string subclass to tag strings as html_safe after they have been sanitized.
When these strings are mutated, the tag is should be removed to mark them as no longer being html_safe.

Ruby 3.2 introduced a new bytesplice method which ActiveSupport did not yet understand to be a mutation.
Users on older versions of Ruby are likely unaffected.

All users running an affected release and using bytesplice should either upgrade or use one of the workarounds immediately.

# Workarounds

Avoid calling bytesplice on a SafeBuffer (html_safe) string with untrusted user input.
GitHub Security Advisory: GHSA-f599-5m7p-hcpf
Package: grape (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.1.0
Patched in: 1.1.0

Summary: grape subject to Cross-site Scripting

Details:
The grape rubygem suffers from a cross-site scripting (XSS) vulnerability via "format" parameter.
GitHub Security Advisory: GHSA-p7f2-rr42-m9xm
Package: rubygems-update (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 2.6.13
Patched in: 2.6.13

Summary: RubyGems Improper Input Validation vulnerability

Details:
RubyGems versions 2.6.12 and earlier are vulnerable to maliciously crafted gem specifications that cause a denial of service attack against RubyGems clients who have issued a `query` command.
GitHub Security Advisory: GHSA-qj2w-mw2r-pv39
Package: rubygems-update (RUBYGEMS)
Severity: HIGH (CVSS 7.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 2.7.6
Patched in: 2.7.6

Summary: RubyGems Deserialization of Untrusted Data vulnerability

Details:
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data vulnerability in owner command that can result in code execution. This attack requires the victim to run the `gem owner` command on a gem with a specially crafted YAML file. This vulnerability is fixed in 2.7.6.
GitHub Security Advisory: GHSA-87qx-g5wg-mwmj
Package: rubygems-update (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.7.6
Patched in: 2.7.6

Summary: RubyGems Cross-site Scripting vulnerability

Details:
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute that can result in XSS. This attack requires the victim to browse to a malicious gem on a vulnerable gem server. This vulnerability is fixed in 2.7.6.
GitHub Security Advisory: GHSA-gv86-43rv-79m2
Package: rubygems-update (RUBYGEMS)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 2.7.6
Patched in: 2.7.6

Summary: RubyGems Improper Input Validation vulnerability

Details:
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems specification homepage attribute that can result in a malicious gem setting an invalid homepage URL. This vulnerability is fixed in 2.7.6.
GitHub Security Advisory: GHSA-8qxg-mff5-j3wc
Package: rubygems-update (RUBYGEMS)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 2.7.6
Patched in: 2.7.6

Summary: RubyGems Path Traversal vulnerability

Details:
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem writing to arbitrary filesystem locations during installation. This attack appears to be exploitable via installation of a malicious gem. This vulnerability is fixed in 2.7.6.
GitHub Security Advisory: GHSA-74pv-v9gh-h25p
Package: rubygems-update (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
Vulnerable versions: < 2.7.6
Patched in: 2.7.6

Summary: RubyGems Infinite Loop vulnerability

Details:
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ruby gem package tar header that can result in a negative size could cause an infinite loop.. This vulnerability appears to have been fixed in 2.7.6.
GitHub Security Advisory: GHSA-mqwr-4qf2-2hcv
Package: rubygems-update (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: >= 2.0.0, < 2.6.14
Patched in: 2.6.14

Summary: RubyGems vulnerable to Deserialization of Untrusted Data

Details:
RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution. The issue has been patched in 2.6.14.
GitHub Security Advisory: GHSA-pm9x-4392-2c2p
Package: rubygems-update (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-20: Improper Input Validation, CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 2.6.13
Patched in: 2.6.13

Summary: RubyGems may allow a maliciously crafted gem to overwrite files

Details:
RubyGems versions 2.6.12 and earlier fail to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem.
GitHub Security Advisory: GHSA-7gcp-2gmq-w3xh
Package: rubygems-update (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection'), CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences
Vulnerable versions: < 2.6.13
Patched in: 2.6.13

Summary: RubyGems Code Injection vulnerability

Details:
RubyGems prior to 2.6.13 is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences.
GitHub Security Advisory: GHSA-73w7-6w9g-gc8w
Package: rubygems-update (RUBYGEMS)
Severity: HIGH (CVSS 8.1)
CWE: CWE-346: Origin Validation Error, CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action
Vulnerable versions: < 2.6.13
Patched in: 2.6.13

Summary: RubyGems has Origin Validation Error vulnerability

Details:
RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls.
GitHub Security Advisory: GHSA-98hq-3qvg-pg78
Package: geminabox (RUBYGEMS)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 0.13.6
Patched in: 0.13.6

Summary: Gem in a Box vulnerable to Cross-site Scripting

Details:
geminabox (aka Gem in a Box) before 0.13.6 is vulnerable to Cross-site Scripting (XSS), as demonstrated by uploading a gem file that has a crafted gem.homepage value in its .gemspec file.
GitHub Security Advisory: GHSA-qxcg-xjjg-66mj
Package: nokogiri (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
Vulnerable versions: < 1.10.3
Patched in: 1.10.3

Summary: Nokogiri vulnerable to libxslt protection mechanism bypass

Details:
A dependency of Nokogiri, libxslt through 1.1.33 allows bypass of a protection mechanism because callers of `xsltCheckRead` and `xsltCheckWrite` permit access even upon receiving a `-1` error code. `xsltCheckRead` can return `-1` for a crafted URL that is not actually invalid and is subsequently loaded.
GitHub Security Advisory: GHSA-qwv2-2x8g-g43g
Package: geminabox (RUBYGEMS)
Severity: HIGH (CVSS 8.8)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: < 0.13.7
Patched in: 0.13.7

Summary: Gem in a Box vulnerable to Cross-site Request Forgery

Details:
geminabox (aka Gem in a Box) before 0.13.7 has CSRF, as demonstrated by an unintended gem upload.
GitHub Security Advisory: GHSA-gx69-6cp4-hxrj
Package: rubygems-update (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-59: Improper Link Resolution Before File Access ('Link Following')
Vulnerable versions: < 2.7.6
Patched in: 2.7.6

Summary: RubyGems Link Following vulnerability

Details:
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in `install_location` function of `package.rb` that can result in path traversal when writing to a symlinked basedir outside of the root. This vulnerability appears to have been fixed in 2.7.6.
GitHub Security Advisory: GHSA-v882-ccj6-jc48
Package: rack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 1.4.0, < 1.4.4
Patched in: 1.4.4

Summary: Rack vulnerable to Denial of Service

Details:
Unspecified vulnerability in `Rack::Auth::AbstractRequest` in Rack 1.1.x before 1.1.5, 1.2.x before 1.2.7, 1.3.x before 1.3.9, and 1.4.x before 1.4.4 allows remote attackers to cause a denial of service via unknown vectors related to "symbolized arbitrary strings."
GitHub Security Advisory: GHSA-v882-ccj6-jc48
Package: rack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 1.3.0, < 1.3.9
Patched in: 1.3.9

Summary: Rack vulnerable to Denial of Service

Details:
Unspecified vulnerability in `Rack::Auth::AbstractRequest` in Rack 1.1.x before 1.1.5, 1.2.x before 1.2.7, 1.3.x before 1.3.9, and 1.4.x before 1.4.4 allows remote attackers to cause a denial of service via unknown vectors related to "symbolized arbitrary strings."
GitHub Security Advisory: GHSA-v882-ccj6-jc48
Package: rack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 1.2.0, < 1.2.7
Patched in: 1.2.7

Summary: Rack vulnerable to Denial of Service

Details:
Unspecified vulnerability in `Rack::Auth::AbstractRequest` in Rack 1.1.x before 1.1.5, 1.2.x before 1.2.7, 1.3.x before 1.3.9, and 1.4.x before 1.4.4 allows remote attackers to cause a denial of service via unknown vectors related to "symbolized arbitrary strings."
GitHub Security Advisory: GHSA-v882-ccj6-jc48
Package: rack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 1.1.0, < 1.1.5
Patched in: 1.1.5

Summary: Rack vulnerable to Denial of Service

Details:
Unspecified vulnerability in `Rack::Auth::AbstractRequest` in Rack 1.1.x before 1.1.5, 1.2.x before 1.2.7, 1.3.x before 1.3.9, and 1.4.x before 1.4.4 allows remote attackers to cause a denial of service via unknown vectors related to "symbolized arbitrary strings."
GitHub Security Advisory: GHSA-95vx-q4c2-64gr
Package: rubygems-update (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 0.9.1
Patched in: 0.9.1

Summary: RubyGems file overwrite vulnerability

Details:
The `extract_files` function in `installer.rb` in RubyGems before 0.9.1 does not check whether files exist before overwriting them, which allows user-assisted remote attackers to overwrite arbitrary files, cause a denial of service, or execute arbitrary code via crafted GEM packages.
GitHub Security Advisory: GHSA-cf46-6xxh-pc75
Package: nokogiri (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
Vulnerable versions: < 1.10.5
Patched in: 1.10.5

Summary: libxslt Type Confusion vulnerability that affects Nokogiri

Details:
In `numbers.c` in libxslt 1.1.33, a type holding grouping characters of an `xsl:number` instruction was too narrow and an invalid character/length combination could be passed to `xsltNumberFormatDecimal`, leading to a read of uninitialized stack data.

Nokogiri prior to version 1.10.5 used a vulnerable version of libxslt. Nokogiri 1.10.5 updated libxslt to version 1.1.34 to address this and other vulnerabilities in libxslt.
GitHub Security Advisory: GHSA-mvqr-r76c-wm5f
Package: devise_token_auth (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 0.1.33, < 1.1.3
Patched in: 1.1.3

Summary: Devise Token Auth vulnerable to Cross-site Scripting

Details:
An issue was discovered in Devise Token Auth through 1.1.2. The omniauth failure endpoint is vulnerable to Reflected Cross Site Scripting (XSS) through the message parameter. Unauthenticated attackers can craft a URL that executes a malicious JavaScript payload in the victim's browser. This affects the `fallback_render` method in the omniauth callbacks controller.
GitHub Security Advisory: GHSA-mc6j-h948-v2p6
Package: rubygems-update (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-347: Improper Verification of Cryptographic Signature
Vulnerable versions: >= 2.2.0, < 2.7.6
Patched in: 2.7.6

Summary: RubyGems Improper Verification of Cryptographic Signature vulnerability

Details:
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, and Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contain an Improper Verification of Cryptographic Signature vulnerability in package.rb. This can result in a mis-signed gem being installed, as the tarball would contain multiple gem signatures. This vulnerability has been fixed in 2.7.6.
GitHub Security Advisory: GHSA-3h57-hmj3-gj3p
Package: rack (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 3.0.0, < 3.0.4.2
Patched in: 3.0.4.2

Summary: Rack has possible DoS Vulnerability in Multipart MIME parsing

Details:
There is a possible DoS vulnerability in the Multipart MIME parsing code in Rack. This vulnerability has been assigned the CVE identifier CVE-2023-27530.

Versions Affected: All. Not affected: None Fixed Versions: 3.0.4.2, 2.2.6.3, 2.1.4.3, 2.0.9.3

# Impact
The Multipart MIME parsing code in Rack limits the number of file parts, but does not limit the total number of parts that can be uploaded. Carefully crafted requests can abuse this and cause multipart parsing to take longer than expected.

All users running an affected release should either upgrade or use one of the workarounds immediately.

# Workarounds
A proxy can be configured to limit the POST body size which will mitigate this issue.
GitHub Security Advisory: GHSA-3h57-hmj3-gj3p
Package: rack (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 2.2.0, < 2.2.6.3
Patched in: 2.2.6.3

Summary: Rack has possible DoS Vulnerability in Multipart MIME parsing

Details:
There is a possible DoS vulnerability in the Multipart MIME parsing code in Rack. This vulnerability has been assigned the CVE identifier CVE-2023-27530.

Versions Affected: All. Not affected: None Fixed Versions: 3.0.4.2, 2.2.6.3, 2.1.4.3, 2.0.9.3

# Impact
The Multipart MIME parsing code in Rack limits the number of file parts, but does not limit the total number of parts that can be uploaded. Carefully crafted requests can abuse this and cause multipart parsing to take longer than expected.

All users running an affected release should either upgrade or use one of the workarounds immediately.

# Workarounds
A proxy can be configured to limit the POST body size which will mitigate this issue.
GitHub Security Advisory: GHSA-3h57-hmj3-gj3p
Package: rack (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 2.1.0, < 2.1.4.3
Patched in: 2.1.4.3

Summary: Rack has possible DoS Vulnerability in Multipart MIME parsing

Details:
There is a possible DoS vulnerability in the Multipart MIME parsing code in Rack. This vulnerability has been assigned the CVE identifier CVE-2023-27530.

Versions Affected: All. Not affected: None Fixed Versions: 3.0.4.2, 2.2.6.3, 2.1.4.3, 2.0.9.3

# Impact
The Multipart MIME parsing code in Rack limits the number of file parts, but does not limit the total number of parts that can be uploaded. Carefully crafted requests can abuse this and cause multipart parsing to take longer than expected.

All users running an affected release should either upgrade or use one of the workarounds immediately.

# Workarounds
A proxy can be configured to limit the POST body size which will mitigate this issue.
GitHub Security Advisory: GHSA-3h57-hmj3-gj3p
Package: rack (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 2.0.9.3
Patched in: 2.0.9.3

Summary: Rack has possible DoS Vulnerability in Multipart MIME parsing

Details:
There is a possible DoS vulnerability in the Multipart MIME parsing code in Rack. This vulnerability has been assigned the CVE identifier CVE-2023-27530.

Versions Affected: All. Not affected: None Fixed Versions: 3.0.4.2, 2.2.6.3, 2.1.4.3, 2.0.9.3

# Impact
The Multipart MIME parsing code in Rack limits the number of file parts, but does not limit the total number of parts that can be uploaded. Carefully crafted requests can abuse this and cause multipart parsing to take longer than expected.

All users running an affected release should either upgrade or use one of the workarounds immediately.

# Workarounds
A proxy can be configured to limit the POST body size which will mitigate this issue.
GitHub Security Advisory: GHSA-35j2-p8fh-x966
Package: elastic-apm (RUBYGEMS)
Severity: HIGH (CVSS 7.4)
CWE: CWE-295: Improper Certificate Validation
Vulnerable versions: < 2.9.0
Patched in: 2.9.0

Summary: Elastic APM agent for Ruby vulnerable to Improper Certificate Validation

Details:
A TLS certificate validation flaw was found in Elastic APM agent for Ruby versions before 2.9.0. When specifying a trusted server CA certificate via the `server_ca_cert` setting, the Ruby agent would not properly verify the certificate returned by the APM server. This could result in a man in the middle style attack against the Ruby agent.
GitHub Security Advisory: GHSA-9fh3-j99m-f4v7
Package: pdf_info (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: <= 0.5.3
Patched in: unpatched

Summary: Code injection in pdf_info

Details:
pdf_info 0.5.3 is vulnerable to Command Execution. An attacker using a specially crafted payload may execute OS commands by using command chaining because during object initalization there is no validation performed and the user provided path is used.
GitHub Security Advisory: GHSA-m4wh-848j-9w2r
Package: katello (RUBYGEMS)
Severity: LOW (CVSS 2.7)
CWE: CWE-312: Cleartext Storage of Sensitive Information
Vulnerable versions: >= 3.0.0.0, < 3.12.2
Patched in: 3.12.2

Summary: Katello cleartext password storage issue

Details:
A cleartext password storage issue was discovered in Katello, versions 3.x.x.x before katello 3.12.2. Registry credentials used during container image discovery were inadvertently logged without being masked. This flaw could expose the registry credentials to other privileged users.
GitHub Security Advisory: GHSA-6pm2-j2v8-h3cj
Package: metasploit-framework (RUBYGEMS)
Severity: HIGH (CVSS 7.2)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: <= 6.0.33
Patched in: unpatched

Summary: Withdrawn: Fortra GoAnywhere MFT Deserialization of Untrusted Data vulnerability affects metasploit-framework

Details:
## Withdrawn
This advisory has been withdrawn because it was incorrectly associated with the metasploit-framework package, which is not affected by this CVE, and the actual vulnerable component does not fit within our supported ecosystems. This link is maintained to preserve external references.

## Original Description

Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object.
GitHub Security Advisory: GHSA-756m-3qf2-hp58
Package: openshift-origin-node (RUBYGEMS)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: <= 1.3.3
Patched in: unpatched

Summary: openshift-origin-node Improper Input Validation vulnerability

Details:
Ruby gem openshift-origin-node before 2014-02-14 does not contain a cronjob timeout which could result in a denial of service in cron.daily and cron.weekly.
GitHub Security Advisory: GHSA-527r-mfmj-prqf
Package: katello (RUBYGEMS)
Severity: HIGH (CVSS 8.8)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: < 2.4.3
Patched in: 2.4.3

Summary: Katello SQL Injection vulnerabilities

Details:
Multiple SQL injection vulnerabilities in the scoped_search function in app/controllers/katello/api/v2/api_controller.rb in Katello allow remote authenticated users to execute arbitrary SQL commands via the (1) sort_by or (2) sort_order parameter.
GitHub Security Advisory: GHSA-p4xx-w6fr-c4w9
Package: clockwork_web (RUBYGEMS)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-352: Cross-Site Request Forgery (CSRF), CWE-652: Improper Neutralization of Data within XQuery Expressions ('XQuery Injection')
Vulnerable versions: < 0.1.2
Patched in: 0.1.2

Summary: Clockwork Web contains a Cross-Site Request Forgery Vulnerability with Rails < 5.2

Details:
Clockwork Web before 0.1.2, when used with Rails before 5.2 is used, allows Cross-Site Request Forgery (CSRF). A CSRF attack works by getting an authorized user to visit a malicious website and then performing requests on behalf of the user. In this instance, actions include enabling and disabling jobs. All users running an affected release on Rails < 5.2 should upgrade immediately.
GitHub Security Advisory: GHSA-g7gf-2rqw-5rwx
Package: publify_core (RUBYGEMS)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-521: Weak Password Requirements
Vulnerable versions: < 9.2.10
Patched in: 9.2.10

Summary: Publify contains Weak Password Requirements

Details:
Weak Password Requirements in GitHub repository publify/publify prior to 9.2.10.