deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-4wm8-fjv7-j774
Package: rubygems-update (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Vulnerable versions: >= 2.6.0, < 2.7.9
Patched in: 2.7.9

Summary: RubyGems Escape sequence injection in errors

Details:
An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::CommandManager#run calls alert_error without escaping, escape sequence injection is possible. (There are many ways to cause an error.)
GitHub Security Advisory: GHSA-5x32-c9mf-49cc
Package: rubygems-update (RUBYGEMS)
Severity: HIGH (CVSS 7.4)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 3.0.0, < 3.0.3
Patched in: 3.0.3

Summary: RubyGems Delete directory using symlink when decompressing tar

Details:
A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. Before making new directories or touching files (which now include path-checking code for symlinks), it would delete the target destination. If that destination was hidden behind a symlink, a malicious gem could delete arbitrary files on the user's machine, presuming the attacker could guess at paths. Given how frequently gem is run as sudo, and how predictable paths are on modern systems (/tmp, /usr, etc.), this could likely lead to data loss or an unusable system.
GitHub Security Advisory: GHSA-5x32-c9mf-49cc
Package: rubygems-update (RUBYGEMS)
Severity: HIGH (CVSS 7.4)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 2.7.6, < 2.7.9
Patched in: 2.7.9

Summary: RubyGems Delete directory using symlink when decompressing tar

Details:
A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. Before making new directories or touching files (which now include path-checking code for symlinks), it would delete the target destination. If that destination was hidden behind a symlink, a malicious gem could delete arbitrary files on the user's machine, presuming the attacker could guess at paths. Given how frequently gem is run as sudo, and how predictable paths are on modern systems (/tmp, /usr, etc.), this could likely lead to data loss or an unusable system.
GitHub Security Advisory: GHSA-76wm-422q-92mq
Package: rubygems-update (RUBYGEMS)
Severity: HIGH (CVSS 8.8)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 3.0.0, < 3.0.2
Patched in: 3.0.2

Summary: Code injection in RubyGems

Details:
An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could inject arbitrary code to the stub line of gemspec, which is eval-ed by code in ensure_loadable_spec during the preinstall check.
GitHub Security Advisory: GHSA-76wm-422q-92mq
Package: rubygems-update (RUBYGEMS)
Severity: HIGH (CVSS 8.8)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 2.6.0, < 2.7.9
Patched in: 2.7.9

Summary: Code injection in RubyGems

Details:
An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could inject arbitrary code to the stub line of gemspec, which is eval-ed by code in ensure_loadable_spec during the preinstall check.
GitHub Security Advisory: GHSA-3pxh-h8hw-mj8w
Package: rack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer, CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 1.4.0, < 1.4.3
Patched in: 1.4.3

Summary: Rack rubygems receiving excessively long lines triggers out-of-memory error

Details:
multipart/parser.rb in Rack 1.3.x before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to cause a denial of service (memory consumption and out-of-memory error) via a long string in a Multipart HTTP packet.
GitHub Security Advisory: GHSA-3pxh-h8hw-mj8w
Package: rack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer, CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 1.3.0, < 1.3.8
Patched in: 1.3.8

Summary: Rack rubygems receiving excessively long lines triggers out-of-memory error

Details:
multipart/parser.rb in Rack 1.3.x before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to cause a denial of service (memory consumption and out-of-memory error) via a long string in a Multipart HTTP packet.
GitHub Security Advisory: GHSA-5r2p-j47h-mhpg
Package: rack (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.6.11
Patched in: 1.6.11

Summary: Rack vulnerable to Cross-site Scripting

Details:
There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the `scheme` method on `Rack::Request`. Applications that expect the scheme to be limited to 'http' or 'https' and do not escape the return value could be vulnerable to an XSS attack. Note that applications using the normal escaping mechanisms provided by Rails may not impacted, but applications that bypass the escaping mechanisms, or do not use them may be vulnerable.
GitHub Security Advisory: GHSA-5r2p-j47h-mhpg
Package: rack (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.0.0, < 2.0.6
Patched in: 2.0.6

Summary: Rack vulnerable to Cross-site Scripting

Details:
There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the `scheme` method on `Rack::Request`. Applications that expect the scheme to be limited to 'http' or 'https' and do not escape the return value could be vulnerable to an XSS attack. Note that applications using the normal escaping mechanisms provided by Rails may not impacted, but applications that bypass the escaping mechanisms, or do not use them may be vulnerable.
GitHub Security Advisory: GHSA-hg78-4f6x-99wq
Package: rack (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 2.0.4, < 2.0.6
Patched in: 2.0.6

Summary: Rack vulnerable to Denial of Service

Details:
There is a possible DoS vulnerability in the multipart parser in Rack before 2.0.6. Specially crafted requests can cause the multipart parser to enter a pathological state, causing the parser to use CPU resources disproportionate to the request size.
GitHub Security Advisory: GHSA-5f9h-9pjv-v6j7
Package: rack (RUBYGEMS)
Severity: HIGH (CVSS 8.6)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-548: Exposure of Information Through Directory Listing
Vulnerable versions: < 2.1.3
Patched in: 2.1.3

Summary: Directory traversal in Rack::Directory app bundled with Rack

Details:
A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerability in the Rack::Directory app that is bundled with Rack which could result in information disclosure.
GitHub Security Advisory: GHSA-rgr4-9jh5-j4j6
Package: rack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 1.4.0, < 1.4.6
Patched in: 1.4.6

Summary: Rack vulnerable to Denial of Service via large parameter depth request

Details:
lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote attackers to cause a denial of service (SystemStackError) via a request with a large parameter depth.
GitHub Security Advisory: GHSA-rgr4-9jh5-j4j6
Package: rack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 1.5.0, < 1.5.4
Patched in: 1.5.4

Summary: Rack vulnerable to Denial of Service via large parameter depth request

Details:
lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote attackers to cause a denial of service (SystemStackError) via a request with a large parameter depth.
GitHub Security Advisory: GHSA-rgr4-9jh5-j4j6
Package: rack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 1.6.0, < 1.6.2
Patched in: 1.6.2

Summary: Rack vulnerable to Denial of Service via large parameter depth request

Details:
lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote attackers to cause a denial of service (SystemStackError) via a request with a large parameter depth.
GitHub Security Advisory: GHSA-j6w9-fv6q-3q52
Package: rack (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-20: Improper Input Validation, CWE-784: Reliance on Cookies without Validation and Integrity Checking in a Security Decision
Vulnerable versions: >= 2.2.0, < 2.2.3
Patched in: 2.2.3

Summary: Rack allows Percent-encoded cookies to overwrite existing prefixed cookie names

Details:
A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it possible for an attacker to forge a secure or host-only cookie prefix.
GitHub Security Advisory: GHSA-j6w9-fv6q-3q52
Package: rack (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-20: Improper Input Validation, CWE-784: Reliance on Cookies without Validation and Integrity Checking in a Security Decision
Vulnerable versions: < 2.1.4
Patched in: 2.1.4

Summary: Rack allows Percent-encoded cookies to overwrite existing prefixed cookie names

Details:
A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it possible for an attacker to forge a secure or host-only cookie prefix.
GitHub Security Advisory: GHSA-fhj9-cjjh-27vm
Package: activerecord (RUBYGEMS)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: >= 3.0.0, < 3.1.0
Patched in: 3.1.0

Summary: Active Record contains deserialization of arbitrary YAML

Details:
ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML.
GitHub Security Advisory: GHSA-fhj9-cjjh-27vm
Package: activerecord (RUBYGEMS)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 2.3.17
Patched in: 2.3.17

Summary: Active Record contains deserialization of arbitrary YAML

Details:
ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML.
GitHub Security Advisory: GHSA-2hxv-mx8x-mcj9
Package: spina (RUBYGEMS)
Severity: HIGH (CVSS 8.8)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: < 0.6.29
Patched in: 0.6.29

Summary: Spina gem vulnerable to Cross-site request forgery (CSRF) vulnerability

Details:
Cross-site request forgery (CSRF) vulnerability in Spina before commit bfe44f289e336f80b[PII_REDACTED]300c493735e75. `Spina::ApplicationController` actions didn't have CSRF protection. This causes a CSRF vulnerability across the entire engine which includes administrative functionality such as creating users, changing passwords, and media management.
GitHub Security Advisory: GHSA-vqcq-mrmw-mcmg
Package: rubyzip (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-59: Improper Link Resolution Before File Access ('Link Following'), CWE-434: Unrestricted Upload of File with Dangerous Type
Vulnerable versions: <= 1.2.1
Patched in: 1.2.2

Summary: Rubyzip gem contains a Directory Traversal vulnerability in zip file component

Details:
rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , an attacker can upload a malicious file that contains symlinks or files with absolute pathnames "../" to write arbitrary files to the filesystem..

This is similar to CVE-2017-5946 which was patched in 1.2.1 but the fix in that case was incomplete.
GitHub Security Advisory: GHSA-r74q-gxcg-73hx
Package: simple_form (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 5.0.0
Patched in: 5.0.0

Summary: Improper Input Validation in simple_form

Details:
## Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

### Impact
For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

```erb
<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>
```

The string provided in the variable `@user_supplied_string` would be invoked as a method call inside the `@user` object (unless the string contains any of the following: `password`, `time_zone`, `country`, `email`, `phone` and `url`).

By manipulation that input, an attacker could do any of the following:

- Code execution (call actions like `#destroy`)
- Denial of Service (by executing a computation intensive method)
- Information Disclosure (check the presence of methods, leak user information)

### Patches
The problem was fixed in version `5.0`. Although it's a major version, there should be no issues with upgrading for `4.x`. The reason it was released in a major version is that the configuration `SimpleForm.file_methods` was deprecated in order to fix the problem.

### Workarounds
The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected.
A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the `as` option, like the following:
```erb
<%= form.input :avatar, as: :file %>
```

### References
[TDB]

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [https://github.com/plataformatec/simple_form](https://github.com/plataformatec/simple_form)
* Email us at [opensource@plataformatec.com.br](mailto:opensource@plataformatec.com.br)
GitHub Security Advisory: GHSA-mq35-wqvf-r23c
Package: sinatra (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.0.0, < 2.0.2
Patched in: 2.0.2

Summary: Sinatra Cross-site Scripting vulnerability

Details:
Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception.
GitHub Security Advisory: GHSA-gcqq-w6gr-h9j9
Package: rubyzip (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 1.2.1
Patched in: 1.2.1

Summary: Directory traversal vulnerability in RubyZip

Details:
The `Zip::File` component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses `../` pathname substrings to write arbitrary files to the filesystem.
GitHub Security Advisory: GHSA-36p7-xjw8-h6f2
Package: ruby-saml (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-91: XML Injection (aka Blind XPath Injection)
Vulnerable versions: < 1.3.0
Patched in: 1.3.0

Summary: Ruby-saml allows attackers to perform XML signature wrapping attacks 

Details:
ruby-saml prior to version 1.3.0 is vulnerable to an XML signature wrapping attack in the specific scenario where there was a signature that referenced at the same time 2 elements (but past the scheme validator process since 1 of the element was inside the encrypted assertion).
ruby-saml users must update to 1.3.0, which implements 3 extra validations to mitigate this kind of attack.
GitHub Security Advisory: GHSA-2w67-526p-gm73
Package: redis-store (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 1.4.0
Patched in: 1.4.0

Summary: redis-store deserializes untrusted data

Details:
Redis-store prior to 1.4.0 allows unsafe objects to be loaded from redis
GitHub Security Advisory: GHSA-pjj4-w39g-pw54
Package: ox (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: <= 2.8.0
Patched in: 2.8.1

Summary: Ox gem crashes due to a crafted input

Details:
In the Ox gem 2.8.0 for Ruby, the process crashes with a segmentation fault when a crafted input is supplied to `parse_obj`. NOTE: the vendor has stated "Ox should handle the error more gracefully" but has not confirmed a security implication.
GitHub Security Advisory: GHSA-9pr6-grf4-x2fr
Package: omniauth (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
Vulnerable versions: < 1.3.2
Patched in: 1.3.2

Summary: Omniauth allows POST parameters to be stored in session

Details:
In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value is improperly protected because POST (in addition to GET) parameters are stored in the session and become available in the environment of the callback phase.
GitHub Security Advisory: GHSA-mf6w-45cf-qhmp
Package: git-fastclone (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Vulnerable versions: < 1.0.5
Patched in: 1.0.5

Summary: Git-fastclone passes user modifiable strings directly to a shell command

Details:
git-fastclone before 1.0.5 passes user modifiable strings directly to a shell command. An attacker can execute malicious commands by modifying the strings that are passed as arguments to `cd ` and `git clone ` commands in the library.
GitHub Security Advisory: GHSA-4xjh-m3qx-49wc
Package: jekyll (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-59: Improper Link Resolution Before File Access ('Link Following')
Vulnerable versions: >= 3.8.0, < 3.8.4
Patched in: 3.8.4

Summary: Jekyll allows attackers to access arbitrary files by specifying a symlink

Details:
Jekyll through 3.6.2, 3.7.x through 3.7.3, and 3.8.x through 3.8.3 allows attackers to access arbitrary files by specifying a symlink in the `include` key in the `_config.yml` file.
GitHub Security Advisory: GHSA-4xjh-m3qx-49wc
Package: jekyll (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-59: Improper Link Resolution Before File Access ('Link Following')
Vulnerable versions: >= 3.7.0, < 3.7.4
Patched in: 3.7.4

Summary: Jekyll allows attackers to access arbitrary files by specifying a symlink

Details:
Jekyll through 3.6.2, 3.7.x through 3.7.3, and 3.8.x through 3.8.3 allows attackers to access arbitrary files by specifying a symlink in the `include` key in the `_config.yml` file.
GitHub Security Advisory: GHSA-4xjh-m3qx-49wc
Package: jekyll (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-59: Improper Link Resolution Before File Access ('Link Following')
Vulnerable versions: < 3.6.3
Patched in: 3.6.3

Summary: Jekyll allows attackers to access arbitrary files by specifying a symlink

Details:
Jekyll through 3.6.2, 3.7.x through 3.7.3, and 3.8.x through 3.8.3 allows attackers to access arbitrary files by specifying a symlink in the `include` key in the `_config.yml` file.
GitHub Security Advisory: GHSA-c289-47qf-rvrr
Package: easymon (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.4.1
Patched in: 1.4.1

Summary: Cross Site Scripting (XSS) vulnerability in easymon

Details:
easymon version 1.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in Endpoint where monitoring is mounted that can result in Reflected XSS that affects Firefox. Can be used to steal cookies, depending on the cookie settings.. This attack appear to be exploitable via The victim must click on a crafted URL that contains the XSS payload. This vulnerability appears to have been fixed in 1.4.1 and later.
GitHub Security Advisory: GHSA-5v3f-73gv-x7x5
Package: cairo (RUBYGEMS)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-476: NULL Pointer Dereference
Vulnerable versions: = 1.15.4
Patched in: 1.15.5

Summary: cairo is vulnerable to denial of service due to a null pointer dereference

Details:
Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the `FT_Load_Glyph` and `FT_Render_Glyph` resulting in an application crash.
GitHub Security Advisory: GHSA-573x-jhqh-jg36
Package: chloride (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-295: Improper Certificate Validation
Vulnerable versions: < 0.3.0
Patched in: 0.3.0

Summary: Improper Certificate Validation in chloride

Details:
Prior to version 0.3.0, chloride's use of net-ssh resulted in host fingerprints for previously unknown hosts getting added to the user's known_hosts file without confirmation. In version 0.3.0 this is updated so that the user's known_hosts file is not updated by chloride.
GitHub Security Advisory: GHSA-4jm3-pfpf-h54p
Package: espeak-ruby (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-284: Improper Access Control
Vulnerable versions: < 1.0.3
Patched in: 1.0.3

Summary: espeak-ruby allows arbitrary command execution

Details:
The espeak-ruby gem before 1.0.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the `speak`, `save`, `bytes` or `bytes_wav` method in `lib/espeak/speech.rb`.
GitHub Security Advisory: GHSA-r58r-74gx-6wx3
Package: nokogiri (RUBYGEMS)
Severity: HIGH (CVSS 8.8)
CWE: CWE-416: Use After Free
Vulnerable versions: < 1.8.2
Patched in: 1.8.2

Summary: Nokogiri gem, via libxml, is affected by DoS vulnerabilities

Details:
Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
GitHub Security Advisory: GHSA-6qvp-r6r3-9p7h
Package: nokogiri (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-476: NULL Pointer Dereference
Vulnerable versions: < 1.8.5
Patched in: 1.8.5

Summary: Nokogiri NULL Pointer Dereference

Details:
A NULL pointer dereference vulnerability exists in the `xpath.c:xmlXPathCompOpEval()` function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the `XPATH_OP_AND` or `XPATH_OP_OR` case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.
GitHub Security Advisory: GHSA-xjqg-9jvg-fgx2
Package: nokogiri (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 1.6.0, <= 1.6.7.0
Patched in: 1.6.7.1

Summary: Nokogiri subject to DoS via libxml2 vulnerability

Details:
The xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.3 (as used in nokogiri before 1.6.7.1) does not properly prevent entity expansion, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data, a different vulnerability than CVE-2014-3660.
GitHub Security Advisory: GHSA-q7wx-62r7-j2x7
Package: nokogiri (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
Vulnerable versions: >= 1.6.6.0, <= 1.6.6.3
Patched in: 1.6.6.4

Summary: Nokogiri vulnerable to libxml XML Entity Expansion

Details:
The xmlreader in libxml allows remote attackers to cause a denial of service (memory consumption) via crafted XML data, related to an XML Entity Expansion (XEE) attack.