deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-wf2x-8w6j-qw37
Package: view_component (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 3.0.0, < 3.9.0
Patched in: 3.9.0

Summary: view_component Cross-site Scripting vulnerability

Details:
### Impact
_What kind of vulnerability is it? Who is impacted?_

This is an XSS vulnerability that has the potential to impact anyone rendering a component directly from a controller with the view_component gem. Note that only components that define a [`#call` method](https://viewcomponent.org/guide/templates.html#call) (i.e. instead of using a sidecar template) are affected. The return value of the `#call` method is not sanitized and can include user-defined content.

In addition, the return value of the [`#output_postamble` method](https://viewcomponent.org/api.html#output_postamble--string) is not sanitized, which can also lead to XSS issues.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

Versions 3.9.0 has been released and fully mitigates both the `#call` and the `#output_postamble` vulnerabilities.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

Sanitize the return value of `#call`, eg:

```ruby
class MyComponent < ApplicationComponent
  def call
    html_escape("<div>#{user_input}</div>")
  end
end
```

### References
_Are there any links users can visit to find out more?_

https://github.com/ViewComponent/view_component/pull/1950

### For more information

If you have any questions or comments about this advisory:

Open an issue in the [github/view_component](https://github.com/github/view_component) project.
GitHub Security Advisory: GHSA-85rf-xh54-whp3
Package: iodine (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 0.7.34
Patched in: 0.7.34

Summary: Malicious URL drafting attack against iodines static file server may allow path traversal

Details:
### Impact

A path traversal vulnerability was detected in iodine's static file service. This vulnerability effects any application running iodine's static file server on an effected iodine version.

Malicious URL drafting may cause the static file server to attempt a response containing data from files that shouldn't be normally accessible from the public folder.

### Patches

The vulnerability was patched in version 0.7.34. Please upgrade to the latest version.

### Workarounds

A possible workaround would be to disable the static file service and it's `X-Sendfile` support, sending static files using nginx or a source code solution (sending the data dynamically).

However, it would be better to upgrade iodine to the latest version, as it also contains non-security related fixes.

### For more information
If you have any questions or comments about this advisory:
* Email [Boaz Segev](https://github.com/boazsegev)
GitHub Security Advisory: GHSA-c2f4-cvqm-65w2
Package: puma (RUBYGEMS)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Vulnerable versions: < 5.6.8
Patched in: 5.6.8

Summary: Puma HTTP Request/Response Smuggling vulnerability

Details:
### Impact
Prior to versions 6.4.2 and 5.6.8, puma exhibited dangerous behavior when parsing chunked transfer encoding bodies.

Fixed versions limit the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption.

### Patches

The vulnerability has been fixed in 6.4.2 and 5.6.8.

### Workarounds

No known workarounds.

### References

* [HTTP Request Smuggling](https://portswigger.net/web-security/request-smuggling)
* Open an issue in [Puma](https://github.com/puma/puma)
* See our [security policy](https://github.com/puma/puma/security/policy)
GitHub Security Advisory: GHSA-c2f4-cvqm-65w2
Package: puma (RUBYGEMS)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Vulnerable versions: >= 6.0.0, < 6.4.2
Patched in: 6.4.2

Summary: Puma HTTP Request/Response Smuggling vulnerability

Details:
### Impact
Prior to versions 6.4.2 and 5.6.8, puma exhibited dangerous behavior when parsing chunked transfer encoding bodies.

Fixed versions limit the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption.

### Patches

The vulnerability has been fixed in 6.4.2 and 5.6.8.

### Workarounds

No known workarounds.

### References

* [HTTP Request Smuggling](https://portswigger.net/web-security/request-smuggling)
* Open an issue in [Puma](https://github.com/puma/puma)
* See our [security policy](https://github.com/puma/puma/security/policy)
GitHub Security Advisory: GHSA-g47j-3m2m-74qv
Package: httparty (RUBYGEMS)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-472: External Control of Assumed-Immutable Web Parameter, CWE-668: Exposure of Resource to Wrong Sphere
Vulnerable versions: <= 0.20.0
Patched in: unpatched

Summary: Duplicate Advisory: httparty has multipart/form-data request tampering vulnerability

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-5pq7-52mg-hr42. This link is maintained to preserve external references.

### Original Description
httparty before 0.21.0 is vulnerable to an assumed-immutable web parameter vulnerability. A remote and unauthenticated attacker can provide a crafted filename parameter during multipart/form-data uploads which could result in attacker controlled filenames being written.
GitHub Security Advisory: GHSA-fmx4-26r3-wxpf
Package: commonmarker (RUBYGEMS)
Severity: HIGH (CVSS 8.8)
CWE: CWE-190: Integer Overflow or Wraparound
Vulnerable versions: < 0.23.4
Patched in: 0.23.4

Summary: Integer overflow in cmark-gfm table parsing extension leads to heap memory corruption

Details:
### Impact

CommonMarker uses `cmark-gfm` for rendering [Github Flavored Markdown](https://github.github.com/gfm/). An [integer overflow in `cmark-gfm`'s table row parsing](https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x) may lead to heap memory corruption when parsing tables who's marker rows contain more than UINT16_MAX columns. The impact of this heap corruption ranges from Information Leak to Arbitrary Code Execution.

If affected versions of CommonMarker are used for rendering remote user controlled markdown, this vulnerability may lead to Remote Code Execution (RCE).

### Patches

This vulnerability has been patched in the following CommonMarker release:

- v0.23.4

### Workarounds

The vulnerability exists in the table markdown extensions of `cmark-gfm`. Disabling any use of the table extension will prevent this vulnerability from being triggered.

### References

- https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x

### Acknowledgements

We would like to thank Felix Wilhelm of Google's Project Zero for reporting this vulnerability

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [CommonMarker](http://github.com/gjtorikian/commonmarker)
GitHub Security Advisory: GHSA-c2v4-chx5-vff6
Package: commonmarker (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-190: Integer Overflow or Wraparound
Vulnerable versions: < 0.23.4
Patched in: unpatched

Summary: Duplicate Advisory: Integer overflow in cmark-gfm table parsing extension leads to heap memory corruption

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-fmx4-26r3-wxpf. This link is maintained to preserve external references.

### Original Description
CommonMarker versions prior to 0.23.4 are at risk of an integer overflow vulnerability. This vulnerability can result in possibly unauthenticated remote attackers to cause heap memory corruption, potentially leading to an information leak or remote code execution, via parsing tables with marker rows that contain more than UINT16_MAX columns.
GitHub Security Advisory: GHSA-qwf7-rv77-fcr3
Package: iodine (RUBYGEMS)
Severity: LOW (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 0.7.33
Patched in: unpatched

Summary: Duplicate Advisory: Malicious URL drafting attack against iodines static file server may allow path traversal

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-85rf-xh54-whp3. This link is maintained to preserve external references.

### Original Description
Path traversal in the static file service in Iodine less than 0.7.33 allows an unauthenticated, remote attacker to read files outside the public folder via malicious URLs.
GitHub Security Advisory: GHSA-x2xw-hw8g-6773
Package: govuk_tech_docs (RUBYGEMS)
Severity: LOW (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Vulnerable versions: >= 2.0.2, < 3.3.1
Patched in: 3.3.1

Summary: govuk_tech_docs vulnerable to unescaped HTML on search results page

Details:
### Impact

Pages that are indexed in search results have their entire contents indexed, including any HTML code snippets. These HTML snippets would appear in the search results unsanitised, so it was possible to render arbitrary HTML or run arbitrary scripts.

This is a low risk security issue; to exploit it, an attacker would need to find a way of committing malicious code to a page indexed by a site that uses tech-docs-gem (which are typically not editable by untrusted users). Their code would also be limited by the relatively short length that's rendered in the corresponding search result. Nevertheless, the XSS would then be triggerable by visiting a pre-constructed URL (/search/index.html?q=some+search+term), which users could be tricked into clicking on through social engineering.

### Patches

This has been fixed in v3.3.1. HTML is now sanitised in search results.
GitHub Security Advisory: GHSA-4mvm-xh8j-fv27
Package: govuk_tech_docs (RUBYGEMS)
Severity: LOW (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.0.2, < 3.3.1
Patched in: unpatched

Summary: Duplicate Advisory: govuk_tech_docs vulnerable to unescaped HTML on search results page

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-x2xw-hw8g-6773. This link is maintained to preserve external references.

### Original Description
 versions from 2.0.2 to before 3.3.1 are vulnerable to a cross-site scripting vulnerability. Malicious JavaScript may be executed in the user's browser if a malicious search result is displayed on the search page.
GitHub Security Advisory: GHSA-hjp3-5g2q-7jww
Package: audited (RUBYGEMS)
Severity: LOW (CVSS 3.1)
Vulnerable versions: >= 4.0.0, < 5.3.3
Patched in: 5.3.3

Summary: Race Condition leading to logging errors

Details:
In certain setups with threaded web servers, Audited's use of `Thread.current` can incorrectly attributed audits to the wrong user. 

Fixed in 5.3.3. 

In March, @convisoappsec noticed that the library in question had a Race Condition problem, which caused logs to be registered at times with different users than those who performed the genuine actions.

- The first issue we identified was from November 2021: https://github.com/collectiveidea/audited/issues/601 
- So the solution was implemented in the following Pull Request: https://github.com/collectiveidea/audited/pull/669 
- And the feature was published in version 5.3.3: RELEASE: https://github.com/collectiveidea/audited/pull/671
GitHub Security Advisory: GHSA-v444-jggx-6v7f
Package: audited (RUBYGEMS)
Severity: LOW (CVSS 3.1)
CWE: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Vulnerable versions: >= 4.0.0, < 5.3.3
Patched in: unpatched

Summary: Duplicate Advisory: Race Condition leading to logging errors

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-hjp3-5g2q-7jww. This link is maintained to preserve external references.

### Original Description
A race condition exists in Audited 4.0.0 to 5.3.3 that can result in an authenticated user to cause audit log entries to be attributed to another user.
GitHub Security Advisory: GHSA-4553-hq82-8654
Package: encoded_id-rails (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 1.0.0.beta2
Patched in: unpatched

Summary: Duplicate Advisory: encoded_id-rails potential DOS vulnerability due to URIs with extremely long encoded IDs

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-3px7-jm2p-6h2c. This link is maintained to preserve external references.

### Original Description
encoded_id-rails versions before 1.0.0.beta2 are affected by an uncontrolled resource consumption vulnerability. A remote and unauthenticated attacker might cause a denial of service condition by sending an HTTP request with an extremely long "id" parameter.
GitHub Security Advisory: GHSA-5g66-628f-7cvj
Package: omniauth-microsoft_graph (RUBYGEMS)
Severity: HIGH (CVSS 8.6)
CWE: CWE-287: Improper Authentication
Vulnerable versions: < 2.0.0
Patched in: 2.0.0

Summary: Omniauth::MicrosoftGraph Account takeover (nOAuth)

Details:
### Summary
The implementation did not validate the legitimacy of the `email` attribute of the user nor did it give/document an option to do so, making it susceptible to [nOAuth](https://www.descope.com/blog/post/noauth) misconfiguration in cases when the `email` is used as a trusted user identifier
GitHub Security Advisory: GHSA-xhvv-3jww-c487
Package: activeadmin (RUBYGEMS)
Severity: MODERATE (CVSS 5.2)
CWE: CWE-1236: Improper Neutralization of Formula Elements in a CSV File
Vulnerable versions: < 3.2.0
Patched in: 3.2.0

Summary: ActiveAdmin CSV Injection leading to sensitive information disclosure

Details:
### Impact

In ActiveAdmin versions prior to 3.2.0, maliciously crafted spreadsheet formulas could be uploaded as part of admin data that, when exported to a CSV file and the imported to a spreadsheet program like libreoffice, could lead to remote code execution and private data exfiltration.

The attacker would need privileges to upload data to the same ActiveAdmin application as the victim, and would need the victim to possibly ignore security warnings from their spreadsheet program.

### Patches

Versions 3.2.0 and above fixed the problem by escaping any data starting with `=` and other characters used by spreadsheet programs.

### Workarounds

Only turn on formula evaluation in spreadsheet programs when importing CSV after explicitly reviewing the file.  

### References

https://owasp.org/www-community/attacks/CSV_Injection
https://github.com/activeadmin/activeadmin/pull/8167
GitHub Security Advisory: GHSA-rqxc-9p8h-xqgq
Package: activeadmin (RUBYGEMS)
Severity: HIGH (CVSS 8.4)
CWE: CWE-1236: Improper Neutralization of Formula Elements in a CSV File
Vulnerable versions: < 3.2.0
Patched in: 3.2.0

Summary: Duplicate Advisory: ActiveAdmin vulnerable to CSV injection

Details:
## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-xhvv-3jww-c487. This link is maintained to preserve external references.

## Original Description
csv_builder.rb in ActiveAdmin (aka Active Admin) before 3.2.0 allows CSV injection.
GitHub Security Advisory: GHSA-r8xx-8vm8-x6wj
Package: resque (RUBYGEMS)
Severity: MODERATE (CVSS 6.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-233: Improper Handling of Parameters
Vulnerable versions: < 2.1.0
Patched in: 2.1.0

Summary: Resque vulnerable to Reflected Cross Site Scripting through pathnames

Details:
### Impact

resque-web in resque versions before 2.1.0 is vulnerable to reflected XSS through the current_queue parameter in the path of the queues endpoint.

### Patches

v2.1.0

### Workarounds

No known workarounds at this time. It is recommended to not click on 3rd party or untrusted links to the resque-web interface until you have patched your application.

### References
https://github.com/resque/resque/issues/1679
https://github.com/resque/resque/pull/1687
GitHub Security Advisory: GHSA-gc3j-vvwf-4rp8
Package: resque (RUBYGEMS)
Severity: MODERATE (CVSS 6.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-233: Improper Handling of Parameters
Vulnerable versions: < 2.2.1
Patched in: 2.2.1

Summary: Resque vulnerable to reflected XSS in resque-web failed and queues lists

Details:
### Impact

The following paths in resque-web have been found to be vulnerable to reflected XSS:

```
/failed/?class=<script>alert(document.cookie)</script>
/queues/><img src=a onerror=alert(document.cookie)>
```

### Patches

v2.2.1

### Workarounds

No known workarounds at this time. It is recommended to not click on 3rd party or untrusted links to the resque-web interface until you have patched your application.

### References

https://github.com/resque/resque/pull/1790
GitHub Security Advisory: GHSA-r9mq-m72x-257g
Package: resque (RUBYGEMS)
Severity: MODERATE (CVSS 6.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-233: Improper Handling of Parameters
Vulnerable versions: < 2.6.0
Patched in: 2.6.0

Summary: Resque vulnerable to reflected XSS in Queue Endpoint

Details:
### Impact

Reflected XSS can be performed using the current_queue portion of the path on the /queues endpoint of resque-web.

### Patches

v2.6.0

### Workarounds

No known workarounds at this time. It is recommended to not click on 3rd party or untrusted links to the resque-web interface until you have patched your application.

### References

https://github.com/resque/resque/pull/1865
GitHub Security Advisory: GHSA-9hmq-fm33-x4xx
Package: resque-scheduler (RUBYGEMS)
Severity: MODERATE (CVSS 6.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 1.27.4, < 4.10.2
Patched in: 4.10.2

Summary: Resque Scheduler Reflected XSS In Delayed Jobs View

Details:
### Impact

Resque Scheduler version 1.27.4 and above are affected by a cross-site scripting vulnerability. A remote attacker can inject javascript code to the "{schedule_job}" or "args" parameter in /resque/delayed/jobs/{schedule_job}?args={args_id} to execute javascript at client side.

### Patches

Fixed in v4.10.2

### Workarounds

No known workarounds at this time. It is recommended to not click on 3rd party or untrusted links to the resque-web interface until you have patched your application.

### References
* https://nvd.nist.gov/vuln/detail/CVE-2022-44303
* https://github.com/resque/resque-scheduler/issues/761
* https://github.com/resque/resque/issues/1885
* https://github.com/resque/resque-scheduler/pull/780
* https://github.com/resque/resque-scheduler/pull/783
GitHub Security Advisory: GHSA-q7jc-v6f2-q9jr
Package: resque-scheduler (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 1.27.4, < 4.10.2
Patched in: 4.10.2

Summary: Duplicate Advisory: Resque Scheduler Reflected XSS In Delayed Jobs View

Details:
## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-9hmq-fm33-x4xx. This link is maintained to preserve external references.

## Original Description
Resque Scheduler version 1.27.4 is vulnerable to Cross-site scripting (XSS). A remote attacker could inject javascript code to the "{schedule_job}" or "args" parameter in /resque/delayed/jobs/{schedule_job}?args={args_id} to execute javascript at client side.
GitHub Security Advisory: GHSA-356j-hg45-x525
Package: activeadmin (RUBYGEMS)
Severity: HIGH (CVSS 8.4)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-1236: Improper Neutralization of Formula Elements in a CSV File
Vulnerable versions: < 2.12.0
Patched in: 2.12.0

Summary: Potential CSV export data leak

Details:
### Impact

In ActiveAdmin versions prior to 2.12.0, a concurrency issue was found that could allow a malicious actor to be able to access potentially private data that belongs to another user.

The bug affects the functionality to export data as CSV files, and was caused by a variable holding the collection to be exported being shared across threads and not properly synchronized.

The attacker would need access to the same ActiveAdmin application as the victim, and could exploit the issue by timing their request immediately before when they know someone else will request a CSV (e.g. via phishing) or request CSVs frequently and hope someone else makes a concurrent request.

### Patches

Versions 2.12.0 and above fixed the problem by completely removing the shared state.
GitHub Security Advisory: GHSA-xgv7-pqqh-h2w9
Package: jruby-openssl (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-295: Improper Certificate Validation
Vulnerable versions: < 0.6
Patched in: 0.6

Summary: jruby-openssl gem for JRuby fails to do proper certificate validation

Details:
A security problem involving peer certificate verification was found where failed verification silently did nothing, making affected applications vulnerable to attackers. Attackers could lead a client application to believe that a secure connection to a rogue SSL server is legitimate. Attackers could also penetrate client-validated SSL server applications with a dummy certificate.
GitHub Security Advisory: GHSA-5844-q3fc-56rh
Package: pubnub (RUBYGEMS)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-331: Insufficient Entropy
Vulnerable versions: < 5.3.0
Patched in: 5.3.0

Summary: pubnub Insufficient Entropy vulnerability

Details:
Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; all versions of the package github.com/pubnub/go; versions of the package github.com/pubnub/go/v7 before 7.2.0; versions of the package pubnub before 7.3.0; versions of the package pubnub/pubnub before 6.1.0; versions of the package pubnub before 5.3.0; versions of the package pubnub before 0.4.0; versions of the package pubnub/c-core before 4.5.0; versions of the package com.pubnub:pubnub-kotlin before 7.7.0; versions of the package pubnub/swift before 6.2.0; versions of the package pubnub before 5.2.0; versions of the package pubnub before 4.3.0 are vulnerable to Insufficient Entropy via the getKey function, due to inefficient implementation of the AES-256-CBC cryptographic algorithm. The provided encrypt function is less secure when hex encoding and trimming are applied, leaving half of the bits in the key always the same for every encoded message or file.

**Note:**

In order to exploit this vulnerability, the attacker needs to invest resources in preparing the attack and brute-force the encryption.