Sign upLogin

expertiza/expertiza

View on GitHub
Star

Showing 63 of 4,497 total issues

open-uri-cached Gem for Ruby Unsafe Temporary File Creation Local Privilege Escalation
Open

    open-uri-cached (1.0.0)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2015-3649

URL: http://seclists.org/oss-sec/2015/q2/373

Solution: remove or disable this gem until a patch is available!

ReDoS based DoS vulnerability in GlobalID
Open

    globalid (0.4.2)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2023-22799

URL: https://github.com/rails/globalid/releases/tag/v1.0.1

Solution: upgrade to >= 1.0.1

Unintended read access in kramdown gem
Open

    kramdown (1.17.0)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2020-14001

Criticality: Critical

URL: https://github.com/advisories/GHSA-mqm2-cgpr-p4m6

Solution: upgrade to >= 2.3.0

activerecord-session_store Timing Attack
Open

    activerecord-session_store (1.1.3)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2019-25025

Criticality: Medium

URL: https://github.com/advisories/GHSA-cvw2-xj8r-mjf7

Solution: upgrade to >= 2.0.0

XSS Vulnerability on closeText option of Dialog jQuery UI
Open

    jquery-ui-rails (4.0.3)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2016-7103

Criticality: Medium

URL: https://github.com/jquery/api.jqueryui.com/issues/281

Solution: upgrade to >= 6.0.0

Remote code execution in Kramdown
Open

    kramdown (1.17.0)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2021-28834

Criticality: Critical

URL: https://github.com/advisories/GHSA-52p9-v744-mwjj

Solution: upgrade to >= 2.3.1

Possible exposure of information vulnerability in Action Pack
Open

    actionpack (5.1.0.rc2)
Severity: Critical
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2022-23633

Criticality: High

URL: https://groups.google.com/g/ruby-security-ann/c/FkTM-_7zSNA/m/K2RiMJBlBAAJ

Solution: upgrade to >= 5.2.6.2, ~> 5.2.6, >= 6.0.4.6, ~> 6.0.4, >= 6.1.4.6, ~> 6.1.4, >= 7.0.2.2

Possible RCE escalation bug with Serialized Columns in Active Record
Open

    activerecord (5.1.0.rc2)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2022-32224

Criticality: Critical

URL: https://groups.google.com/g/rubyonrails-security/c/MmFO3LYQE8U

Solution: upgrade to >= 5.2.8.1, ~> 5.2.8, >= 6.0.5.1, ~> 6.0.5, >= 6.1.6.1, ~> 6.1.6, >= 7.0.3.1

Improper neutralization of data URIs may allow XSS in Loofah
Open

    loofah (2.18.0)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2022-23515

Criticality: Medium

URL: https://github.com/flavorjones/loofah/security/advisories/GHSA-228g-948r-83gx

Solution: upgrade to >= 2.19.1

Denial of Service Vulnerability in ActiveRecord’s PostgreSQL adapter
Open

    activerecord (5.1.0.rc2)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2022-44566

URL: https://github.com/rails/rails/releases/tag/v7.0.4.1

Solution: upgrade to >= 5.2.8.15, ~> 5.2.8, >= 6.1.7.1, ~> 6.1.7, >= 7.0.4.1

Code injection in ruby git
Open

    git (1.12.0)
Severity: Critical
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2022-47318

Criticality: High

URL: https://github.com/ruby-git/ruby-git/pull/602

Solution: upgrade to >= 1.13.0

XML Injection in Xerces Java affects Nokogiri
Open

    nokogiri (1.10.10)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2022-23437

Criticality: Medium

URL: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xxx9-3xcr-gjj3

Solution: upgrade to >= 1.13.4

Unsafe objects can be loaded from Redis
Open

    redis-store (1.2.0)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2017-1000248

Criticality: Critical

URL: https://github.com/redis-store/redis-store/commit/ce13252c26fcc40ed4935c9abfeb0ee0761e5704

Solution: upgrade to >= 1.4.0

ReDoS based DoS vulnerability in Action Dispatch
Open

    actionpack (5.1.0.rc2)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2023-22792

URL: https://github.com/rails/rails/releases/tag/v7.0.4.1

Solution: upgrade to >= 5.2.8.15, ~> 5.2.8, >= 6.1.7.1, ~> 6.1.7, >= 7.0.4.1

Potential XSS vulnerability in Action View
Open

    actionview (5.1.0.rc2)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2020-15169

Criticality: Medium

URL: https://groups.google.com/g/rubyonrails-security/c/b-C9kSGXYrc

Solution: upgrade to >= 5.2.4.4, ~> 5.2.4, >= 6.0.3.3

Improper Handling of Unexpected Data Type in Nokogiri
Open

    nokogiri (1.10.10)
Severity: Critical
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2022-29181

Criticality: High

URL: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xh29-r2w5-wx8m

Solution: upgrade to >= 1.13.6

Possible DoS Vulnerability in Action Controller Token Authentication
Open

    actionpack (5.1.0.rc2)
Severity: Critical
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2021-22904

Criticality: High

URL: https://groups.google.com/g/rubyonrails-security/c/Pf1TjkOBdyQ

Solution: upgrade to ~> 5.2.4.6, ~> 5.2.6, >= 6.0.3.7, ~> 6.0.3, >= 6.1.3.2

Possible XSS vulnerability in ActionView
Open

    actionview (5.1.0.rc2)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2020-5267

Criticality: Medium

URL: https://groups.google.com/forum/#!topic/rubyonrails-security/55reWMM_Pg8

Solution: upgrade to >= 5.2.4.2, ~> 5.2.4, >= 6.0.2.2

ReDoS based DoS vulnerability in Active Support’s underscore
Open

    activesupport (5.1.0.rc2)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2023-22796

URL: https://github.com/rails/rails/releases/tag/v7.0.4.1

Solution: upgrade to >= 5.2.8.15, ~> 5.2.8, >= 6.1.7.1, ~> 6.1.7, >= 7.0.4.1

A potential Denial of Service issue in protobuf-java
Open

    google-protobuf (3.8.0)
Severity: Critical
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2021-22569

Criticality: High

URL: https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-wrvw-hg22-4m67

Solution: upgrade to >= 3.19.2

Severity
Category
Status
Source
Language