deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-gh2w-j7cx-2664
Package: activerecord (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 3.2.0, < 3.2.10
Patched in: 3.2.10

Summary: Active Record contains SQL Injection

Details:
SQL injection vulnerability in the Active Record component in Ruby on Rails before 2.3.15, 3.0.x before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain find_by_ method calls.
GitHub Security Advisory: GHSA-gh2w-j7cx-2664
Package: activerecord (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 3.1.0, < 3.1.9
Patched in: 3.1.9

Summary: Active Record contains SQL Injection

Details:
SQL injection vulnerability in the Active Record component in Ruby on Rails before 2.3.15, 3.0.x before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain find_by_ method calls.
GitHub Security Advisory: GHSA-jmgw-6vjg-jjwg
Package: actionpack (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 3.2.0, < 3.2.11
Patched in: 3.2.11

Summary: actionpack Improper Input Validation vulnerability

Details:
`active_support/core_ext/hash/conversions.rb` in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
GitHub Security Advisory: GHSA-jmgw-6vjg-jjwg
Package: actionpack (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 3.1.0, < 3.1.10
Patched in: 3.1.10

Summary: actionpack Improper Input Validation vulnerability

Details:
`active_support/core_ext/hash/conversions.rb` in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
GitHub Security Advisory: GHSA-jmgw-6vjg-jjwg
Package: actionpack (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 3.0.0, < 3.0.19
Patched in: 3.0.19

Summary: actionpack Improper Input Validation vulnerability

Details:
`active_support/core_ext/hash/conversions.rb` in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
GitHub Security Advisory: GHSA-jmgw-6vjg-jjwg
Package: actionpack (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 2.3.15
Patched in: 2.3.15

Summary: actionpack Improper Input Validation vulnerability

Details:
`active_support/core_ext/hash/conversions.rb` in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
GitHub Security Advisory: GHSA-v2r9-c84j-v7xm
Package: rdoc (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.3.0, < 3.12.1
Patched in: 3.12.1

Summary: RDoc contains XSS vulnerability

Details:
darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.
GitHub Security Advisory: GHSA-x457-cw4h-hq5f
Package: json (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 1.7.0, < 1.7.7
Patched in: 1.7.7

Summary: JSON gem has Improper Input Validation vulnerability

Details:
The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."
GitHub Security Advisory: GHSA-x457-cw4h-hq5f
Package: json (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 1.6.0, < 1.6.8
Patched in: 1.6.8

Summary: JSON gem has Improper Input Validation vulnerability

Details:
The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."
GitHub Security Advisory: GHSA-x457-cw4h-hq5f
Package: json (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 1.5.5
Patched in: 1.5.5

Summary: JSON gem has Improper Input Validation vulnerability

Details:
The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."
GitHub Security Advisory: GHSA-574q-fxfj-wv6h
Package: puppet (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 3.1.0, < 3.1.1
Patched in: 3.1.1

Summary: Puppet Improper Input Validation vulnerability

Details:
Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "serialized attributes."
GitHub Security Advisory: GHSA-p463-639r-q9g9
Package: dragonfly (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 0.9, < 0.9.13
Patched in: 0.9.13

Summary: Dragonfly Code Injection vulnerability

Details:
The Dragonfly gem 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby, when used with Ruby on Rails, allows remote attackers to execute arbitrary code via a crafted request.
GitHub Security Advisory: GHSA-p463-639r-q9g9
Package: dragonfly (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 0.7, < 0.8.6
Patched in: 0.8.6

Summary: Dragonfly Code Injection vulnerability

Details:
The Dragonfly gem 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby, when used with Ruby on Rails, allows remote attackers to execute arbitrary code via a crafted request.
GitHub Security Advisory: GHSA-6c8p-qphv-668v
Package: ruby-openid (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 2.2.2
Patched in: 2.2.2

Summary: Denial of service in ruby-openid

Details:
The ruby-openid gem before 2.2.2 for Ruby allows remote OpenID providers to cause a denial of service (CPU consumption) via (1) a large XRDS document or (2) an XML Entity Expansion (XEE) attack.
GitHub Security Advisory: GHSA-9c2j-593q-3g82
Package: activesupport (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 3.2.0, < 3.2.13
Patched in: 3.2.13

Summary: activesupport Improper Input Validation vulnerability

Details:
The `ActiveSupport::XmlMini_JDOM` backend in `lib/active_support/xml_mini/jdom.rb` in the Active Support component in Ruby on Rails 3.0.x and 3.1.x before 3.1.12 and 3.2.x before 3.2.13, when JRuby is used, does not properly restrict the capabilities of the XML parser, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving (1) an external DTD or (2) an external entity declaration in conjunction with an entity reference.
GitHub Security Advisory: GHSA-9c2j-593q-3g82
Package: activesupport (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 3.0.0, < 3.1.12
Patched in: 3.1.12

Summary: activesupport Improper Input Validation vulnerability

Details:
The `ActiveSupport::XmlMini_JDOM` backend in `lib/active_support/xml_mini/jdom.rb` in the Active Support component in Ruby on Rails 3.0.x and 3.1.x before 3.1.12 and 3.2.x before 3.2.13, when JRuby is used, does not properly restrict the capabilities of the XML parser, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving (1) an external DTD or (2) an external entity declaration in conjunction with an entity reference.
GitHub Security Advisory: GHSA-j838-vfpq-fmf2
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 3.2.0, < 3.2.13
Patched in: 3.2.13

Summary: actionpack Cross-site Scripting vulnerability

Details:
The sanitize helper in `lib/action_controller/vendor/html-scanner/html/sanitizer.rb` in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded `:` (colon) characters in URLs, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted scheme name, as demonstrated by including a `&#x3a;` sequence.
GitHub Security Advisory: GHSA-j838-vfpq-fmf2
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 3.0.0, < 3.1.12
Patched in: 3.1.12

Summary: actionpack Cross-site Scripting vulnerability

Details:
The sanitize helper in `lib/action_controller/vendor/html-scanner/html/sanitizer.rb` in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded `:` (colon) characters in URLs, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted scheme name, as demonstrated by including a `&#x3a;` sequence.
GitHub Security Advisory: GHSA-j838-vfpq-fmf2
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.3.18
Patched in: 2.3.18

Summary: actionpack Cross-site Scripting vulnerability

Details:
The sanitize helper in `lib/action_controller/vendor/html-scanner/html/sanitizer.rb` in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded `:` (colon) characters in URLs, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted scheme name, as demonstrated by including a `&#x3a;` sequence.
GitHub Security Advisory: GHSA-p673-hjf2-pwfr
Package: command_wrap (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: <= 0.6.2
Patched in: unpatched

Summary: Shell command injection in command_wrap

Details:
command_wrap.rb in the command_wrap Gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL or filename.
GitHub Security Advisory: GHSA-78j3-7wpm-qhvp
Package: kelredd-pruview (RUBYGEMS)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: <= 0.5.0
Patched in: unpatched

Summary: Shell Metacharacter Injection in kelredd-pruview

Details:
kelredd-pruview gem 0.3.8 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument to document.rb, video.rb, or video_image.rb.
GitHub Security Advisory: GHSA-m6f7-46hw-grcj
Package: cremefraiche (RUBYGEMS)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: < 0.6.1
Patched in: 0.6.1

Summary: Creme Fraiche contains OS Command Injection

Details:
The set_meta_data function in lib/cremefraiche.rb in the Creme Fraiche gem before 0.6.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the file name of an email attachment.  NOTE: some of these details are obtained from third party information.
GitHub Security Advisory: GHSA-9qj7-jvg4-qr2x
Package: passenger (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-377: Insecure Temporary File
Vulnerable versions: >= 4.0.1, < 4.0.5
Patched in: 4.0.5

Summary: Phusion Passenger Denial of Service

Details:
Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary "config" file in a directory with a predictable name in `/tmp/` before it is used by the gem.
GitHub Security Advisory: GHSA-9qj7-jvg4-qr2x
Package: passenger (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-377: Insecure Temporary File
Vulnerable versions: < 3.0.21
Patched in: 3.0.21

Summary: Phusion Passenger Denial of Service

Details:
Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary "config" file in a directory with a predictable name in `/tmp/` before it is used by the gem.
GitHub Security Advisory: GHSA-f7p5-w2cr-7cp7
Package: puppet (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 3.2.0, < 3.2.2
Patched in: 3.2.2

Summary: Puppet Improper Input Validation vulnerability

Details:
Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.
GitHub Security Advisory: GHSA-f7p5-w2cr-7cp7
Package: puppet (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 2.7.0, < 2.7.22
Patched in: 2.7.22

Summary: Puppet Improper Input Validation vulnerability

Details:
Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.
GitHub Security Advisory: GHSA-w6rc-q387-vpgq
Package: passenger (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-59: Improper Link Resolution Before File Access ('Link Following')
Vulnerable versions: < 4.0.6
Patched in: 4.0.6

Summary: insecure temporary directory usage in passenger

Details:
ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/.
GitHub Security Advisory: GHSA-rg5m-3fqp-6px8
Package: actionmailer (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-134: Use of Externally-Controlled Format String
Vulnerable versions: >= 3.0.0, < 3.2.15
Patched in: 3.2.15

Summary: actionmailer email address processing causes Denial of service

Details:
Multiple format string vulnerabilities in log_subscriber.rb files in the log subscriber component in Action Mailer in Ruby on Rails 3.x before 3.2.15 allow remote attackers to cause a denial of service via a crafted e-mail address that is improperly handled during construction of a log message.
GitHub Security Advisory: GHSA-rprj-g6xc-p5gq
Package: wicked (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 1.0.1
Patched in: 1.0.1

Summary: Wicked gem contains Path traversal vulnerability

Details:
The Wicked gem prior to v1.0.1 allows a remote attacker to traverse directories on the system via a vulnerability in `controller/concerns/render_redirect.rb`. An attacker can send a specially-crafted URL request containing `%2E%2E%2F` directory traversal sequences to read arbitrary files on the system.
GitHub Security Advisory: GHSA-r5hc-9xx5-97rw
Package: i18n (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 0.6.6
Patched in: 0.6.6

Summary: i18n gem Cross-site Scripting vulnerability 

Details:
Cross-site scripting (XSS) vulnerability in exceptions.rb in the i18n gem before 0.6.6 for Ruby allows remote attackers to inject arbitrary web script or HTML via a crafted I18n::MissingTranslationData.new call.
GitHub Security Advisory: GHSA-cf36-985g-v73c
Package: omniauth-facebook (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 1.4.1, < 1.5.0
Patched in: 1.5.0

Summary: omniauth-facebook Cross-Site Request Forgery vulnerability

Details:
The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via the state parameter.
GitHub Security Advisory: GHSA-cj43-9h3w-v976
Package: puppet (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 2.7.0, < 2.7.23
Patched in: 2.7.23

Summary: Puppet allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service

Details:
Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service.  NOTE: this vulnerability can only be exploited utilizing unspecified "local file system access" to the Puppet Master.
GitHub Security Advisory: GHSA-rfmf-rx8w-935w
Package: sounder (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: < 1.0.2
Patched in: 1.0.2

Summary: Sounder Contains Arbitrary Command Execution Vulnerability

Details:
lib/sounder/sound.rb in the sounder gem 1.0.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a filename.
GitHub Security Advisory: GHSA-mpxf-gcw2-pw5q
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 4.0.0, < 4.0.2
Patched in: 4.0.2

Summary: actionpack Improper Input Validation vulnerability

Details:
`actionpack/lib/action_view/lookup_context.rb` in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to cause a denial of service (memory consumption) via a header containing an invalid MIME type that leads to excessive caching.
GitHub Security Advisory: GHSA-mpxf-gcw2-pw5q
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 3.0.0, < 3.2.16
Patched in: 3.2.16

Summary: actionpack Improper Input Validation vulnerability

Details:
`actionpack/lib/action_view/lookup_context.rb` in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to cause a denial of service (memory consumption) via a header containing an invalid MIME type that leads to excessive caching.
GitHub Security Advisory: GHSA-w37c-q653-qg95
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 4.0.0, < 4.0.2
Patched in: 4.0.2

Summary: actionpack Cross-site Scripting vulnerability

Details:
Cross-site scripting (XSS) vulnerability in the simple_format helper in `actionpack/lib/action_view/helpers/text_helper.rb` in Ruby on Rails 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML attribute.
GitHub Security Advisory: GHSA-8r6h-7x9g-xmw9
Package: will_paginate (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 3.0.5
Patched in: 3.0.5

Summary: will_paginate Cross-site Scripting vulnerability

Details:
Cross-site scripting (XSS) vulnerability in the will_paginate gem before 3.0.5 for Ruby allows remote attackers to inject arbitrary web script or HTML via vectors involving generated pagination links.
GitHub Security Advisory: GHSA-4c4w-3q45-hp9j
Package: aescrypt (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-330: Use of Insufficiently Random Values
Vulnerable versions: <= 1.0.0
Patched in: unpatched

Summary: Aescrypt does not sufficiently use random values

Details:
The aescrypt gem 1.0.0 for Ruby does not randomize the CBC IV for use with the AESCrypt.encrypt and AESCrypt.decrypt functions, which allows attackers to defeat cryptographic protection mechanisms via a chosen plaintext attack.
GitHub Security Advisory: GHSA-hqf9-rc9j-5fmj
Package: activerecord (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 4.0.0, < 4.0.3
Patched in: 4.0.3

Summary: Array data injection vulnerability in activerecord

Details:
SQL injection vulnerability in `activerecord/lib/active_record/connection_adapters/postgresql/cast.rb` in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute "add data" SQL commands via vectors involving `\` (backslash) characters that are not properly handled in operations on array columns.