deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-5cqm-crxm-6qpv
Package: cgi (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-190: Integer Overflow or Wraparound
Vulnerable versions: >= 0.2.0, < 0.2.1
Patched in: 0.2.1

Summary: Buffer overrun in CGI.escape_html

Details:
A buffer overrun vulnerability was discovered in CGI.escape_html. This can lead to a buffer overflow when a user passes a very large string (> 700 MB) to CGI.escape_html on a platform where long type takes 4 bytes, typically, Windows.
GitHub Security Advisory: GHSA-5cqm-crxm-6qpv
Package: cgi (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-190: Integer Overflow or Wraparound
Vulnerable versions: >= 0.3.0, < 0.3.1
Patched in: 0.3.1

Summary: Buffer overrun in CGI.escape_html

Details:
A buffer overrun vulnerability was discovered in CGI.escape_html. This can lead to a buffer overflow when a user passes a very large string (> 700 MB) to CGI.escape_html on a platform where long type takes 4 bytes, typically, Windows.
GitHub Security Advisory: GHSA-4vf4-qmvg-mh7h
Package: cgi (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-565: Reliance on Cookies without Validation and Integrity Checking
Vulnerable versions: < 0.1.0.1
Patched in: 0.1.0.1

Summary: Cookie Prefix Spoofing in CGI::Cookie.parse

Details:
CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem prior to versions 0.3.1, 0.2.1, 0.1.1, and 0.1.0.1 for Ruby.
GitHub Security Advisory: GHSA-4vf4-qmvg-mh7h
Package: cgi (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-565: Reliance on Cookies without Validation and Integrity Checking
Vulnerable versions: = 0.2.0
Patched in: 0.2.1

Summary: Cookie Prefix Spoofing in CGI::Cookie.parse

Details:
CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem prior to versions 0.3.1, 0.2.1, 0.1.1, and 0.1.0.1 for Ruby.
GitHub Security Advisory: GHSA-4vf4-qmvg-mh7h
Package: cgi (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-565: Reliance on Cookies without Validation and Integrity Checking
Vulnerable versions: = 0.3.0
Patched in: 0.3.1

Summary: Cookie Prefix Spoofing in CGI::Cookie.parse

Details:
CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem prior to versions 0.3.1, 0.2.1, 0.1.1, and 0.1.0.1 for Ruby.
GitHub Security Advisory: GHSA-p65m-qr5x-rrqq
Package: webbynode (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: <= 1.0.5.3
Patched in: unpatched

Summary: Webbynode Code Injection vulnerability

Details:
The message function in `lib/webbynode/notify.rb` in the Webbynode gem 1.0.5.3 and earlier for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a growlnotify message.
GitHub Security Advisory: GHSA-6325-6g32-7p35
Package: flash_tool (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Vulnerable versions: <= 0.6.0
Patched in: unpatched

Summary: flash_tool Gem for Ruby File Download Handling Arbitrary Command Execution

Details:
flash_tool Gem for Ruby contains a flaw that is triggered during the handling of downloaded files that contain shell characters. With a specially crafted file, a context-dependent attacker can execute arbitrary commands.
GitHub Security Advisory: GHSA-5f2p-6vjv-2q2m
Package: sup (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 0.14.0, < 0.14.1.1
Patched in: 0.14.1.1

Summary: Sup Code Injection vulnerability

Details:
Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of an email attachment.
GitHub Security Advisory: GHSA-5f2p-6vjv-2q2m
Package: sup (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: < 0.13.2.1
Patched in: 0.13.2.1

Summary: Sup Code Injection vulnerability

Details:
Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of an email attachment.
GitHub Security Advisory: GHSA-wwh7-4jw9-33x6
Package: yajl-ruby (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-134: Use of Externally-Controlled Format String
Vulnerable versions: < 1.3.1
Patched in: 1.3.1

Summary: yajl-ruby gem Denial of Service vulnerability

Details:
In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to `Yajl::Parser.new.parse`, the whole ruby process crashes with a SIGABRT in the `yajl_string_decode` function in `yajl_encode.c`. This results in the whole ruby process terminating and potentially a denial of service.
GitHub Security Advisory: GHSA-229r-pqp6-8w6g
Package: sprout (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: = 0.7.246
Patched in: unpatched

Summary: sprout Arbitrary Code Execution vulnerability

Details:
The `unpack_zip` function in `archive_unpacker.rb` in the sprout gem 0.7.246 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a (1) filename or (2) path.
GitHub Security Advisory: GHSA-x27v-x225-gq8g
Package: recurly (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 2.0.0, < 2.0.13
Patched in: 2.0.13

Summary: Recurly gem Server-Side Request Forgery in Resource#find method

Details:
The Recurly Client Ruby Library before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerable to a Server-Side Request Forgery vulnerability in the `Resource#find` method that could result in compromise of API keys or other critical resources.
GitHub Security Advisory: GHSA-x27v-x225-gq8g
Package: recurly (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 2.1.0, < 2.1.11
Patched in: 2.1.11

Summary: Recurly gem Server-Side Request Forgery in Resource#find method

Details:
The Recurly Client Ruby Library before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerable to a Server-Side Request Forgery vulnerability in the `Resource#find` method that could result in compromise of API keys or other critical resources.
GitHub Security Advisory: GHSA-x27v-x225-gq8g
Package: recurly (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 2.2.0, < 2.2.5
Patched in: 2.2.5

Summary: Recurly gem Server-Side Request Forgery in Resource#find method

Details:
The Recurly Client Ruby Library before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerable to a Server-Side Request Forgery vulnerability in the `Resource#find` method that could result in compromise of API keys or other critical resources.
GitHub Security Advisory: GHSA-x27v-x225-gq8g
Package: recurly (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 2.3.0, < 2.3.10
Patched in: 2.3.10

Summary: Recurly gem Server-Side Request Forgery in Resource#find method

Details:
The Recurly Client Ruby Library before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerable to a Server-Side Request Forgery vulnerability in the `Resource#find` method that could result in compromise of API keys or other critical resources.
GitHub Security Advisory: GHSA-x27v-x225-gq8g
Package: recurly (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 2.4.0, < 2.4.11
Patched in: 2.4.11

Summary: Recurly gem Server-Side Request Forgery in Resource#find method

Details:
The Recurly Client Ruby Library before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerable to a Server-Side Request Forgery vulnerability in the `Resource#find` method that could result in compromise of API keys or other critical resources.
GitHub Security Advisory: GHSA-x27v-x225-gq8g
Package: recurly (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 2.5.0, < 2.5.4
Patched in: 2.5.4

Summary: Recurly gem Server-Side Request Forgery in Resource#find method

Details:
The Recurly Client Ruby Library before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerable to a Server-Side Request Forgery vulnerability in the `Resource#find` method that could result in compromise of API keys or other critical resources.
GitHub Security Advisory: GHSA-x27v-x225-gq8g
Package: recurly (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 2.6.0, < 2.6.3
Patched in: 2.6.3

Summary: Recurly gem Server-Side Request Forgery in Resource#find method

Details:
The Recurly Client Ruby Library before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerable to a Server-Side Request Forgery vulnerability in the `Resource#find` method that could result in compromise of API keys or other critical resources.
GitHub Security Advisory: GHSA-x27v-x225-gq8g
Package: recurly (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 2.7.0, < 2.7.8
Patched in: 2.7.8

Summary: Recurly gem Server-Side Request Forgery in Resource#find method

Details:
The Recurly Client Ruby Library before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerable to a Server-Side Request Forgery vulnerability in the `Resource#find` method that could result in compromise of API keys or other critical resources.
GitHub Security Advisory: GHSA-x27v-x225-gq8g
Package: recurly (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 2.8.0, < 2.8.2
Patched in: 2.8.2

Summary: Recurly gem Server-Side Request Forgery in Resource#find method

Details:
The Recurly Client Ruby Library before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerable to a Server-Side Request Forgery vulnerability in the `Resource#find` method that could result in compromise of API keys or other critical resources.
GitHub Security Advisory: GHSA-x27v-x225-gq8g
Package: recurly (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 2.9.0, < 2.9.2
Patched in: 2.9.2

Summary: Recurly gem Server-Side Request Forgery in Resource#find method

Details:
The Recurly Client Ruby Library before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerable to a Server-Side Request Forgery vulnerability in the `Resource#find` method that could result in compromise of API keys or other critical resources.
GitHub Security Advisory: GHSA-x27v-x225-gq8g
Package: recurly (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 2.10.0, < 2.10.4
Patched in: 2.10.4

Summary: Recurly gem Server-Side Request Forgery in Resource#find method

Details:
The Recurly Client Ruby Library before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerable to a Server-Side Request Forgery vulnerability in the `Resource#find` method that could result in compromise of API keys or other critical resources.
GitHub Security Advisory: GHSA-x27v-x225-gq8g
Package: recurly (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 2.11.0, < 2.11.3
Patched in: 2.11.3

Summary: Recurly gem Server-Side Request Forgery in Resource#find method

Details:
The Recurly Client Ruby Library before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerable to a Server-Side Request Forgery vulnerability in the `Resource#find` method that could result in compromise of API keys or other critical resources.
GitHub Security Advisory: GHSA-jg4m-q6w8-vrjp
Package: rgpg (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: < 0.2.3
Patched in: 0.2.3

Summary: rgpg Code Injection vulnerability

Details:
The `self.run_gpg` function in `lib/rgpg/gpg_helper.rb` in the rgpg gem before 0.2.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.
GitHub Security Advisory: GHSA-5m2v-hc64-56h6
Package: rubyzip (RUBYGEMS)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 1.3.0
Patched in: 1.3.0

Summary: Rubyzip denial of service 

Details:
In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption).
GitHub Security Advisory: GHSA-rg32-m3hf-772v
Package: slanger (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 0.6.1
Patched in: 0.6.1

Summary: Slanger Arbitrary command execution

Details:
Slanger 0.6.0 is affected by Remote Code Execution (RCE). The impact is A remote attacker can execute arbitrary commands by sending a crafted request to the server. The component is Message handler & request validator. The attack vector is Remote unauthenticated. The fixed version is after commit 5267b455caeb2e055cccf0d2b6a22727c111f5c3.
GitHub Security Advisory: GHSA-688c-3x49-6rqj
Package: rack-protection (RUBYGEMS)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-203: Observable Discrepancy
Vulnerable versions: >= 2.0.0.beta1, <= 2.0.0.rc3
Patched in: 2.0.0

Summary: rack-protection gem timing attack vulnerability when validating CSRF token

Details:
Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to have been fixed in 1.5.5 and 2.0.0.
GitHub Security Advisory: GHSA-688c-3x49-6rqj
Package: rack-protection (RUBYGEMS)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-203: Observable Discrepancy
Vulnerable versions: < 1.5.5
Patched in: 1.5.5

Summary: rack-protection gem timing attack vulnerability when validating CSRF token

Details:
Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to have been fixed in 1.5.5 and 2.0.0.
GitHub Security Advisory: GHSA-jppv-gw3r-w3q8
Package: rake (RUBYGEMS)
Severity: MODERATE (CVSS 6.4)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: <= 12.3.2
Patched in: 12.3.3

Summary: OS Command Injection in Rake

Details:
There is an OS command injection vulnerability in Ruby Rake before 12.3.3 in `Rake::FileList` when supplying a filename that begins with the pipe character `|`.
GitHub Security Advisory: GHSA-wfwm-chj7-w59r
Package: ox (RUBYGEMS)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-125: Out-of-bounds Read
Vulnerable versions: < 2.8.2
Patched in: 2.8.2

Summary: Ox gem stack overflow in sax_parse

Details:
In the Ox gem 2.8.1 for Ruby, the process crashes with a stack-based buffer over-read in the `read_from_str` function in `sax_buf.c` when a crafted input is supplied to `sax_parse`.
GitHub Security Advisory: GHSA-94hm-8q65-rmxm
Package: omniauth-saml (RUBYGEMS)
Severity: HIGH (CVSS 7.7)
CWE: CWE-287: Improper Authentication
Vulnerable versions: < 1.10.0
Patched in: 1.10.0

Summary: OmniAuth-SAML authentication bypass via incorrect XML canonicalization and DOM traversal

Details:
OmniAuth OmniAuth-SAML 1.9.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.
GitHub Security Advisory: GHSA-ww4x-rwq6-qpgf
Package: omniauth (RUBYGEMS)
Severity: HIGH (CVSS 8.8)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: <= 1.9.2
Patched in: 2.0.0

Summary: OmniAuth Ruby gem Cross-site Request Forgery in request phase

Details:
The request phase of the OmniAuth Ruby gem (1.9.2 and earlier) is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, allowing accounts to be connected without user intent, user interaction, or feedback to the user. This permits a secondary account to be able to sign into the web application as the primary account.

As of v2 OmniAuth no longer has the vulnerable configuration by default, but it is still possible to configure OmniAuth in such a way that the web application becomes vulnerable to Cross-Site Request Forgery. There is a recommended remediation described [here](https://github.com/omniauth/omniauth/wiki/Resolving-CVE-2015-9284).
GitHub Security Advisory: GHSA-4g4c-8gqh-m4vm
Package: paranoid2 (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Vulnerable versions: = 1.1.6
Patched in: unpatched

Summary: paranoid2 gem Code backdoor

Details:
The paranoid2 gem 1.1.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1.1.5.
GitHub Security Advisory: GHSA-w754-gq8r-pf5f
Package: mini_magick (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: < 3.6.0
Patched in: 3.6.0

Summary: MiniMagick Gem for Ruby URI Handling Arbitrary Command Injection

Details:
`lib/mini_magick.rb` in the MiniMagick Gem 1.3.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.
GitHub Security Advisory: GHSA-q6cw-2553-7837
Package: newrelic_rpm (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 3.2.0, <= 3.5.3.23
Patched in: 3.5.3.24

Summary: newrelic_rpm Gem Discloses Sensitive Information

Details:
Ruby agent 3.2.0 through 3.5.3.23 serializes sensitive data when communicating with servers operated by New Relic, which allows remote attackers to obtain sensitive information (database credentials and SQL statements) by sniffing the network and deserializing the data.
GitHub Security Advisory: GHSA-hrj5-qp7x-rpg6
Package: marginalia (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: < 1.6
Patched in: 1.6

Summary: SQL Injection in marginalia

Details:
marginalia < 1.6 is affected by SQL Injection. The impact is an injection of any SQL queries when a user controller argument is added as a component. This issue affects users that add a component that is user controller, for instance a parameter or a header. The attack vector is inputting of SQL to a vulnerable vector (header, http parameter, etc). The fixed version is 1.6.
GitHub Security Advisory: GHSA-vc47-6rqg-c7f5
Package: cgi (RUBYGEMS)
Severity: HIGH (CVSS 8.8)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), CWE-436: Interpretation Conflict
Vulnerable versions: < 0.1.0.2
Patched in: 0.1.0.2

Summary: HTTP response splitting in CGI

Details:
Ruby gem cgi.rb prior to versions 0.3.5, 0.2.2 and 0.1.0.2 allow HTTP header injection. If a CGI application using the CGI library inserts untrusted input into the HTTP response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. This issue has been patched in versions 0.3.5, 0.2.2 and 0.1.0.2.
GitHub Security Advisory: GHSA-vc47-6rqg-c7f5
Package: cgi (RUBYGEMS)
Severity: HIGH (CVSS 8.8)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), CWE-436: Interpretation Conflict
Vulnerable versions: >= 0.2.0, < 0.2.2
Patched in: 0.2.2

Summary: HTTP response splitting in CGI

Details:
Ruby gem cgi.rb prior to versions 0.3.5, 0.2.2 and 0.1.0.2 allow HTTP header injection. If a CGI application using the CGI library inserts untrusted input into the HTTP response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. This issue has been patched in versions 0.3.5, 0.2.2 and 0.1.0.2.
GitHub Security Advisory: GHSA-vc47-6rqg-c7f5
Package: cgi (RUBYGEMS)
Severity: HIGH (CVSS 8.8)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), CWE-436: Interpretation Conflict
Vulnerable versions: >= 0.3.0, < 0.3.5
Patched in: 0.3.5

Summary: HTTP response splitting in CGI

Details:
Ruby gem cgi.rb prior to versions 0.3.5, 0.2.2 and 0.1.0.2 allow HTTP header injection. If a CGI application using the CGI library inserts untrusted input into the HTTP response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. This issue has been patched in versions 0.3.5, 0.2.2 and 0.1.0.2.
GitHub Security Advisory: GHSA-r7j3-vvh2-xrpj
Package: mini_magick (RUBYGEMS)
Severity: HIGH (CVSS 7.8)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: < 4.9.4
Patched in: 4.9.4

Summary: OS Command Injection in MiniMagick

Details:
In `lib/mini_magick/image.rb` in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because `Image.open` input is directly passed to `Kernel#open`, which accepts a `|` character followed by a command.
GitHub Security Advisory: GHSA-jphg-qwrw-7w9g
Package: json (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 2.3.0
Patched in: 2.3.0

Summary: Unsafe object creation in json RubyGem

Details:
The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269/GHSA-x457-cw4h-hq5f, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.
GitHub Security Advisory: GHSA-x7p2-x2j6-mwhr
Package: gemirro (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 0.16.0
Patched in: 0.16.0

Summary: Gemirro Stored XSS in Gemspec "homepage" value

Details:
Stored cross-site scripting (XSS) vulnerability in Gemirro before 0.16.0 allows attackers to inject arbitrary web script via a crafted javascript: URL in the "homepage" value of a ".gemspec" file.
A ".gemspec" file must be created with a JavaScript URL in the homepage  value. This can be used to build a gem for upload to the Gemirro server, in order to achieve stored XSS via the author name hyperlink.