deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-7vxr-6cxg-j3x8
Package: ftpd (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: < 0.2.2
Patched in: 0.2.2

Summary: OS Command Injection in ftpd

Details:
The ftpd gem 0.2.1 for Ruby allows remote attackers to execute arbitrary OS commands via shell metacharacters in a LIST or NLST command argument within FTP protocol traffic.
GitHub Security Advisory: GHSA-78vq-9j56-wrfr
Package: gon (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 6.4.0
Patched in: 6.4.0

Summary: Gon gem lack of escaping certain input when outputting as JSON

Details:
An issue was discovered in the gon gem before gon-6.4.0 for Ruby. MultiJson does not honor the escape_mode parameter to escape fields as an XSS protection mechanism. To mitigate, json_dumper.rb in gon now does escaping for XSS by default without relying on MultiJson.
GitHub Security Advisory: GHSA-8gg6-3r63-25m8
Package: git-fastclone (RUBYGEMS)
Severity: HIGH (CVSS 8.8)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Vulnerable versions: < 1.0.1
Patched in: 1.0.1

Summary: git-fastclone permits arbitrary shell command execution from .gitmodules

Details:
git-fastclone before 1.0.1 permits arbitrary shell command execution from .gitmodules. If an attacker can instruct a user to run a recursive clone from a repository they control, they can get a client to run an arbitrary shell command. Alternately, if an attacker can MITM an unencrypted git clone, they could exploit this. The ext command will be run if the repository is recursively cloned or if submodules are updated. This attack works when cloning both local and remote repositories.
GitHub Security Advisory: GHSA-8jhx-9gf4-hhf5
Package: consul (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-284: Improper Access Control
Vulnerable versions: < 1.0.3
Patched in: 1.0.3

Summary: Consul gem insufficient authentication check - Multiple powers in one controller are not always checked correctly

Details:
With the consul ruby gem before 1.0.3, if a controller checks multiple powers  using `:if` or `:except` conditions, these conditions are erroneously applied to all power checks in that controller. This can lead to skipped power checks and hence unauthenticated access to certain controller actions.
GitHub Security Advisory: GHSA-73qw-ww62-m54x
Package: colorscore (RUBYGEMS)
Severity: CRITICAL (CVSS 10.0)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Vulnerable versions: < 0.0.5
Patched in: 0.0.5

Summary: colorscore Command Injection vulnerability

Details:
The initialize method in the Histogram class in `lib/colorscore/histogram.rb` in the colorscore gem before 0.0.5 for Ruby allows context-dependent attackers to execute arbitrary code via shell metacharacters in the (1) `image_path`, (2) `colors`, or (3) `depth` variable.
GitHub Security Advisory: GHSA-m3q7-rj8g-m457
Package: ember-source (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: = 2.2.0
Patched in: 2.2.1

Summary: ember-source Cross-site Scripting vulnerability

Details:
Cross-site scripting (XSS) vulnerability in Ember.js 1.8.x through 1.10.x, 1.11.x before 1.11.4, 1.12.x before 1.12.2, 1.13.x before 1.13.12, 2.0.x before 2.0.3, 2.1.x before 2.1.2, and 2.2.x before 2.2.1 allows remote attackers to inject arbitrary web script or HTML.
GitHub Security Advisory: GHSA-m3q7-rj8g-m457
Package: ember-source (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.1.0, < 2.1.2
Patched in: 2.1.2

Summary: ember-source Cross-site Scripting vulnerability

Details:
Cross-site scripting (XSS) vulnerability in Ember.js 1.8.x through 1.10.x, 1.11.x before 1.11.4, 1.12.x before 1.12.2, 1.13.x before 1.13.12, 2.0.x before 2.0.3, 2.1.x before 2.1.2, and 2.2.x before 2.2.1 allows remote attackers to inject arbitrary web script or HTML.
GitHub Security Advisory: GHSA-m3q7-rj8g-m457
Package: ember-source (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.0.0, < 2.0.3
Patched in: 2.0.3

Summary: ember-source Cross-site Scripting vulnerability

Details:
Cross-site scripting (XSS) vulnerability in Ember.js 1.8.x through 1.10.x, 1.11.x before 1.11.4, 1.12.x before 1.12.2, 1.13.x before 1.13.12, 2.0.x before 2.0.3, 2.1.x before 2.1.2, and 2.2.x before 2.2.1 allows remote attackers to inject arbitrary web script or HTML.
GitHub Security Advisory: GHSA-m3q7-rj8g-m457
Package: ember-source (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 1.13.0, < 1.13.12
Patched in: 1.13.12

Summary: ember-source Cross-site Scripting vulnerability

Details:
Cross-site scripting (XSS) vulnerability in Ember.js 1.8.x through 1.10.x, 1.11.x before 1.11.4, 1.12.x before 1.12.2, 1.13.x before 1.13.12, 2.0.x before 2.0.3, 2.1.x before 2.1.2, and 2.2.x before 2.2.1 allows remote attackers to inject arbitrary web script or HTML.
GitHub Security Advisory: GHSA-m3q7-rj8g-m457
Package: ember-source (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 1.12.0, < 1.12.2
Patched in: 1.12.2

Summary: ember-source Cross-site Scripting vulnerability

Details:
Cross-site scripting (XSS) vulnerability in Ember.js 1.8.x through 1.10.x, 1.11.x before 1.11.4, 1.12.x before 1.12.2, 1.13.x before 1.13.12, 2.0.x before 2.0.3, 2.1.x before 2.1.2, and 2.2.x before 2.2.1 allows remote attackers to inject arbitrary web script or HTML.
GitHub Security Advisory: GHSA-m3q7-rj8g-m457
Package: ember-source (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 1.8.0, < 1.11.4
Patched in: 1.11.4

Summary: ember-source Cross-site Scripting vulnerability

Details:
Cross-site scripting (XSS) vulnerability in Ember.js 1.8.x through 1.10.x, 1.11.x before 1.11.4, 1.12.x before 1.12.2, 1.13.x before 1.13.12, 2.0.x before 2.0.3, 2.1.x before 2.1.2, and 2.2.x before 2.2.1 allows remote attackers to inject arbitrary web script or HTML.
GitHub Security Advisory: GHSA-mp78-r56v-45qc
Package: ember-source (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 1.11.0, < 1.11.2
Patched in: 1.11.2

Summary: ember-source vulnerable to Cross-site Scripting

Details:
Cross-site scripting (XSS) vulnerability in Ember.js 1.10.x before 1.10.1 and 1.11.x before 1.11.2.
GitHub Security Advisory: GHSA-mp78-r56v-45qc
Package: ember-source (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: = 1.10.0
Patched in: 1.10.1

Summary: ember-source vulnerable to Cross-site Scripting

Details:
Cross-site scripting (XSS) vulnerability in Ember.js 1.10.x before 1.10.1 and 1.11.x before 1.11.2.
GitHub Security Advisory: GHSA-w7q9-xr2x-wh7x
Package: delayed_job_web (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 1.2.9, < 1.4.2
Patched in: 1.4.2

Summary: delayed_job_web Cross-site Scripting vulnerability

Details:
An exploitable cross site scripting (XSS) vulnerability exists in the filter functionality of the delayed_job_web rails gem versions 1.2.9 before 1.4.2. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim's browser. An attacker can phish an authenticated user to trigger this vulnerability.
GitHub Security Advisory: GHSA-5m48-c37x-f792
Package: ember-source (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: = 1.0.0.rc6.0
Patched in: 1.0.0.rc6.1

Summary: Ember.js Potential XSS Exploit When Binding `tagName` to User-Supplied Data

Details:
In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, the `tagName` property of an `Ember.View` was inserted into such a string without being sanitized. This means that if an application assigns a view's `tagName` to user-supplied data, a specially-crafted payload could execute arbitrary JavaScript in the context of the current domain ("XSS"). This vulnerability only affects applications that assign or bind user-provided content to `tagName`.
GitHub Security Advisory: GHSA-5m48-c37x-f792
Package: ember-source (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: = 1.0.0.rc5.0
Patched in: 1.0.0.rc5.1

Summary: Ember.js Potential XSS Exploit When Binding `tagName` to User-Supplied Data

Details:
In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, the `tagName` property of an `Ember.View` was inserted into such a string without being sanitized. This means that if an application assigns a view's `tagName` to user-supplied data, a specially-crafted payload could execute arbitrary JavaScript in the context of the current domain ("XSS"). This vulnerability only affects applications that assign or bind user-provided content to `tagName`.
GitHub Security Advisory: GHSA-5m48-c37x-f792
Package: ember-source (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: = 1.0.0.rc4.0
Patched in: 1.0.0.rc4.1

Summary: Ember.js Potential XSS Exploit When Binding `tagName` to User-Supplied Data

Details:
In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, the `tagName` property of an `Ember.View` was inserted into such a string without being sanitized. This means that if an application assigns a view's `tagName` to user-supplied data, a specially-crafted payload could execute arbitrary JavaScript in the context of the current domain ("XSS"). This vulnerability only affects applications that assign or bind user-provided content to `tagName`.
GitHub Security Advisory: GHSA-5m48-c37x-f792
Package: ember-source (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: = 1.0.0.rc3.0
Patched in: 1.0.0.rc3.1

Summary: Ember.js Potential XSS Exploit When Binding `tagName` to User-Supplied Data

Details:
In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, the `tagName` property of an `Ember.View` was inserted into such a string without being sanitized. This means that if an application assigns a view's `tagName` to user-supplied data, a specially-crafted payload could execute arbitrary JavaScript in the context of the current domain ("XSS"). This vulnerability only affects applications that assign or bind user-provided content to `tagName`.
GitHub Security Advisory: GHSA-5m48-c37x-f792
Package: ember-source (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: = 1.0.0.rc2.0
Patched in: 1.0.0.rc2.1

Summary: Ember.js Potential XSS Exploit When Binding `tagName` to User-Supplied Data

Details:
In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, the `tagName` property of an `Ember.View` was inserted into such a string without being sanitized. This means that if an application assigns a view's `tagName` to user-supplied data, a specially-crafted payload could execute arbitrary JavaScript in the context of the current domain ("XSS"). This vulnerability only affects applications that assign or bind user-provided content to `tagName`.
GitHub Security Advisory: GHSA-5m48-c37x-f792
Package: ember-source (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 1.0.0.rc1.0
Patched in: 1.0.0.rc1.1

Summary: Ember.js Potential XSS Exploit When Binding `tagName` to User-Supplied Data

Details:
In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, the `tagName` property of an `Ember.View` was inserted into such a string without being sanitized. This means that if an application assigns a view's `tagName` to user-supplied data, a specially-crafted payload could execute arbitrary JavaScript in the context of the current domain ("XSS"). This vulnerability only affects applications that assign or bind user-provided content to `tagName`.
GitHub Security Advisory: GHSA-hwrx-wc75-mgh7
Package: spree (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: = 0.30.0.beta1
Patched in: 0.30.0

Summary: Spree allows remote attackers to obtain sensitive information

Details:
Spree 0.11.x before 0.11.2 and 0.30.x before 0.30.0 exchanges data using JavaScript Object Notation (JSON) without a mechanism for validating requests, which allows remote attackers to obtain sensitive information via vectors involving (1) `admin/products.json`, (2) `admin/users.json`, or (3) `admin/overview/get_report_data`, related to a "JSON hijacking" issue.
GitHub Security Advisory: GHSA-hwrx-wc75-mgh7
Package: spree (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 0.11.0, < 0.11.2
Patched in: 0.11.2

Summary: Spree allows remote attackers to obtain sensitive information

Details:
Spree 0.11.x before 0.11.2 and 0.30.x before 0.30.0 exchanges data using JavaScript Object Notation (JSON) without a mechanism for validating requests, which allows remote attackers to obtain sensitive information via vectors involving (1) `admin/products.json`, (2) `admin/users.json`, or (3) `admin/overview/get_report_data`, related to a "JSON hijacking" issue.
GitHub Security Advisory: GHSA-hxx6-p24v-wg8c
Package: curl (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: <= 0.0.9
Patched in: unpatched

Summary: Curl Gem insufficient URL escaping command injection

Details:
`lib/curl.rb` in the Curl Gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.
GitHub Security Advisory: GHSA-fgmx-8h93-26fh
Package: omniauth-oauth2 (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: < 1.1.1
Patched in: 1.1.1

Summary: omniauth-oauth2 Cross-Site Request Forgery vulnerability

Details:
Cross-site request forgery (CSRF) vulnerability in the omniauth-oauth2 gem prior to 1.1.1 for Ruby allows remote attackers to hijack the authentication of users for requests that modify session state.
GitHub Security Advisory: GHSA-4q53-fqhc-cr46
Package: ember-source (RUBYGEMS)
Severity: LOW (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 1.3.0, < 1.3.2
Patched in: 1.3.2

Summary: ember-source Cross-site Scripting vulnerability

Details:
Cross-site scripting (XSS) vulnerability in the link-to helper in Ember.js 1.2.x before 1.2.2, 1.3.x before 1.3.2, and 1.4.x before 1.4.0-beta.6, when used in non-block form, allows remote attackers to inject arbitrary web script or HTML via the title attribute.
GitHub Security Advisory: GHSA-4q53-fqhc-cr46
Package: ember-source (RUBYGEMS)
Severity: LOW (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 1.2.0, < 1.2.2
Patched in: 1.2.2

Summary: ember-source Cross-site Scripting vulnerability

Details:
Cross-site scripting (XSS) vulnerability in the link-to helper in Ember.js 1.2.x before 1.2.2, 1.3.x before 1.3.2, and 1.4.x before 1.4.0-beta.6, when used in non-block form, allows remote attackers to inject arbitrary web script or HTML via the title attribute.
GitHub Security Advisory: GHSA-c9c5-9fpr-m882
Package: sentry-raven (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 0.12.2
Patched in: 0.12.2

Summary: sentry-raven allows remote attackers to cause a denial of service via a large exponent value in a scientific number

Details:
The `numtok` function in `lib/raven/okjson.rb` in the raven-ruby gem before 0.12.2 for Ruby allows remote attackers to cause a denial of service via a large exponent value in a scientific number.
GitHub Security Advisory: GHSA-hxvp-655x-xxqv
Package: kafo (RUBYGEMS)
Severity: LOW (CVSS 0.0)
Vulnerable versions: >= 0.4.0, < 0.5.2
Patched in: 0.5.2

Summary: Kafo allows local users to obtain passwords and other sensitive information by reading default_values.yaml

Details:
Kafo before 0.3.17 and 0.4.x before 0.5.2, as used by Foreman, uses world-readable permissions for `default_values.yaml`, which allows local users to obtain passwords and other sensitive information by reading the file.
GitHub Security Advisory: GHSA-hxvp-655x-xxqv
Package: kafo (RUBYGEMS)
Severity: LOW (CVSS 0.0)
Vulnerable versions: < 0.3.17
Patched in: 0.3.17

Summary: Kafo allows local users to obtain passwords and other sensitive information by reading default_values.yaml

Details:
Kafo before 0.3.17 and 0.4.x before 0.5.2, as used by Foreman, uses world-readable permissions for `default_values.yaml`, which allows local users to obtain passwords and other sensitive information by reading the file.
GitHub Security Advisory: GHSA-jxx8-v83v-rhw3
Package: spree (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 1.0.0, < 2.0.0.rc1
Patched in: 2.0.0.rc1

Summary: Spree Improper Input Validation vulnerability

Details:
Spree Commerce 1.0.x before 2.0.0.rc1 allows remote authenticated administrators to instantiate arbitrary Ruby objects and execute arbitrary commands via the (1) `payment_method` parameter to `core/app/controllers/spree/admin/payment_methods_controller.rb`; and the (2) `promotion_action parameter` to `promotion_actions_controller.rb`, (3) `promotion_rule parameter` to `promotion_rules_controller.rb`, and (4) `calculator_type` parameter to `promotions_controller.rb` in `promo/app/controllers/spree/admin/`, related to unsafe use of the constantize function.
GitHub Security Advisory: GHSA-77xq-7c6p-6xp6
Package: openshift-origin-controller (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Vulnerable versions: <= 1.3.4
Patched in: unpatched

Summary: RubyGem openshift-origin-controller is vulnerable to command injection

Details:
rubygem-openshift-origin-controller: API can be used to create applications via cartridge_cache.rb URI.prase() to perform command injection
GitHub Security Advisory: GHSA-333g-rpr4-7hxq
Package: omniauth_amazon (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 0
Patched in: unpatched

Summary: rest-client Gem Contains Malicious Code

Details:
The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.
Users of an affected version should consider downgrading to the last non-affected version of 1.6.9, or upgrading to 1.7.x.
Additionally, a set of other minor gems have been partially or completely yanked and are included in this advisory.
These include cron_parser, coin_base, blockchain_wallet, awesome-bot, doge-coin, capistrano-colors, bitcoin_vanity, lita_coin, coming-soon, and omniauth_amazon.
GitHub Security Advisory: GHSA-333g-rpr4-7hxq
Package: coming-soon (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 0
Patched in: unpatched

Summary: rest-client Gem Contains Malicious Code

Details:
The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.
Users of an affected version should consider downgrading to the last non-affected version of 1.6.9, or upgrading to 1.7.x.
Additionally, a set of other minor gems have been partially or completely yanked and are included in this advisory.
These include cron_parser, coin_base, blockchain_wallet, awesome-bot, doge-coin, capistrano-colors, bitcoin_vanity, lita_coin, coming-soon, and omniauth_amazon.
GitHub Security Advisory: GHSA-333g-rpr4-7hxq
Package: bitcoin_vanity (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 0
Patched in: unpatched

Summary: rest-client Gem Contains Malicious Code

Details:
The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.
Users of an affected version should consider downgrading to the last non-affected version of 1.6.9, or upgrading to 1.7.x.
Additionally, a set of other minor gems have been partially or completely yanked and are included in this advisory.
These include cron_parser, coin_base, blockchain_wallet, awesome-bot, doge-coin, capistrano-colors, bitcoin_vanity, lita_coin, coming-soon, and omniauth_amazon.
GitHub Security Advisory: GHSA-333g-rpr4-7hxq
Package: capistrano-colors (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 0
Patched in: unpatched

Summary: rest-client Gem Contains Malicious Code

Details:
The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.
Users of an affected version should consider downgrading to the last non-affected version of 1.6.9, or upgrading to 1.7.x.
Additionally, a set of other minor gems have been partially or completely yanked and are included in this advisory.
These include cron_parser, coin_base, blockchain_wallet, awesome-bot, doge-coin, capistrano-colors, bitcoin_vanity, lita_coin, coming-soon, and omniauth_amazon.
GitHub Security Advisory: GHSA-333g-rpr4-7hxq
Package: doge-coin (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 0
Patched in: unpatched

Summary: rest-client Gem Contains Malicious Code

Details:
The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.
Users of an affected version should consider downgrading to the last non-affected version of 1.6.9, or upgrading to 1.7.x.
Additionally, a set of other minor gems have been partially or completely yanked and are included in this advisory.
These include cron_parser, coin_base, blockchain_wallet, awesome-bot, doge-coin, capistrano-colors, bitcoin_vanity, lita_coin, coming-soon, and omniauth_amazon.