deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-228g-948r-83gx
Package: loofah (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.1.0, < 2.19.1
Patched in: 2.19.1

Summary: Improper neutralization of data URIs may allow XSS in Loofah

Details:
## Summary

Loofah `>= 2.1.0, < 2.19.1` is vulnerable to cross-site scripting via the `image/svg+xml` media type in data URIs.


## Mitigation

Upgrade to Loofah `>= 2.19.1`.


## Severity

The Loofah maintainers have evaluated this as [Medium Severity 6.1](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).


## References

- [CWE - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (4.9)](https://cwe.mitre.org/data/definitions/79.html)
- [SVG MIME Type (image/svg+xml) is misleading to developers · Issue #266 · w3c/svgwg](https://github.com/w3c/svgwg/issues/266)
- https://hackerone.com/reports/1694173
- https://github.com/flavorjones/loofah/issues/101

## Credit

This vulnerability was responsibly reported by Maciej Piechota (@haqpl).
GitHub Security Advisory: GHSA-486f-hjj9-9vhh
Package: loofah (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: < 2.19.1
Patched in: 2.19.1

Summary: Inefficient Regular Expression Complexity in Loofah

Details:
## Summary

Loofah `< 2.19.1` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a denial of service through CPU resource consumption.


## Mitigation

Upgrade to Loofah `>= 2.19.1`.


## Severity

The Loofah maintainers have evaluated this as [High Severity 7.5 (CVSS3.1)](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).


## References

- [CWE - CWE-1333: Inefficient Regular Expression Complexity (4.9)](https://cwe.mitre.org/data/definitions/1333.html)
- https://hackerone.com/reports/1684163


## Credit

This vulnerability was responsibly reported by @ooooooo-q (https://github.com/ooooooo-q).
GitHub Security Advisory: GHSA-q4m3-2j7h-f7xw
Package: jquery-rails (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.2.0
Patched in: 2.2.0

Summary: Cross-Site Scripting in jquery

Details:
Versions of `jquery` prior to 1.9.0 are vulnerable to Cross-Site Scripting. The load method fails to recognize and remove `<script>` HTML tags that contain a whitespace character, i.e: `</script >`, which results in the enclosed script logic to be executed. This allows attackers to execute arbitrary JavaScript in a victim's browser.


## Recommendation

Upgrade to version 1.9.0 or later.
GitHub Security Advisory: GHSA-g266-3crh-h7gj
Package: ldoce (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: <= 0.0.2
Patched in: unpatched

Summary: ldoce Gem Arbitrary Command Execution

Details:
`lib/ldoce/word.rb` in the ldoce 0.0.2 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in (1) an mp3 URL or (2) file name.
GitHub Security Advisory: GHSA-rhgq-vv9x-j4p5
Package: lawn-login (RUBYGEMS)
Severity: HIGH (CVSS 7.8)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: = 0.0.7
Patched in: unpatched

Summary: lawn-login exposes database password to unauthorized users

Details:
The login function in `lib/lawn.rb` in the lawn-login gem 0.0.7 for Ruby places credentials on the curl command line, which allows local users to obtain sensitive information by listing the process.
GitHub Security Advisory: GHSA-rp63-jfmw-532w
Package: mail (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 2.4.3
Patched in: 2.4.3

Summary: Mail Gem Improper Input Validation vulnerability

Details:
The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery.
GitHub Security Advisory: GHSA-cvw2-xj8r-mjf7
Package: activerecord-session_store (RUBYGEMS)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-208: Observable Timing Discrepancy
Vulnerable versions: <= 1.1.3
Patched in: 2.0.0

Summary: Activerecord-session_store Vulnerable to Timing Attack

Details:
The `activerecord-session_store` (aka Active Record Session Store) component through 1.1.3 for Ruby on Rails does not use a constant-time approach when delivering information about whether a guessed session ID is valid. Consequently, remote attackers can leverage timing discrepancies to achieve a correct guess in a relatively short amount of time. This is a related issue to CVE-2019-16782. 

## Recommendation

This has been fixed in version 2.0.0.  All users are advised to update to this version or later.
GitHub Security Advisory: GHSA-f2c9-5jqw-3xh3
Package: qiita-markdown (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 0.33.0
Patched in: 0.33.0

Summary: Cross-Site Scripting in Qiita-Markdown

Details:
Increments Qiita-Markdown before 0.33.0 allows XSS in transformers.
GitHub Security Advisory: GHSA-746g-3gfp-hfhw
Package: devise (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-288: Authentication Bypass Using an Alternate Path or Channel, CWE-312: Cleartext Storage of Sensitive Information
Vulnerable versions: < 3.5.4
Patched in: 3.5.4

Summary: Devise Gem for Ruby Unauthorized Access Using "Remember Me" Cookie

Details:
Devise version before 3.5.4 uses cookies to implement a "Remember me" functionality. However, it generates the same cookie for all devices. If an attacker manages to steal a remember me cookie and the user does not change the password frequently, the cookie can be used to gain access to the application indefinitely.
GitHub Security Advisory: GHSA-88p8-4vv5-82j7
Package: xaviershay-dm-rails (RUBYGEMS)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: <= 1.2.0
Patched in: unpatched

Summary: xaviershay-dm-rails Gem for Ruby exposes sensitive information via the process table

Details:
xaviershay-dm-rails Gem for Ruby contains a flaw in the `execute()` function in `/datamapper/dm-rails/blob/master/lib/dm-rails/storage.rb`. The issue is due to the function exposing sensitive information via the process table. This may allow a local attack to gain access to MySQL credential information.
GitHub Security Advisory: GHSA-25f5-gc4h-hc22
Package: devise_masquerade (RUBYGEMS)
Severity: HIGH (CVSS 8.1)
CWE: CWE-269: Improper Privilege Management
Vulnerable versions: < 1.3.1
Patched in: 1.3.1

Summary: Improper Privilege Management in devise_masquerade

Details:
The devise_masquerade gem before 1.3 allows certain attacks when a password's salt is unknown. An application that uses this gem to let administrators masquerade/impersonate users loses one layer of security protection compared to a situation where Devise (without this extension) is used. If the server-side `secret_key_base` value became publicly known (for instance if it is committed to a public repository by mistake), there are still other protections in place that prevent an attacker from impersonating any user on the site. When masquerading is not used in a plain Devise application, one must know the password salt of the target user if one wants to encrypt and sign a valid session cookie. When `devise_masquerade` is used, however, an attacker can decide which user the "back" action will go back to without knowing that user's password salt and simply knowing the user ID, by manipulating the session cookie and pretending that a user is already masqueraded by an administrator.
GitHub Security Advisory: GHSA-4f68-49qq-h392
Package: em-imap (RUBYGEMS)
Severity: HIGH (CVSS 7.4)
CWE: CWE-295: Improper Certificate Validation
Vulnerable versions: <= 0.5
Patched in: unpatched

Summary: Improper certificate validation in em-imap

Details:
em-imap 0.5 and earlier use the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The hostname in a TLS server certificate is not verified.
GitHub Security Advisory: GHSA-2j9c-9vmv-7m39
Package: rack-cors (RUBYGEMS)
Severity: HIGH (CVSS 8.8)
Vulnerable versions: < 0.4.1
Patched in: 0.4.1

Summary: Missing Regex anchor in Rack-Cors allows malicious third party site to perform CORS request

Details:
Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. If the configuration were intended to allow only the trusted `example.com` domain name and not the malicious `example.net` domain name, then `example.com.example.net` (as well as `example.com-example.net`) would be inadvertently allowed.
GitHub Security Advisory: GHSA-3fhf-6939-qg8p
Package: rest-client (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-384: Session Fixation
Vulnerable versions: >= 1.6.1.a, < 1.8.0
Patched in: 1.8.0

Summary: rest-client Gem Vulnerable to Session Fixation

Details:
REST client for Ruby (aka rest-client) versions 1.6.1.a until 1.8.0 allow remote attackers to conduct session fixation attacks or obtain sensitive cookie information by leveraging passage of cookies set in a response to a redirect.
GitHub Security Advisory: GHSA-6x45-86q6-rcmr
Package: gyazo (RUBYGEMS)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: = 1.0.0
Patched in: 2.0.0

Summary: Gyazo allows local users to write arbitrary files

Details:
`lib/gyazo/client.rb` in the gyazo gem 1.0.0 for Ruby allows local users to write to arbitrary files via a symlink attack on a temporary file, related to time-based filenames.
GitHub Security Advisory: GHSA-5vx5-9q73-wgp4
Package: safemode (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-184: Incomplete List of Disallowed Inputs
Vulnerable versions: < 1.3.2
Patched in: 1.3.2

Summary: Safemode Gem Has Incomplete List of Disallowed Inputs

Details:
rubygem-safemode, as used in Foreman, versions 1.3.1 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax. This can lead to deletion of objects for which the user does not have delete permissions or possibly to privilege escalation.
GitHub Security Advisory: GHSA-94cq-7ccq-cmcm
Package: lynx (RUBYGEMS)
Severity: HIGH (CVSS 7.8)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: <= 0.4.0
Patched in: 1.0.0

Summary: lynx doesn't properly sanitize user input and exposes database password to unauthorized users

Details:
The lynx gem prior to 1.0.0 for Ruby places the configured password on command lines, which allows local users to obtain sensitive information by listing processes.

As of version 1.0.0, lynx no longer supports a `--password` option. Passwords are only configured in a configuration file, so it's no longer possible to expose passwords on the command line.
GitHub Security Advisory: GHSA-c43v-hrmg-56r4
Package: cocaine (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: >= 0.4.0, < 0.5.3
Patched in: 0.5.3

Summary: Cocaine Gem OS Command Injection vulnerability

Details:
The Cocaine gem 0.4.0 through 0.5.2 for Ruby allows context-dependent attackers to execute arbitrary commands via a crafted has object, related to recursive variable interpolation.
GitHub Security Advisory: GHSA-c92m-rrrc-q5wf
Package: safemode (RUBYGEMS)
Severity: HIGH (CVSS 8.1)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: < 1.2.4
Patched in: 1.2.4

Summary: safemode gem allows context-dependent attackers to obtain sensitive information via the inspect method

Details:
The Safemode gem before 1.2.4 for Ruby, when initialized with a delegate object that is a Rails controller, allows context-dependent attackers to obtain sensitive information via the inspect method.
GitHub Security Advisory: GHSA-cj92-c4fj-w9c5
Package: mail (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 2.4.4
Patched in: 2.4.4

Summary: Mail Gem Path Traversal vulnerability

Details:
Directory traversal vulnerability in `lib/mail/network/delivery_methods/file_delivery.rb` in the Mail gem before 2.4.4 for Ruby allows remote attackers to read arbitrary files via a `..` (dot dot) in the to parameter.
GitHub Security Advisory: GHSA-q86f-fmqf-qrf6
Package: mail (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
Vulnerable versions: < 2.5.5
Patched in: 2.5.5

Summary: Mail Gem CRLF Injection vulnerability

Details:
The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring.
GitHub Security Advisory: GHSA-pr3h-jjhj-573x
Package: sprockets (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 4.0.0.beta1, <= 4.0.0.beta7
Patched in: 4.0.0.beta8

Summary: Sprockets path traversal leads to information leak

Details:
Specially crafted requests can be used to access files that exist on the filesystem that is outside an application's root directory, when the Sprockets server is used in production.
  
All users running an affected release should either upgrade or use one of the work arounds immediately.
  
### Workaround:
  
In Rails applications, work around this issue, set `config.assets.compile = false` and `config.public_file_server.enabled = true` in an initializer and precompile the assets.

This work around will not be possible in all hosting environments and upgrading is advised.
GitHub Security Advisory: GHSA-pr3h-jjhj-573x
Package: sprockets (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 3.0.0, < 3.7.2
Patched in: 3.7.2

Summary: Sprockets path traversal leads to information leak

Details:
Specially crafted requests can be used to access files that exist on the filesystem that is outside an application's root directory, when the Sprockets server is used in production.
  
All users running an affected release should either upgrade or use one of the work arounds immediately.
  
### Workaround:
  
In Rails applications, work around this issue, set `config.assets.compile = false` and `config.public_file_server.enabled = true` in an initializer and precompile the assets.

This work around will not be possible in all hosting environments and upgrading is advised.
GitHub Security Advisory: GHSA-pr3h-jjhj-573x
Package: sprockets (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: < 2.12.5
Patched in: 2.12.5

Summary: Sprockets path traversal leads to information leak

Details:
Specially crafted requests can be used to access files that exist on the filesystem that is outside an application's root directory, when the Sprockets server is used in production.
  
All users running an affected release should either upgrade or use one of the work arounds immediately.
  
### Workaround:
  
In Rails applications, work around this issue, set `config.assets.compile = false` and `config.public_file_server.enabled = true` in an initializer and precompile the assets.

This work around will not be possible in all hosting environments and upgrading is advised.
GitHub Security Advisory: GHSA-h5g2-38x9-4gv3
Package: minitar (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 0.6
Patched in: 0.6

Summary: archive-tar-minitar and minitar vulnerable to Path Traversal

Details:
Directory traversal vulnerability in the minitar before 0.6 and archive-tar-minitar 0.5.2 gems for Ruby allows remote attackers to write to arbitrary files via a `..` (dot dot) in a TAR archive entry.
GitHub Security Advisory: GHSA-h5g2-38x9-4gv3
Package: archive-tar-minitar (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 0.5.2
Patched in: 0.5.2

Summary: archive-tar-minitar and minitar vulnerable to Path Traversal

Details:
Directory traversal vulnerability in the minitar before 0.6 and archive-tar-minitar 0.5.2 gems for Ruby allows remote attackers to write to arbitrary files via a `..` (dot dot) in a TAR archive entry.
GitHub Security Advisory: GHSA-jxhw-mg8m-2pj8
Package: devise (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-704: Incorrect Type Conversion or Cast
Vulnerable versions: >= 1.5.0, < 1.5.4
Patched in: 1.5.4

Summary: Devise does not properly perform type conversion when performing database queries

Details:
Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass security checks via unknown vectors, as demonstrated by resetting passwords of arbitrary accounts.
GitHub Security Advisory: GHSA-jxhw-mg8m-2pj8
Package: devise (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-704: Incorrect Type Conversion or Cast
Vulnerable versions: >= 2.0.0, < 2.0.5
Patched in: 2.0.5

Summary: Devise does not properly perform type conversion when performing database queries

Details:
Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass security checks via unknown vectors, as demonstrated by resetting passwords of arbitrary accounts.
GitHub Security Advisory: GHSA-jxhw-mg8m-2pj8
Package: devise (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-704: Incorrect Type Conversion or Cast
Vulnerable versions: >= 2.1.0, < 2.1.3
Patched in: 2.1.3

Summary: Devise does not properly perform type conversion when performing database queries

Details:
Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass security checks via unknown vectors, as demonstrated by resetting passwords of arbitrary accounts.
GitHub Security Advisory: GHSA-jxhw-mg8m-2pj8
Package: devise (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-704: Incorrect Type Conversion or Cast
Vulnerable versions: >= 2.2.0, < 2.2.3
Patched in: 2.2.3

Summary: Devise does not properly perform type conversion when performing database queries

Details:
Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass security checks via unknown vectors, as demonstrated by resetting passwords of arbitrary accounts.
GitHub Security Advisory: GHSA-6c3j-c64m-qhgq
Package: jquery-rails (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Vulnerable versions: < 4.3.4
Patched in: 4.3.4

Summary: XSS in jQuery as used in Drupal, Backdrop CMS, and other products

Details:
jQuery from 1.1.4 until 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles `jQuery.extend(true, {}, ...)` because of `Object.prototype` pollution. If an unsanitized source object contained an enumerable `__proto__` property, it could extend the native `Object.prototype`.
GitHub Security Advisory: GHSA-77hg-g8cc-5r37
Package: puppet (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-269: Improper Privilege Management
Vulnerable versions: >= 2.7, < 2.7.11
Patched in: 2.7.11

Summary: Puppet Privilege Escallation

Details:
The change_user method in the SUIDManager (lib/puppet/util/suidmanager.rb) in Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3 does not properly manage group privileges, which allows local users to gain privileges via vectors related to (1) the change_user not dropping supplementary groups in certain conditions, (2) changes to the eguid without associated changes to the egid, or (3) the addition of the real gid to supplementary groups.
GitHub Security Advisory: GHSA-77hg-g8cc-5r37
Package: puppet (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-269: Improper Privilege Management
Vulnerable versions: >= 2.6, < 2.6.14
Patched in: 2.6.14

Summary: Puppet Privilege Escallation

Details:
The change_user method in the SUIDManager (lib/puppet/util/suidmanager.rb) in Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3 does not properly manage group privileges, which allows local users to gain privileges via vectors related to (1) the change_user not dropping supplementary groups in certain conditions, (2) changes to the eguid without associated changes to the egid, or (3) the addition of the real gid to supplementary groups.
GitHub Security Advisory: GHSA-c4mc-49hq-q275
Package: puppet (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-377: Insecure Temporary File
Vulnerable versions: >= 2.7, < 2.7.13
Patched in: 2.7.13

Summary: Puppet uses predictable filenames, allowing arbitrary file overwrite

Details:
Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp.
GitHub Security Advisory: GHSA-c4mc-49hq-q275
Package: puppet (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-377: Insecure Temporary File
Vulnerable versions: >= 2.6, < 2.6.15
Patched in: 2.6.15

Summary: Puppet uses predictable filenames, allowing arbitrary file overwrite

Details:
Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp.
GitHub Security Advisory: GHSA-5cqm-crxm-6qpv
Package: cgi (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-190: Integer Overflow or Wraparound
Vulnerable versions: < 0.1.0.1
Patched in: 0.1.0.1

Summary: Buffer overrun in CGI.escape_html

Details:
A buffer overrun vulnerability was discovered in CGI.escape_html. This can lead to a buffer overflow when a user passes a very large string (> 700 MB) to CGI.escape_html on a platform where long type takes 4 bytes, typically, Windows.