deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-w3j4-76qw-wwjm
Package: better_errors (RUBYGEMS)
Severity: MODERATE (CVSS 6.3)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: < 2.8.0
Patched in: 2.8.0

Summary: Older releases of better_errors open to Cross-Site Request Forgery attack

Details:
### Impact
better_errors prior to 2.8.0 did not implement CSRF protection for its internal requests. It also did not enforce the correct "Content-Type" header for these requests, which allowed a cross-origin "simple request" to be made without CORS protection. These together left an application with better_errors enabled open to cross-origin attacks.

_As a developer tool, better_errors documentation strongly recommends addition only to the `development` bundle group, so this vulnerability should only affect development environments. Please ensure that your project limits better_errors to the `development` group (or the non-Rails equivalent)._

### Patches
Starting with release 2.8.x, CSRF protection is enforced. It is recommended that you upgrade to the latest release, or minimally to "~> 2.8.3".

### Workarounds
There are no known workarounds to mitigate the risk of using older releases of better_errors.

### References
- Chris Moberly provided [an example attack that uses a now-patched vulnerability of webpack-dev-server in conjunction with Better Errors](https://about.gitlab.com/blog/2021/09/07/why-are-developers-vulnerable-to-driveby-attacks/)

### For more information
If you have any questions or comments about this advisory, please
- Add to the [discussion in better_errors](https://github.com/BetterErrors/better_errors/discussions/507)
- Open an issue in [better_errors](https://github.com/BetterErrors/better_errors)
GitHub Security Advisory: GHSA-6fcq-3cm2-j3j5
Package: kcapifony (RUBYGEMS)
Severity: HIGH (CVSS 7.8)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: <= 2.1.6
Patched in: unpatched

Summary: Kcapifony gem for Ruby places database user passwords on the command line

Details:
`lib/ksymfony1.rb` in the kcapifony gem 2.1.6 for Ruby places database user passwords on the (1) `mysqldump`, (2) `pg_dump`, (3) `mysql`, and (4) `psql` command lines, which allows local users to obtain sensitive information by listing the processes.
GitHub Security Advisory: GHSA-gwrj-88fp-5m36
Package: narou (RUBYGEMS)
Severity: HIGH (CVSS 8.5)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: < 3.8.0
Patched in: 3.8.0

Summary: Code injection in Narou

Details:
Narou (aka Narou.rb) before 3.8.0 allows Ruby Code Injection via the title name or author name of a novel.
GitHub Security Advisory: GHSA-9p29-94hp-8rvc
Package: qiita-markdown (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 0.34.0
Patched in: 0.34.0

Summary: qiita-markdown Cross-site Scripting vulnerability

Details:
Increments Qiita::Markdown before 0.34.0 allows XSS via a crafted gist link, a different vulnerability than CVE-2021-28796.
GitHub Security Advisory: GHSA-hqf9-rc9j-5fmj
Package: activerecord (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: = 4.1.0.beta1
Patched in: 4.1.0.beta2

Summary: Array data injection vulnerability in activerecord

Details:
SQL injection vulnerability in `activerecord/lib/active_record/connection_adapters/postgresql/cast.rb` in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute "add data" SQL commands via vectors involving `\` (backslash) characters that are not properly handled in operations on array columns.
GitHub Security Advisory: GHSA-m42h-mh85-4qgc
Package: railties (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection'), CWE-330: Use of Insufficiently Random Values
Vulnerable versions: >= 5.2.0, <= 5.2.2.0
Patched in: 5.2.2.1

Summary: Use of Insufficiently Random Values in Railties Allows Remote Code Execution

Details:
# Possible Remote Code Execution Exploit in Rails Development Mode

Impact 
------ 
With some knowledge of a target application it is possible for an attacker to  guess the automatically generated development mode secret token.  This secret  token can be used in combination with other Rails internals to escalate to a remote code execution exploit. 

All users running an affected release should either upgrade or use one of the workarounds immediately. 

Releases 
-------- 
The 6.0.0.beta3 and 5.2.2.1 releases are available at the normal locations. 

Workarounds 
----------- 
This issue can be mitigated by specifying a secret key in development mode. 
In "config/environments/development.rb" add this: 

```
  config.secret_key_base = SecureRandom.hex(64) 
```

Please note that only the 5.2.x, 5.1.x, 5.0.x, and 4.2.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases. 

Credits 
------- 
Thanks to ooooooo_q
GitHub Security Advisory: GHSA-543v-gj2c-r3ch
Package: activemodel (RUBYGEMS)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 4.2.0, <= 4.2.5.0
Patched in: 4.2.5.1

Summary: activemodel contains Improper Input Validation

Details:
Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters.
GitHub Security Advisory: GHSA-543v-gj2c-r3ch
Package: activemodel (RUBYGEMS)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 4.1.0, <= 4.1.14.0
Patched in: 4.1.14.1

Summary: activemodel contains Improper Input Validation

Details:
Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters.
GitHub Security Advisory: GHSA-78rc-8c29-p45g
Package: actionpack (RUBYGEMS)
Severity: HIGH (CVSS 7.3)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 4.2.0, <= 4.2.5.1
Patched in: 4.2.5.2

Summary: actionpack allows remote code execution via application's unrestricted use of render method

Details:
Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.
GitHub Security Advisory: GHSA-78rc-8c29-p45g
Package: actionpack (RUBYGEMS)
Severity: HIGH (CVSS 7.3)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 4.0.0, <= 4.1.14.1
Patched in: 4.1.14.2

Summary: actionpack allows remote code execution via application's unrestricted use of render method

Details:
Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.
GitHub Security Advisory: GHSA-78rc-8c29-p45g
Package: actionpack (RUBYGEMS)
Severity: HIGH (CVSS 7.3)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 3.0.0, <= 3.2.22.1
Patched in: 3.2.22.2

Summary: actionpack allows remote code execution via application's unrestricted use of render method

Details:
Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.
GitHub Security Advisory: GHSA-7rr7-rcjw-56vj
Package: activestorage (RUBYGEMS)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 5.2.0, <= 5.2.1.0
Patched in: 5.2.1.1

Summary: Exposure of Sensitive Information to an Unauthorized Actor in activestorage

Details:
A bypass vulnerability in Active Storage >= 5.2.0 for Google Cloud Storage and Disk services allow an attacker to modify the `content-disposition` and `content-type` parameters which can be used in with HTML files and have them executed inline. Additionally, if combined with other techniques such as cookie bombing and specially crafted AppCache manifests, an attacker can gain access to private signed URLs within a specific storage path.

Vulnerable apps are those using either GCS or the Disk service in production. Other storage services such as S3 or Azure aren't affected.
GitHub Security Advisory: GHSA-9h6g-gp95-x3q5
Package: actionpack (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
Vulnerable versions: >= 4.0.0, <= 4.2.5.0
Patched in: 4.2.5.1

Summary: actionpack is vulnerable to denial of service because of a wildcard controller route

Details:
actionpack/lib/action_dispatch/routing/route_set.rb in Action Pack in Ruby on Rails 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows remote attackers to cause a denial of service (superfluous caching and memory consumption) by leveraging an application's use of a wildcard controller route.
GitHub Security Advisory: GHSA-ffpv-c4hm-3x6v
Package: actionpack (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
Vulnerable versions: >= 4.0.0, <= 4.1.14.0
Patched in: 4.1.14.1

Summary: actionpack is vulnerable to denial of service via a crafted HTTP Accept header

Details:
actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header.
GitHub Security Advisory: GHSA-ffpv-c4hm-3x6v
Package: actionpack (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
Vulnerable versions: <= 3.2.22.0
Patched in: 3.2.22.1

Summary: actionpack is vulnerable to denial of service via a crafted HTTP Accept header

Details:
actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header.
GitHub Security Advisory: GHSA-ffpv-c4hm-3x6v
Package: actionpack (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
Vulnerable versions: >= 4.2.0, <= 4.2.5.0
Patched in: 4.2.5.1

Summary: actionpack is vulnerable to denial of service via a crafted HTTP Accept header

Details:
actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header.
GitHub Security Advisory: GHSA-jxjr-5h69-qw3w
Package: nokogiri (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Vulnerable versions: >= 1.6.0, <= 1.6.7.1
Patched in: 1.6.7.2

Summary: Heap-based buffer overflow in nokogiri

Details:
Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3.  A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to use an excessive amount of CPU, leak potentially sensitive information, or crash the application.
GitHub Security Advisory: GHSA-p692-7mm3-3fxg
Package: actionpack (RUBYGEMS)
Severity: LOW (CVSS 3.7)
Vulnerable versions: >= 4.0.0, <= 4.1.14.0
Patched in: 4.1.14.1

Summary: actionpack is vulnerable to remote bypass authentication

Details:
The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to bypass authentication by measuring timing differences.
GitHub Security Advisory: GHSA-p692-7mm3-3fxg
Package: actionpack (RUBYGEMS)
Severity: LOW (CVSS 3.7)
Vulnerable versions: >= 3.1.0, <= 3.2.22.0
Patched in: 3.2.22.1

Summary: actionpack is vulnerable to remote bypass authentication

Details:
The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to bypass authentication by measuring timing differences.
GitHub Security Advisory: GHSA-pr3r-4wrp-r2pv
Package: activerecord (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-284: Improper Access Control, CWE-476: NULL Pointer Dereference
Vulnerable versions: >= 4.2.0, <= 4.2.7.0
Patched in: 4.2.7.1

Summary: ActiveRecord in Ruby on Rails allows database-query bypass

Details:
Active Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660, CVE-2012-2694, and CVE-2013-0155.
GitHub Security Advisory: GHSA-q2qw-rmrh-vv42
Package: activejob (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-284: Improper Access Control, CWE-502: Deserialization of Untrusted Data
Vulnerable versions: >= 5.2.0, <= 5.2.1.0
Patched in: 5.2.1.1

Summary: Improper Access Control in activejob

Details:
A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give them access to information that they should not have.
GitHub Security Advisory: GHSA-q2qw-rmrh-vv42
Package: activejob (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-284: Improper Access Control, CWE-502: Deserialization of Untrusted Data
Vulnerable versions: >= 5.1.0, <= 5.1.6.0
Patched in: 5.1.6.1

Summary: Improper Access Control in activejob

Details:
A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give them access to information that they should not have.
GitHub Security Advisory: GHSA-q2qw-rmrh-vv42
Package: activejob (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-284: Improper Access Control, CWE-502: Deserialization of Untrusted Data
Vulnerable versions: >= 5.0.0, <= 5.0.7.0
Patched in: 5.0.7.1

Summary: Improper Access Control in activejob

Details:
A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give them access to information that they should not have.
GitHub Security Advisory: GHSA-vx9j-46rh-fqr8
Package: actionview (RUBYGEMS)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 4.0.0, <= 4.1.14.1
Patched in: 4.1.14.2

Summary: actionview contains Path Traversal vulnerability

Details:
There is a possible directory traversal and information leak vulnerability in Action View. This was meant to be fixed on CVE-2016-0752. However the 3.2 patch was not covering all possible scenarios. This vulnerability has been assigned the CVE identifier CVE-2016-2097.

Versions Affected:  3.2.x, 4.0.x, 4.1.x
Not affected:       4.2+
Fixed Versions:     3.2.22.2, 4.1.14.2

Impact
------
Applications that pass unverified user input to the `render` method in a controller may be vulnerable to an information leak vulnerability.

Impacted code will look something like this:

```ruby
def index
  render params[:id]
end
```

Carefully crafted requests can cause the above code to render files from unexpected places like outside the application's view directory, and can possibly escalate this to a remote code execution attack.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases
--------
The FIXED releases are available at the normal locations.

Workarounds
-----------
A workaround to this issue is to not pass arbitrary user input to the `render` method. Instead, verify that data before passing it to the `render` method.

For example, change this:

```ruby
def index
  render params[:id]
end
```

To this:

```ruby
def index
  render verify_template(params[:id])
end

private
def verify_template(name)
  # add verification logic particular to your application here
end
```

Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches for it. It is in git-am format and consist of a single changeset.

* 3-2-render_data_leak_2.patch - Patch for 3.2 series
* 4-1-render_data_leak_2.patch - Patch for 4.1 series

Credits
-------
Thanks to both Jyoti Singh and Tobias Kraze from makandra for reporting this and working with us in the patch!
GitHub Security Advisory: GHSA-vx9j-46rh-fqr8
Package: actionview (RUBYGEMS)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 3.0.0, <= 3.2.22.1
Patched in: 3.2.22.2

Summary: actionview contains Path Traversal vulnerability

Details:
There is a possible directory traversal and information leak vulnerability in Action View. This was meant to be fixed on CVE-2016-0752. However the 3.2 patch was not covering all possible scenarios. This vulnerability has been assigned the CVE identifier CVE-2016-2097.

Versions Affected:  3.2.x, 4.0.x, 4.1.x
Not affected:       4.2+
Fixed Versions:     3.2.22.2, 4.1.14.2

Impact
------
Applications that pass unverified user input to the `render` method in a controller may be vulnerable to an information leak vulnerability.

Impacted code will look something like this:

```ruby
def index
  render params[:id]
end
```

Carefully crafted requests can cause the above code to render files from unexpected places like outside the application's view directory, and can possibly escalate this to a remote code execution attack.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases
--------
The FIXED releases are available at the normal locations.

Workarounds
-----------
A workaround to this issue is to not pass arbitrary user input to the `render` method. Instead, verify that data before passing it to the `render` method.

For example, change this:

```ruby
def index
  render params[:id]
end
```

To this:

```ruby
def index
  render verify_template(params[:id])
end

private
def verify_template(name)
  # add verification logic particular to your application here
end
```

Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches for it. It is in git-am format and consist of a single changeset.

* 3-2-render_data_leak_2.patch - Patch for 3.2 series
* 4-1-render_data_leak_2.patch - Patch for 4.1 series

Credits
-------
Thanks to both Jyoti Singh and Tobias Kraze from makandra for reporting this and working with us in the patch!
GitHub Security Advisory: GHSA-xrr4-p6fq-hjg7
Package: actionview (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 4.2.0, <= 4.2.5.0
Patched in: 4.2.5.1

Summary: Directory traversal vulnerability in Action View in Ruby on Rails

Details:
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a `..` (dot dot) in a pathname.
GitHub Security Advisory: GHSA-xrr4-p6fq-hjg7
Package: actionview (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 4.0.0, <= 4.1.14.0
Patched in: 4.1.14.1

Summary: Directory traversal vulnerability in Action View in Ruby on Rails

Details:
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a `..` (dot dot) in a pathname.
GitHub Security Advisory: GHSA-f2rp-4rv7-fc95
Package: foreman_fog_proxmox (RUBYGEMS)
Severity: HIGH (CVSS 7.8)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: < 0.13.1
Patched in: 0.13.1

Summary: Exposure of Sensitive Information to an Unauthorized Actor in foreman_fog_proxmox

Details:
A flaw was found in the Foreman project. The Proxmox compute resource exposes the password through the API to an authenticated local attacker with view_hosts permission. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Versions of foreman_fog_proxmox prior to 0.13.1 are affected.
GitHub Security Advisory: GHSA-fp4w-jxhp-m23p
Package: bundler (RUBYGEMS)
Severity: HIGH (CVSS 8.8)
Vulnerable versions: >= 1.16.0, < 2.2.10
Patched in: 2.2.10

Summary: Dependency Confusion in Bundler

Details:
Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.17 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that is explicitly depended on by the application.