deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-2rqw-v265-jf8c
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 6.1.0, <= 6.1.4
Patched in: 6.1.4.1

Summary: Open Redirect in ActionPack

Details:
# Overview

There is a possible open redirect vulnerability in the Host Authorization middleware in Action Pack. This vulnerability has been assigned the CVE identifier CVE-2021-22942.

Versions Affected: >= 6.0.0.
Not affected: < 6.0.0
Fixed Versions: 6.1.4.1, 6.0.4.1

# Impact

Specially crafted “X-Forwarded-Host” headers in combination with certain “allowed host” formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.

Impacted applications will have allowed hosts with a leading dot. For example, configuration files that look like this:

```ruby
config.hosts <<  '.EXAMPLE.com'
```

When an allowed host contains a leading dot, a specially crafted Host header can be used to redirect to a malicious website.

This vulnerability is similar to CVE-2021-22881, but CVE-2021-22881 did not take in to account domain name case sensitivity.

# Releases

The fixed releases are available at the normal locations.

# Workarounds

In the case a patch can’t be applied, the following monkey patch can be used in an initializer:

```ruby
module ActionDispatch
  class HostAuthorization
    HOSTNAME = /[a-z0-9.-]+|\[[a-f0-9]*:[a-f0-9.:]+\]/i
    VALID_ORIGIN_HOST = /\A(#{HOSTNAME})(?::\d+)?\z/
    VALID_FORWARDED_HOST = /(?:\A|,[ ]?)(#{HOSTNAME})(?::\d+)?\z/

    private
      def authorized?(request)
        origin_host =
          request.get_header("HTTP_HOST")&.slice(VALID_ORIGIN_HOST, 1) || ""
        forwarded_host =
          request.x_forwarded_host&.slice(VALID_FORWARDED_HOST, 1) || ""
        @permissions.allows?(origin_host) &&
          (forwarded_host.blank? || @permissions.allows?(forwarded_host))
      end
  end
end
```
GitHub Security Advisory: GHSA-2rqw-v265-jf8c
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 6.0.0, <= 6.0.4
Patched in: 6.0.4.1

Summary: Open Redirect in ActionPack

Details:
# Overview

There is a possible open redirect vulnerability in the Host Authorization middleware in Action Pack. This vulnerability has been assigned the CVE identifier CVE-2021-22942.

Versions Affected: >= 6.0.0.
Not affected: < 6.0.0
Fixed Versions: 6.1.4.1, 6.0.4.1

# Impact

Specially crafted “X-Forwarded-Host” headers in combination with certain “allowed host” formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.

Impacted applications will have allowed hosts with a leading dot. For example, configuration files that look like this:

```ruby
config.hosts <<  '.EXAMPLE.com'
```

When an allowed host contains a leading dot, a specially crafted Host header can be used to redirect to a malicious website.

This vulnerability is similar to CVE-2021-22881, but CVE-2021-22881 did not take in to account domain name case sensitivity.

# Releases

The fixed releases are available at the normal locations.

# Workarounds

In the case a patch can’t be applied, the following monkey patch can be used in an initializer:

```ruby
module ActionDispatch
  class HostAuthorization
    HOSTNAME = /[a-z0-9.-]+|\[[a-f0-9]*:[a-f0-9.:]+\]/i
    VALID_ORIGIN_HOST = /\A(#{HOSTNAME})(?::\d+)?\z/
    VALID_FORWARDED_HOST = /(?:\A|,[ ]?)(#{HOSTNAME})(?::\d+)?\z/

    private
      def authorized?(request)
        origin_host =
          request.get_header("HTTP_HOST")&.slice(VALID_ORIGIN_HOST, 1) || ""
        forwarded_host =
          request.x_forwarded_host&.slice(VALID_FORWARDED_HOST, 1) || ""
        @permissions.allows?(origin_host) &&
          (forwarded_host.blank? || @permissions.allows?(forwarded_host))
      end
  end
end
```
GitHub Security Advisory: GHSA-3wqf-4x89-9g79
Package: bootstrap (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.3.0, < 3.4.0
Patched in: 3.4.0

Summary: Bootstrap vulnerable to Cross-Site Scripting (XSS)

Details:
In Bootstrap starting in version 2.3.0 and prior to 3.4.0, as well as 4.x before 4.1.2, XSS is possible in the collapse data-parent attribute.
GitHub Security Advisory: GHSA-3wqf-4x89-9g79
Package: bootstrap (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 4.0.0, < 4.1.2
Patched in: 4.1.2

Summary: Bootstrap vulnerable to Cross-Site Scripting (XSS)

Details:
In Bootstrap starting in version 2.3.0 and prior to 3.4.0, as well as 4.x before 4.1.2, XSS is possible in the collapse data-parent attribute.
GitHub Security Advisory: GHSA-7mvr-5x2g-wfc8
Package: bootstrap (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.3.0, < 3.4.0
Patched in: 3.4.0

Summary: Bootstrap Cross-site Scripting vulnerability

Details:
In Bootstrap starting in version 2.3.0 and prior to versions 3.4.0 and 4.1.2, XSS is possible in the data-container property of tooltip.  This is similar to CVE-2018-14041.
GitHub Security Advisory: GHSA-7mvr-5x2g-wfc8
Package: bootstrap (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 4.0.0, < 4.1.2
Patched in: 4.1.2

Summary: Bootstrap Cross-site Scripting vulnerability

Details:
In Bootstrap starting in version 2.3.0 and prior to versions 3.4.0 and 4.1.2, XSS is possible in the data-container property of tooltip.  This is similar to CVE-2018-14041.
GitHub Security Advisory: GHSA-mpmx-gm5v-q789
Package: puppet (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-340: Generation of Predictable Numbers or Identifiers
Vulnerable versions: >= 2.7.0, < 2.7.5
Patched in: 2.7.5

Summary: Puppet uses predictable filenames, allowing arbitrary file overwrite

Details:
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in `--edit` mode, uses a predictable file name, which allows local users to run arbitrary Puppet code or trick a user into editing arbitrary files.
GitHub Security Advisory: GHSA-qh3g-27jf-3j54
Package: puppet (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-59: Improper Link Resolution Before File Access ('Link Following')
Vulnerable versions: >= 2.7.0, < 2.7.5
Patched in: 2.7.5

Summary: Puppet allows local users to modify the permissions of arbitrary files

Details:
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to modify the permissions of arbitrary files via a symlink attack on the SSH authorized_keys file.
GitHub Security Advisory: GHSA-8c56-v25w-f89c
Package: puppet (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-59: Improper Link Resolution Before File Access ('Link Following')
Vulnerable versions: >= 2.7.0, < 2.7.5
Patched in: 2.7.5

Summary: Puppet arbitrary file overwrite

Details:
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to overwrite arbitrary files via a symlink attack on the .k5login file.
GitHub Security Advisory: GHSA-g8vp-2v5p-9qfh
Package: avo (RUBYGEMS)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.47.0
Patched in: 2.47.0

Summary: Cross-site scripting (XSS) in Action messages on Avo

Details:
Avo is a framework to create admin panels for Ruby on Rails apps. In Avo 3 pre12, any HTML inside text that is passed to `error` or `succeed` in an `Avo::BaseAction` subclass will be rendered directly without sanitization in the toast/notification that appears in the UI on Action completion. A malicious user could exploit this vulnerability to trigger a cross site scripting attack on an unsuspecting user. This issue has been addressed in the 3.3.0 and 2.47.0 releases of Avo. Users are advised to upgrade.
GitHub Security Advisory: GHSA-g8vp-2v5p-9qfh
Package: avo (RUBYGEMS)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 3.0.0.beta1, < 3.3.0
Patched in: 3.3.0

Summary: Cross-site scripting (XSS) in Action messages on Avo

Details:
Avo is a framework to create admin panels for Ruby on Rails apps. In Avo 3 pre12, any HTML inside text that is passed to `error` or `succeed` in an `Avo::BaseAction` subclass will be rendered directly without sanitization in the toast/notification that appears in the UI on Action completion. A malicious user could exploit this vulnerability to trigger a cross site scripting attack on an unsuspecting user. This issue has been addressed in the 3.3.0 and 2.47.0 releases of Avo. Users are advised to upgrade.
GitHub Security Advisory: GHSA-ghjv-mh6x-7q6h
Package: avo (RUBYGEMS)
Severity: HIGH (CVSS 7.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 2.46.0
Patched in: 2.47.0

Summary: avo vulnerable to stored cross-site scripting (XSS) in key_value field

Details:
### Summary
A **stored cross-site scripting (XSS)** vulnerability was found in the **key_value** field of Avo v3.2.3. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim's browser.

### Details
The value of the key_value is inserted directly into the HTML code. In the current version of Avo (possibly also older versions), the value is not properly sanitized before it is inserted into the HTML code.

This vulnerability can be exploited by an attacker to inject malicious JavaScript code into the key_value field. When a victim views the page containing the malicious code, the code will be executed in their browser.

In [avo/fields/common/key_value_component.html.erb]( https://github.com/avo-hq/avo/blob/main/app/components/avo/fields/common/key_value_component.html.erb#L38C21-L38C33) the value is taken in lines **38** and **49** and seems to be interpreted directly as html in lines **44** and **55**.

### PoC

![POC](https://user-images.githubusercontent.com/26570201/295596307-5d4f563e-99c0-4981-a82e-fc42cfd902c5.gif)


To reproduce the vulnerability, follow these steps:

1. Edit an entry with a key_value field.
2. Enter the following payload into the value field:
```POC\"> <script>alert( 'XSS in key_value' );</script> <strong>Outside-tag</strong```
3. Save the entry.
4. Go to the index page and click on the eye icon next to the entry.

The malicious JavaScript code will be executed and an alert box will be displayed. 
_On the show and edit page the alert seems not to pop up, but the strong tag breaks out of the expected html tag_

### Impact
This vulnerability could be used to steal sensitive information from victims that could be used to hijack victims' accounts or redirect them to malicious websites.
GitHub Security Advisory: GHSA-ghjv-mh6x-7q6h
Package: avo (RUBYGEMS)
Severity: HIGH (CVSS 7.3)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 3.0.0.beta1, <= 3.2.3
Patched in: 3.2.4

Summary: avo vulnerable to stored cross-site scripting (XSS) in key_value field

Details:
### Summary
A **stored cross-site scripting (XSS)** vulnerability was found in the **key_value** field of Avo v3.2.3. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim's browser.

### Details
The value of the key_value is inserted directly into the HTML code. In the current version of Avo (possibly also older versions), the value is not properly sanitized before it is inserted into the HTML code.

This vulnerability can be exploited by an attacker to inject malicious JavaScript code into the key_value field. When a victim views the page containing the malicious code, the code will be executed in their browser.

In [avo/fields/common/key_value_component.html.erb]( https://github.com/avo-hq/avo/blob/main/app/components/avo/fields/common/key_value_component.html.erb#L38C21-L38C33) the value is taken in lines **38** and **49** and seems to be interpreted directly as html in lines **44** and **55**.

### PoC

![POC](https://user-images.githubusercontent.com/26570201/295596307-5d4f563e-99c0-4981-a82e-fc42cfd902c5.gif)


To reproduce the vulnerability, follow these steps:

1. Edit an entry with a key_value field.
2. Enter the following payload into the value field:
```POC\"> <script>alert( 'XSS in key_value' );</script> <strong>Outside-tag</strong```
3. Save the entry.
4. Go to the index page and click on the eye icon next to the entry.

The malicious JavaScript code will be executed and an alert box will be displayed. 
_On the show and edit page the alert seems not to pop up, but the strong tag breaks out of the expected html tag_

### Impact
This vulnerability could be used to steal sensitive information from victims that could be used to hijack victims' accounts or redirect them to malicious websites.
GitHub Security Advisory: GHSA-8c56-v25w-f89c
Package: puppet (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-59: Improper Link Resolution Before File Access ('Link Following')
Vulnerable versions: < 2.6.11
Patched in: 2.6.11

Summary: Puppet arbitrary file overwrite

Details:
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to overwrite arbitrary files via a symlink attack on the .k5login file.
GitHub Security Advisory: GHSA-qh3g-27jf-3j54
Package: puppet (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-59: Improper Link Resolution Before File Access ('Link Following')
Vulnerable versions: < 2.6.11
Patched in: 2.6.11

Summary: Puppet allows local users to modify the permissions of arbitrary files

Details:
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to modify the permissions of arbitrary files via a symlink attack on the SSH authorized_keys file.
GitHub Security Advisory: GHSA-mpmx-gm5v-q789
Package: puppet (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-340: Generation of Predictable Numbers or Identifiers
Vulnerable versions: < 2.6.11
Patched in: 2.6.11

Summary: Puppet uses predictable filenames, allowing arbitrary file overwrite

Details:
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in `--edit` mode, uses a predictable file name, which allows local users to run arbitrary Puppet code or trick a user into editing arbitrary files.
GitHub Security Advisory: GHSA-9pvx-fwwh-w289
Package: puppet (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-284: Improper Access Control
Vulnerable versions: >= 2.6.0, <= 2.6.3
Patched in: 2.6.4

Summary: Puppet does not properly restrict access to node resources

Details:
Puppet 2.6.0 through 2.6.3 does not properly restrict access to node resources, which allows remote authenticated Puppet nodes to read or modify the resources of other nodes via unspecified vectors.
GitHub Security Advisory: GHSA-v58w-6xc2-w799
Package: puppet (RUBYGEMS)
Severity: LOW (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 2.7.0, < 2.7.13
Patched in: 2.7.13

Summary: Puppet Denial of Service and Arbitrary File Write

Details:
A vulnerability in Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys to **(1)** cause a denial of service (memory consumption) via a REST request to a stream that triggers a thread block, as demonstrated using CVE-2012-1986 and `/dev/random`; or **(2)** cause a denial of service (filesystem consumption) via crafted REST requests that use "a marshaled form of a `Puppet::FileBucket::File object`" to write to arbitrary file locations.
GitHub Security Advisory: GHSA-v58w-6xc2-w799
Package: puppet (RUBYGEMS)
Severity: LOW (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 2.6.0, < 2.6.15
Patched in: 2.6.15

Summary: Puppet Denial of Service and Arbitrary File Write

Details:
A vulnerability in Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys to **(1)** cause a denial of service (memory consumption) via a REST request to a stream that triggers a thread block, as demonstrated using CVE-2012-1986 and `/dev/random`; or **(2)** cause a denial of service (filesystem consumption) via crafted REST requests that use "a marshaled form of a `Puppet::FileBucket::File object`" to write to arbitrary file locations.
GitHub Security Advisory: GHSA-6xxq-j39w-g3f6
Package: puppet (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection'), CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: >= 2.7.0, < 2.7.13
Patched in: 2.7.13

Summary: Puppet Arbitrary Command Execution

Details:
Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys and file-creation permissions on the puppet master to execute arbitrary commands by creating a file whose full pathname contains shell metacharacters, then performing a filebucket request.
GitHub Security Advisory: GHSA-6xxq-j39w-g3f6
Package: puppet (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection'), CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: >= 2.6.0, < 2.6.15
Patched in: 2.6.15

Summary: Puppet Arbitrary Command Execution

Details:
Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys and file-creation permissions on the puppet master to execute arbitrary commands by creating a file whose full pathname contains shell metacharacters, then performing a filebucket request.
GitHub Security Advisory: GHSA-chcr-x7hc-8fp8
Package: devise-two-factor (RUBYGEMS)
Severity: MODERATE (CVSS 5.0)
CWE: CWE-307: Improper Restriction of Excessive Authentication Attempts
Vulnerable versions: >= 1.0.0, <= 5.0.0
Patched in: unpatched

Summary: Devise-Two-Factor vulnerable to brute force attacks

Details:
### Advisory withdrawn
The backing CVE has been rejected

Devise-Two-Factor does not throttle or otherwise restrict login attempts at the server by default. When combined with the Time-based One Time Password algorithm's (TOTP) inherent entropy limitations, it's possible for an attacker to bypass the 2FA mechanism through brute-force attacks.

### Impact

If a user's username and password have already been compromised an attacker would be able to try possible TOTP codes and see if they can hit a lucky collision to log in as that user. The user under attack would not necessarily know that their account has been compromised.

### Patches

Devise-Two-Factor has not released any fixes for this vulnerability. This library is open-ended by design and cannot solve this for all applications natively. It's recommended that any application leveraging Devise-Two-Factor implement controls at the application level to mitigate this threat. A non-exhaustive list of possible mitigations can be found below.

#### Mitigations

1. Use the `lockable` strategy from Devise to lock a user after a certain number of failed login attempts. See https://www.rubydoc.info/github/heartcombo/devise/main/Devise/Models/Lockable for more information.
2. Configure a rate limit for your application, especially on the endpoints used to log in. One such library to accomplish this is [rack-attack](https://rubygems.org/gems/rack-attack).
3. When displaying authentication errors hide whether validating a username/password combination failed or a two-factor code failed behind a more generic error message.

### Acknowledgements

Christian Reitter ([Radically Open Security](https://www.radicallyopensecurity.com/)) and Chris MacNaughton ([Centauri Solutions](https://centauri.solutions))
GitHub Security Advisory: GHSA-qcm3-vfq5-wfr2
Package: RedCloth (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: < 4.3.3
Patched in: 4.3.3

Summary: RedCloth Regular Expression Denial of Service issue

Details:
A Regular Expression Denial of Service (ReDoS) issue was discovered in the `sanitize_html` function of RedCloth gem. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
GitHub Security Advisory: GHSA-wf2x-8w6j-qw37
Package: view_component (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.83.0
Patched in: 2.83.0

Summary: view_component Cross-site Scripting vulnerability

Details:
### Impact
_What kind of vulnerability is it? Who is impacted?_

This is an XSS vulnerability that has the potential to impact anyone rendering a component directly from a controller with the view_component gem. Note that only components that define a [`#call` method](https://viewcomponent.org/guide/templates.html#call) (i.e. instead of using a sidecar template) are affected. The return value of the `#call` method is not sanitized and can include user-defined content.

In addition, the return value of the [`#output_postamble` method](https://viewcomponent.org/api.html#output_postamble--string) is not sanitized, which can also lead to XSS issues.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

Versions 3.9.0 has been released and fully mitigates both the `#call` and the `#output_postamble` vulnerabilities.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

Sanitize the return value of `#call`, eg:

```ruby
class MyComponent < ApplicationComponent
  def call
    html_escape("<div>#{user_input}</div>")
  end
end
```

### References
_Are there any links users can visit to find out more?_

https://github.com/ViewComponent/view_component/pull/1950

### For more information

If you have any questions or comments about this advisory:

Open an issue in the [github/view_component](https://github.com/github/view_component) project.