deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-x3rq-r3cm-5vc4
Package: publify_core (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-841: Improper Enforcement of Behavioral Workflow
Vulnerable versions: < 9.2.7
Patched in: 9.2.7

Summary: Publify Business Logic Errors

Details:
Publify (formerly known as Typo) prior to version 9.2.7 is vulnerable to business logic errors.
GitHub Security Advisory: GHSA-c273-c6vg-4pv5
Package: publify_core (RUBYGEMS)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-284: Improper Access Control, CWE-639: Authorization Bypass Through User-Controlled Key, CWE-732: Incorrect Permission Assignment for Critical Resource
Vulnerable versions: < 9.2.9
Patched in: 9.2.9

Summary: Publify has Improper Access Controls

Details:
A low-privileged user can modify and delete admin articles by changing the value of the `article[id]` parameter prior to 9.2.9.
GitHub Security Advisory: GHSA-3hwx-c6cp-q972
Package: publify_core (RUBYGEMS)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-434: Unrestricted Upload of File with Dangerous Type
Vulnerable versions: < 9.2.9
Patched in: 9.2.9

Summary: Publify vulnerable to cross site scripting

Details:
Unrestricted file upload allowed the attacker to manipulate the request and bypass the protection of HTML files using a text file. Stored XSS may be obtained.
GitHub Security Advisory: GHSA-5jm7-g527-m694
Package: publify_core (RUBYGEMS)
Severity: MODERATE (CVSS 4.9)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 9.2.8
Patched in: 9.2.8

Summary: Publify exposes article metadata

Details:
Leaking password protected articles content due to improper access control in GitHub repository publify/publify prior to 9.2.8. Attackers can leverage this vulnerability to view the contents of any password-protected article present on the publify website, compromising confidentiality and integrity of users.
GitHub Security Advisory: GHSA-w78q-4w34-jrjx
Package: publify_core (RUBYGEMS)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: < 9.2.8
Patched in: 9.2.8

Summary: Publify vulnerable to code injection

Details:
Code Injection in GitHub repository publify/publify prior to 9.2.8.
GitHub Security Advisory: GHSA-2xvj-j3qh-x8c3
Package: private_address_check (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Vulnerable versions: < 0.5.0
Patched in: 0.5.0

Summary: private_address_check contains race condition

Details:
The private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the socket uses not being checked. DNS entries with a TTL of 0 can trigger this case where the initial resolution is a public address but the subsequent resolution is a private address.
GitHub Security Advisory: GHSA-79m3-q3wh-c3qm
Package: publify_core (RUBYGEMS)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 9.2.8
Patched in: 9.2.8

Summary: Publify Incorrect Authorization

Details:
Improper Access Control in GitHub repository publify/publify prior to 9.2.8. Anonymous users can't view but can leave comments on an article in draft mode.
GitHub Security Advisory: GHSA-f93j-hmcr-jcwh
Package: moped (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 2.0.0, < 2.0.5
Patched in: 2.0.5

Summary: Moped Rubygem Data Injection Vulnerability

Details:
`The Moped::BSON::ObjecId.legal?` method in rubygem-moped before [commit dd5a7c14b5d2e466f7875d079af71ad19774609b](https://github.com/mongoid/moped/commit/dd5a7c14b5d2e466f7875d079af71ad19774609b#diff-3b93602f64c2fe46d38efd9f73ef5358R24) allows remote attackers to cause a denial of service (worker resource consumption) or perform a cross-site scripting (XSS) attack via a crafted string.
GitHub Security Advisory: GHSA-f93j-hmcr-jcwh
Package: moped (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 1.5.3
Patched in: 1.5.3

Summary: Moped Rubygem Data Injection Vulnerability

Details:
`The Moped::BSON::ObjecId.legal?` method in rubygem-moped before [commit dd5a7c14b5d2e466f7875d079af71ad19774609b](https://github.com/mongoid/moped/commit/dd5a7c14b5d2e466f7875d079af71ad19774609b#diff-3b93602f64c2fe46d38efd9f73ef5358R24) allows remote attackers to cause a denial of service (worker resource consumption) or perform a cross-site scripting (XSS) attack via a crafted string.
GitHub Security Advisory: GHSA-c3gv-9cxf-6f57
Package: loofah (RUBYGEMS)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.3.1
Patched in: 2.3.1

Summary: Loofah Allows Cross-site Scripting

Details:
In the Loofah gem for Ruby through v2.3.0, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.
GitHub Security Advisory: GHSA-4936-rj25-6wm6
Package: nori (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 1.0.0, < 1.0.3
Patched in: 1.0.3

Summary: nori contains Improper Input Validation

Details:
The nori gem 2.0.x before 2.0.2, 1.1.x before 1.1.4, and 1.0.x before 1.0.3 for Ruby does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
GitHub Security Advisory: GHSA-4936-rj25-6wm6
Package: nori (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 1.1.0, < 1.1.4
Patched in: 1.1.4

Summary: nori contains Improper Input Validation

Details:
The nori gem 2.0.x before 2.0.2, 1.1.x before 1.1.4, and 1.0.x before 1.0.3 for Ruby does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
GitHub Security Advisory: GHSA-4936-rj25-6wm6
Package: nori (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 2.0.0, < 2.0.2
Patched in: 2.0.2

Summary: nori contains Improper Input Validation

Details:
The nori gem 2.0.x before 2.0.2, 1.1.x before 1.1.4, and 1.0.x before 1.0.3 for Ruby does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
GitHub Security Advisory: GHSA-6j63-35hj-vmcg
Package: mysql-binuuid-rails (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: < 1.1.1
Patched in: 1.1.1

Summary: mysql-bunuuid-rails vulnerable to SQL injection

Details:
mysql-binuuid-rails 1.1.0 and earlier allows SQL Injection because it removes default string escaping for affected database columns.
GitHub Security Advisory: GHSA-r53w-g4xm-3gc6
Package: haml (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 5.0.0
Patched in: 5.0.0

Summary: Haml vulnerable to cross-site scripting

Details:
In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like `< > " '` must be escaped properly. In this case, the `'` character was missed. An attacker can manipulate the input to introduce additional attributes, potentially executing code.
GitHub Security Advisory: GHSA-4whc-pp4x-9pf3
Package: jquery-ujs (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: < 1.0.4
Patched in: 1.0.4

Summary: jquery-rails and jquery-ujs subject to Exposure of Sensitive Information

Details:
jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.
GitHub Security Advisory: GHSA-4whc-pp4x-9pf3
Package: jquery-rails (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 4.0.0, < 4.0.4
Patched in: 4.0.4

Summary: jquery-rails and jquery-ujs subject to Exposure of Sensitive Information

Details:
jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.
GitHub Security Advisory: GHSA-4whc-pp4x-9pf3
Package: jquery-rails (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: < 3.1.3
Patched in: 3.1.3

Summary: jquery-rails and jquery-ujs subject to Exposure of Sensitive Information

Details:
jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.
GitHub Security Advisory: GHSA-qh4w-7pw3-p4rp
Package: bson (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 3.0.4
Patched in: 3.0.4

Summary: BSON rubygem contains potential denial of service

Details:
The `Moped::BSON::ObjecId.legal?` method in `mongodb/bson-ruby` before 3.0.4 as used in rubygem-moped allows remote attackers to cause a denial of service (worker resource consumption) via a crafted string. NOTE: This issue is due to an incomplete fix to CVE-2015-4410.
GitHub Security Advisory: GHSA-j5rj-g695-342r
Package: fat_free_crm (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: = 0.18.0
Patched in: 0.18.1

Summary: Fat Free CRM vulnerable to Cross-site Scripting

Details:
FatFreeCRM version `<=0.14.1`, `>=0.15.0 <=0.15.1`, `>=0.16.0 <=0.16.3`, `>=0.17.0 <=0.17.2`, and `==0.18.0` contains a Cross Site Scripting (XSS) vulnerability in [commit 6d60bc8ed010c4eda05d6645c64849f415f68d65](https://github.com/asteinhauser/fat_free_crm/commit/306f940b26ccf3f406665f07bece1229a7a5dcfa) that can result in Javascript execution. This attack appears to be exploitable via Content with Javascript payload will be executed on end user browsers when they visit the page. This vulnerability appears to have been fixed in 0.18.1, 0.17.3, 0.16.4, 0.15.2, and 0.14.2.
GitHub Security Advisory: GHSA-j5rj-g695-342r
Package: fat_free_crm (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 0.17.0, < 0.17.3
Patched in: 0.17.3

Summary: Fat Free CRM vulnerable to Cross-site Scripting

Details:
FatFreeCRM version `<=0.14.1`, `>=0.15.0 <=0.15.1`, `>=0.16.0 <=0.16.3`, `>=0.17.0 <=0.17.2`, and `==0.18.0` contains a Cross Site Scripting (XSS) vulnerability in [commit 6d60bc8ed010c4eda05d6645c64849f415f68d65](https://github.com/asteinhauser/fat_free_crm/commit/306f940b26ccf3f406665f07bece1229a7a5dcfa) that can result in Javascript execution. This attack appears to be exploitable via Content with Javascript payload will be executed on end user browsers when they visit the page. This vulnerability appears to have been fixed in 0.18.1, 0.17.3, 0.16.4, 0.15.2, and 0.14.2.
GitHub Security Advisory: GHSA-j5rj-g695-342r
Package: fat_free_crm (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 0.16.0, < 0.16.4
Patched in: 0.16.4

Summary: Fat Free CRM vulnerable to Cross-site Scripting

Details:
FatFreeCRM version `<=0.14.1`, `>=0.15.0 <=0.15.1`, `>=0.16.0 <=0.16.3`, `>=0.17.0 <=0.17.2`, and `==0.18.0` contains a Cross Site Scripting (XSS) vulnerability in [commit 6d60bc8ed010c4eda05d6645c64849f415f68d65](https://github.com/asteinhauser/fat_free_crm/commit/306f940b26ccf3f406665f07bece1229a7a5dcfa) that can result in Javascript execution. This attack appears to be exploitable via Content with Javascript payload will be executed on end user browsers when they visit the page. This vulnerability appears to have been fixed in 0.18.1, 0.17.3, 0.16.4, 0.15.2, and 0.14.2.
GitHub Security Advisory: GHSA-j5rj-g695-342r
Package: fat_free_crm (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 0.15.0, < 0.15.2
Patched in: 0.15.2

Summary: Fat Free CRM vulnerable to Cross-site Scripting

Details:
FatFreeCRM version `<=0.14.1`, `>=0.15.0 <=0.15.1`, `>=0.16.0 <=0.16.3`, `>=0.17.0 <=0.17.2`, and `==0.18.0` contains a Cross Site Scripting (XSS) vulnerability in [commit 6d60bc8ed010c4eda05d6645c64849f415f68d65](https://github.com/asteinhauser/fat_free_crm/commit/306f940b26ccf3f406665f07bece1229a7a5dcfa) that can result in Javascript execution. This attack appears to be exploitable via Content with Javascript payload will be executed on end user browsers when they visit the page. This vulnerability appears to have been fixed in 0.18.1, 0.17.3, 0.16.4, 0.15.2, and 0.14.2.
GitHub Security Advisory: GHSA-j5rj-g695-342r
Package: fat_free_crm (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 0.14.2
Patched in: 0.14.2

Summary: Fat Free CRM vulnerable to Cross-site Scripting

Details:
FatFreeCRM version `<=0.14.1`, `>=0.15.0 <=0.15.1`, `>=0.16.0 <=0.16.3`, `>=0.17.0 <=0.17.2`, and `==0.18.0` contains a Cross Site Scripting (XSS) vulnerability in [commit 6d60bc8ed010c4eda05d6645c64849f415f68d65](https://github.com/asteinhauser/fat_free_crm/commit/306f940b26ccf3f406665f07bece1229a7a5dcfa) that can result in Javascript execution. This attack appears to be exploitable via Content with Javascript payload will be executed on end user browsers when they visit the page. This vulnerability appears to have been fixed in 0.18.1, 0.17.3, 0.16.4, 0.15.2, and 0.14.2.
GitHub Security Advisory: GHSA-3m6r-39p3-jq25
Package: doorkeeper (RUBYGEMS)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-1254: Incorrect Comparison Logic Granularity
Vulnerable versions: < 4.2.0
Patched in: 4.2.0

Summary: Doorkeeper is vulnerable to replay attacks

Details:
The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging failure to implement the OAuth 2.0 Token Revocation specification.
GitHub Security Advisory: GHSA-rqp5-pg7w-832p
Package: datagrid (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: = 1.0.6
Patched in: unpatched

Summary: datagrid contains code Injection backdoor

Details:
The datagrid gem 1.0.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.
GitHub Security Advisory: GHSA-j858-xp5v-f8xx
Package: dragonfly (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'), CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: < 1.4.0
Patched in: 1.4.0

Summary: Dragonfly contains remote code execution vulnerability

Details:
An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL when the `verify_url` option is disabled. This may lead to code execution. The problem occurs because the generate and process features mishandle use of the ImageMagick convert utility.
GitHub Security Advisory: GHSA-4hpq-rjcx-7vj9
Package: clearance (RUBYGEMS)
Severity: HIGH (CVSS 7.6)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: < 2.5.0
Patched in: 2.5.0

Summary: Clearance Gem Open Redirect Vulnerability

Details:
This affects the package clearance before 2.5.0. The vulnerability can be possible when users are able to set the value of `session[:return_to]`. If the value used for return_to contains multiple leading slashes (`/////example.com`) the user ends up being redirected to the external domain that comes after the slashes (`http://example.com`).
GitHub Security Advisory: GHSA-qrgf-jqqm-x7xv
Package: fog-dragonfly (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Vulnerable versions: <= 0.9.15
Patched in: unpatched

Summary: Code injection in dragonfly gem

Details:
`lib/dragonfly/imagemagickutils.rb` in the fog-dragonfly gem 0.8.2 for Ruby allows remote attackers to execute arbitrary commands via unspecified vectors.
GitHub Security Advisory: GHSA-qrgf-jqqm-x7xv
Package: dragonfly (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Vulnerable versions: < 1.0.0
Patched in: 1.0.0

Summary: Code injection in dragonfly gem

Details:
`lib/dragonfly/imagemagickutils.rb` in the fog-dragonfly gem 0.8.2 for Ruby allows remote attackers to execute arbitrary commands via unspecified vectors.
GitHub Security Advisory: GHSA-4p8f-mmfj-r45g
Package: fat_free_crm (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 0.18.1
Patched in: 0.18.1

Summary: Cross-site scripting in fat_free_crm

Details:
Fat Free CRM before 0.18.1 has XSS in the `tags_helpe`r in `app/helpers/tags_helper.rb`.
GitHub Security Advisory: GHSA-2xjj-5x6h-8vmf
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 3.2.0, < 3.2.2
Patched in: 3.2.2

Summary: Cross-site Scripting in actionpack

Details:
Cross-site scripting (XSS) vulnerability in `actionpack/lib/action_view/helpers/form_options_helper.rb` in the select helper in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving certain generation of OPTION elements within SELECT elements.
GitHub Security Advisory: GHSA-2xjj-5x6h-8vmf
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 3.1.0, < 3.1.4
Patched in: 3.1.4

Summary: Cross-site Scripting in actionpack

Details:
Cross-site scripting (XSS) vulnerability in `actionpack/lib/action_view/helpers/form_options_helper.rb` in the select helper in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving certain generation of OPTION elements within SELECT elements.
GitHub Security Advisory: GHSA-2xjj-5x6h-8vmf
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 3.0.0, < 3.0.12
Patched in: 3.0.12

Summary: Cross-site Scripting in actionpack

Details:
Cross-site scripting (XSS) vulnerability in `actionpack/lib/action_view/helpers/form_options_helper.rb` in the select helper in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving certain generation of OPTION elements within SELECT elements.
GitHub Security Advisory: GHSA-xwr3-fmgj-mmfr
Package: bio-basespace-sdk (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: <= 0.1.7
Patched in: unpatched

Summary: Exposure of Sensitive Information in bio-basespace-sdk

Details:
The put_call function in the API client (`api/api_client.rb`) in the BaseSpace Ruby SDK (aka bio-basespace-sdk) gem 0.1.7 for Ruby uses the `API_KEY` on the command line, which allows remote attackers to obtain sensitive information by listing the processes.
GitHub Security Advisory: GHSA-xgr2-v94m-rc9g
Package: activesupport (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Vulnerable versions: >= 3.0.0, < 3.0.20
Patched in: 3.0.20

Summary: activesupport in Rails vulnerable to incorrect data conversion

Details:
`lib/active_support/json/backends/yaml.rb` in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.
GitHub Security Advisory: GHSA-xgr2-v94m-rc9g
Package: activesupport (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Vulnerable versions: >= 2.3.2, < 2.3.16
Patched in: 2.3.16

Summary: activesupport in Rails vulnerable to incorrect data conversion

Details:
`lib/active_support/json/backends/yaml.rb` in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.
GitHub Security Advisory: GHSA-gr44-7grc-37vq
Package: activerecord (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-284: Improper Access Control
Vulnerable versions: >= 3.2.0, < 3.2.12
Patched in: 3.2.12

Summary: ActiveRecord vulnerable to modification of protected model attributes

Details:
ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the `attr_protected` protection mechanism and modify protected model attributes via a crafted request.
GitHub Security Advisory: GHSA-gr44-7grc-37vq
Package: activerecord (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-284: Improper Access Control
Vulnerable versions: >= 3.1.0, < 3.1.11
Patched in: 3.1.11

Summary: ActiveRecord vulnerable to modification of protected model attributes

Details:
ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the `attr_protected` protection mechanism and modify protected model attributes via a crafted request.