deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-g4xq-jx4w-4cjv
Package: loofah (RUBYGEMS)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.2.3
Patched in: 2.2.3

Summary: Loofah Cross-site Scripting vulnerability

Details:
In the Loofah gem for Ruby, through version 2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished. Users are advised to upgrade to version 2.2.3.

See https://github.com/flavorjones/loofah/issues/154 for more details.
GitHub Security Advisory: GHSA-77pc-q5q7-qg9h
Package: rails-html-sanitizer (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 1.0.3
Patched in: 1.0.3

Summary: Moderate severity vulnerability that affects rails-html-sanitizer

Details:
Withdrawn, accidental duplicate publish.

Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node.
GitHub Security Advisory: GHSA-mrhj-2g4v-39qx
Package: rails-html-sanitizer (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: = 1.0.2
Patched in: 1.0.3

Summary: Moderate severity vulnerability that affects rails-html-sanitizer

Details:
Withdrawn, accidental duplicate publish.

Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem 1.0.2 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via an HTML entity that is mishandled by the Rails::Html::FullSanitizer class.
GitHub Security Advisory: GHSA-qc8j-m8j3-rjq6
Package: rails-html-sanitizer (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 1.0.3
Patched in: 1.0.3

Summary: Moderate severity vulnerability that affects rails-html-sanitizer

Details:
Withdrawn, accidental duplicate publish.

Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via crafted tag attributes.
GitHub Security Advisory: GHSA-35c4-f3rq-f9g3
Package: activesupport (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 3.2.0, < 3.2.22
Patched in: 3.2.22

Summary: Moderate severity vulnerability that affects activesupport

Details:
Withdrawn, accidental duplicate publish.

The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.
GitHub Security Advisory: GHSA-35c4-f3rq-f9g3
Package: activesupport (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 4.2.0, < 4.2.2
Patched in: 4.2.2

Summary: Moderate severity vulnerability that affects activesupport

Details:
Withdrawn, accidental duplicate publish.

The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.
GitHub Security Advisory: GHSA-35c4-f3rq-f9g3
Package: activesupport (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 4.0.0, < 4.1.11
Patched in: 4.1.11

Summary: Moderate severity vulnerability that affects activesupport

Details:
Withdrawn, accidental duplicate publish.

The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.
GitHub Security Advisory: GHSA-9vc2-p34x-jhxh
Package: rack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 1.6.0, < 1.6.2
Patched in: 1.6.2

Summary: Moderate severity vulnerability that affects rack

Details:
Withdrawn, accidental duplicate publish.

lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote attackers to cause a denial of service (SystemStackError) via a request with a large parameter depth.
GitHub Security Advisory: GHSA-9vc2-p34x-jhxh
Package: rack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 1.5.0, < 1.5.4
Patched in: 1.5.4

Summary: Moderate severity vulnerability that affects rack

Details:
Withdrawn, accidental duplicate publish.

lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote attackers to cause a denial of service (SystemStackError) via a request with a large parameter depth.
GitHub Security Advisory: GHSA-9vc2-p34x-jhxh
Package: rack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 1.4.6
Patched in: 1.4.6

Summary: Moderate severity vulnerability that affects rack

Details:
Withdrawn, accidental duplicate publish.

lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote attackers to cause a denial of service (SystemStackError) via a request with a large parameter depth.
GitHub Security Advisory: GHSA-685w-vc84-wxcx
Package: doorkeeper (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: < 1.4.1
Patched in: 1.4.1

Summary: Doorkeeper vulnerable to Cross-site Request Forgery

Details:
Cross-site request forgery (CSRF) vulnerability in doorkeeper before 1.4.1 allows remote attackers to hijack the authentication of unspecified victims for requests that read a user OAuth authorization code via unknown vectors.
GitHub Security Advisory: GHSA-r4x3-g983-9g48
Package: sprockets (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 2.12.0, < 2.12.3
Patched in: 2.12.3

Summary: Moderate severity vulnerability that affects sprockets

Details:
Withdrawn, accidental duplicate publish.

Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.
GitHub Security Advisory: GHSA-r4x3-g983-9g48
Package: sprockets (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 2.11.0, < 2.11.3
Patched in: 2.11.3

Summary: Moderate severity vulnerability that affects sprockets

Details:
Withdrawn, accidental duplicate publish.

Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.
GitHub Security Advisory: GHSA-r4x3-g983-9g48
Package: sprockets (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 2.10.0, < 2.10.2
Patched in: 2.10.2

Summary: Moderate severity vulnerability that affects sprockets

Details:
Withdrawn, accidental duplicate publish.

Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.
GitHub Security Advisory: GHSA-r4x3-g983-9g48
Package: sprockets (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 2.9.0, < 2.9.4
Patched in: 2.9.4

Summary: Moderate severity vulnerability that affects sprockets

Details:
Withdrawn, accidental duplicate publish.

Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.
GitHub Security Advisory: GHSA-r4x3-g983-9g48
Package: sprockets (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 2.8.0, < 2.8.3
Patched in: 2.8.3

Summary: Moderate severity vulnerability that affects sprockets

Details:
Withdrawn, accidental duplicate publish.

Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.
GitHub Security Advisory: GHSA-r4x3-g983-9g48
Package: sprockets (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: = 2.5.0
Patched in: 2.5.1

Summary: Moderate severity vulnerability that affects sprockets

Details:
Withdrawn, accidental duplicate publish.

Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.
GitHub Security Advisory: GHSA-r4x3-g983-9g48
Package: sprockets (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 2.4.0, < 2.4.6
Patched in: 2.4.6

Summary: Moderate severity vulnerability that affects sprockets

Details:
Withdrawn, accidental duplicate publish.

Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.
GitHub Security Advisory: GHSA-r4x3-g983-9g48
Package: sprockets (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 2.2.0, < 2.2.3
Patched in: 2.2.3

Summary: Moderate severity vulnerability that affects sprockets

Details:
Withdrawn, accidental duplicate publish.

Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.
GitHub Security Advisory: GHSA-r4x3-g983-9g48
Package: sprockets (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 2.1.0, < 2.1.4
Patched in: 2.1.4

Summary: Moderate severity vulnerability that affects sprockets

Details:
Withdrawn, accidental duplicate publish.

Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.
GitHub Security Advisory: GHSA-r4x3-g983-9g48
Package: sprockets (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 2.0.5
Patched in: 2.0.5

Summary: Moderate severity vulnerability that affects sprockets

Details:
Withdrawn, accidental duplicate publish.

Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.
GitHub Security Advisory: GHSA-5xmj-wm96-fmw8
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 4.1.0, < 4.1.8
Patched in: 4.1.8

Summary: Moderate severity vulnerability that affects actionpack

Details:
Withdrawn, accidental duplicate publish.

Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via vectors involving a \ (backslash) character, a similar issue to CVE-2014-7818.
GitHub Security Advisory: GHSA-5xmj-wm96-fmw8
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 4.0.0, < 4.0.12
Patched in: 4.0.12

Summary: Moderate severity vulnerability that affects actionpack

Details:
Withdrawn, accidental duplicate publish.

Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via vectors involving a \ (backslash) character, a similar issue to CVE-2014-7818.
GitHub Security Advisory: GHSA-5xmj-wm96-fmw8
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 3.2.21
Patched in: 3.2.21

Summary: Moderate severity vulnerability that affects actionpack

Details:
Withdrawn, accidental duplicate publish.

Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via vectors involving a \ (backslash) character, a similar issue to CVE-2014-7818.
GitHub Security Advisory: GHSA-23v3-qfrj-wmgh
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 4.1.0, < 4.1.7
Patched in: 4.1.7

Summary: Moderate severity vulnerability that affects actionpack

Details:
Withdrawn, accidental duplicate publish.

Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via a /..%2F sequence.
GitHub Security Advisory: GHSA-23v3-qfrj-wmgh
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 4.0.0, < 4.0.11
Patched in: 4.0.11

Summary: Moderate severity vulnerability that affects actionpack

Details:
Withdrawn, accidental duplicate publish.

Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via a /..%2F sequence.
GitHub Security Advisory: GHSA-23v3-qfrj-wmgh
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 3.2.20
Patched in: 3.2.20

Summary: Moderate severity vulnerability that affects actionpack

Details:
Withdrawn, accidental duplicate publish.

Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via a /..%2F sequence.
GitHub Security Advisory: GHSA-qf5x-qgx7-437h
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: = 4.1.0
Patched in: 4.1.1

Summary: Moderate severity vulnerability that affects actionpack

Details:
Withdrawn, accidental duplicate publish.

Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.
GitHub Security Advisory: GHSA-qf5x-qgx7-437h
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 4.0.0, < 4.0.5
Patched in: 4.0.5

Summary: Moderate severity vulnerability that affects actionpack

Details:
Withdrawn, accidental duplicate publish.

Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.
GitHub Security Advisory: GHSA-qf5x-qgx7-437h
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 3.2.18
Patched in: 3.2.18

Summary: Moderate severity vulnerability that affects actionpack

Details:
Withdrawn, accidental duplicate publish.

Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.
GitHub Security Advisory: GHSA-7hp2-xwpj-95jq
Package: nokogiri (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-125: Out-of-bounds Read
Vulnerable versions: >= 1.6.0, < 1.6.8
Patched in: 1.6.8

Summary: Denial of service or RCE from libxml2 and libxslt

Details:
Nokogiri is affected by series of vulnerabilities in libxml2 and libxslt, which are libraries Nokogiri depends on. It was discovered that libxml2 and libxslt incorrectly handled certain malformed documents, which can allow malicious users to cause issues ranging from denial of service to remote code execution attacks.
GitHub Security Advisory: GHSA-2gw2-8q9w-cw8p
Package: ffi (RUBYGEMS)
Severity: HIGH (CVSS 7.8)
CWE: CWE-426: Untrusted Search Path
Vulnerable versions: < 1.9.24
Patched in: 1.9.24

Summary: Ruby-ffi has a DLL loading issue 

Details:
ruby-ffi version 1.9.23 and earlier has a DLL loading issue which can be hijacked on Windows OS, when a Symbol is used as DLL name instead of a String This vulnerability appears to have been fixed in v1.9.24 and later.
GitHub Security Advisory: GHSA-qw8w-2xcp-xg59
Package: passenger (RUBYGEMS)
Severity: LOW (CVSS 0.0)
Vulnerable versions: = 4.0.37
Patched in: 4.0.38

Summary: Insecure use of temporary files in Phusion passenger

Details:
Phusion Passenger 4.0.37 allows local users to write to certain files and directories via a symlink attack on (1) control_process.pid or a (2) generation-* file.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1831.
GitHub Security Advisory: GHSA-c7j7-p5jq-26ff
Package: passenger (RUBYGEMS)
Severity: LOW (CVSS 0.0)
Vulnerable versions: < 4.0.38
Patched in: 4.0.38

Summary: Insecure use of temporary files in passenger

Details:
Phusion Passenger before 4.0.38 allows local users to write to certain files and directories via a symlink attack on 
1. `control_process.pid` or 
2. a generation-* file.
GitHub Security Advisory: GHSA-fxwv-953p-7qpf
Package: passenger (RUBYGEMS)
Severity: LOW (CVSS 3.7)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 5.0.0, < 5.0.22
Patched in: 5.0.22

Summary: Phusion Passenger allows remote attackers to spoof headers

Details:
`agent/Core/Controller/SendRequest.cpp` in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to applications by using an `_` (underscore) character instead of a `-` (dash) character in an HTTP header, as demonstrated by an `X_User` header.
GitHub Security Advisory: GHSA-fxwv-953p-7qpf
Package: passenger (RUBYGEMS)
Severity: LOW (CVSS 3.7)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 4.0.60
Patched in: 4.0.60

Summary: Phusion Passenger allows remote attackers to spoof headers

Details:
`agent/Core/Controller/SendRequest.cpp` in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to applications by using an `_` (underscore) character instead of a `-` (dash) character in an HTTP header, as demonstrated by an `X_User` header.
GitHub Security Advisory: GHSA-m2q3-53fq-7h66
Package: gollum (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: < 4.0.1
Patched in: 4.0.1

Summary: Gollum Exposure of Sensitive Information

Details:
The Precious module in gollum before 4.0.1 allows remote attackers to read arbitrary files by leveraging the lack of a certain temporary-file check.
GitHub Security Advisory: GHSA-x489-jjwm-52g7
Package: devise-two-factor (RUBYGEMS)
Severity: MODERATE (CVSS 5.3)
Vulnerable versions: < 2.0.0
Patched in: 2.0.0

Summary: Tinfoil Devise-two-factor does not "burn" a successfully validated one-time password (OTP)

Details:
Tinfoil Devise-two-factor before 2.0.0 does not strictly follow [RFC 6238 § 5.2 ](https://datatracker.ietf.org/doc/html/rfc6238#section-5.2) and does not "burn" a successfully validated one-time password (aka OTP), which allows physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP through performing a man-in-the-middle attack between the provider and verifier, or "shoulder surfing", and replaying the OTP in the current time-step.