Sign upLogin

stevegrossi/stevegrossi

View on GitHub
Star

Showing 190 of 190 total issues

Possible XSS vulnerability in ActionView
Open

    actionview (4.2.7.1)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2020-5267

Criticality: Medium

URL: https://groups.google.com/forum/#!topic/rubyonrails-security/55reWMM_Pg8

Solution: upgrade to >= 5.2.4.2, ~> 5.2.4, >= 6.0.2.2

Percent-encoded cookies can be used to overwrite existing prefixed cookie names
Open

    rack (1.6.4)
Severity: Critical
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2020-8184

Criticality: High

URL: https://groups.google.com/g/rubyonrails-security/c/OWtmozPH9Ak

Solution: upgrade to ~> 2.1.4, >= 2.2.3

Directory traversal in Rack::Directory app bundled with Rack
Open

    rack (1.6.4)
Severity: Critical
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2020-8161

Criticality: High

URL: https://groups.google.com/forum/#!topic/ruby-security-ann/T4ZIsfRf2eA

Solution: upgrade to ~> 2.1.3, >= 2.2.0

OS Command Injection in Rake
Open

    rake (11.2.2)
Severity: Critical
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2020-8130

Criticality: High

URL: https://github.com/advisories/GHSA-jppv-gw3r-w3q8

Solution: upgrade to >= 12.3.3

Denial of service via multipart parsing in Rack
Open

    rack (1.6.4)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2022-44572

URL: https://github.com/rack/rack/releases/tag/v3.0.4.1

Solution: upgrade to >= 2.0.9.2, ~> 2.0.9, >= 2.1.4.2, ~> 2.1.4, >= 2.2.6.1, ~> 2.2.6, >= 3.0.4.1

Denial of service via header parsing in Rack
Open

    rack (1.6.4)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2022-44570

URL: https://github.com/rack/rack/releases/tag/v3.0.4.1

Solution: upgrade to >= 2.0.9.2, ~> 2.0.9, >= 2.1.4.2, ~> 2.1.4, >= 2.2.6.2, ~> 2.2.6, >= 3.0.4.1

Denial of Service Vulnerability in Rack Content-Disposition parsing
Open

    rack (1.6.4)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2022-44571

URL: https://github.com/rack/rack/releases/tag/v3.0.4.1

Solution: upgrade to >= 2.0.9.2, ~> 2.0.9, >= 2.1.4.2, ~> 2.1.4, >= 2.2.6.1, ~> 2.2.6, >= 3.0.4.1

Possible shell escape sequence injection vulnerability in Rack
Open

    rack (1.6.4)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2022-30123

Criticality: Critical

URL: https://groups.google.com/g/ruby-security-ann/c/LWB10kWzag8

Solution: upgrade to >= 2.0.9.1, ~> 2.0.9, >= 2.1.4.1, ~> 2.1.4, >= 2.2.3.1

simple_form Gem for Ruby Incorrect Access Control for forms based on user input
Open

    simple_form (3.2.1)
Severity: Minor
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2019-16676

Criticality: Critical

URL: https://github.com/plataformatec/simple_form/security/advisories/GHSA-r74q-gxcg-73hx

Solution: upgrade to >= 5.0

Denial of Service Vulnerability in Rack Multipart Parsing
Open

    rack (1.6.4)
Severity: Critical
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2022-30122

Criticality: High

URL: https://groups.google.com/g/ruby-security-ann/c/L2Axto442qk

Solution: upgrade to >= 2.0.9.1, ~> 2.0.9, >= 2.1.4.1, ~> 2.1.4, >= 2.2.3.1

Function bigfoot has 583 lines of code (exceeds 25 allowed). Consider refactoring.
Open

    $.bigfoot = function(options) {


        //  ______   ______   _________  _________  ________  ___   __    _______    ______
        // /_____/\ /_____/\ /________/\/________/\/_______/\/__/\ /__/\ /______/\  /_____/\
Severity: Major
Found in app/assets/javascripts/jquery.bigfoot.js - About 2 days to fix

    File jquery.chosen.js has 1042 lines of code (exceeds 250 allowed). Consider refactoring.
    Open

    // Chosen, a Select Box Enhancer for jQuery and Prototype
// by Patrick Filler for Harvest, http://getharvest.com
//
// Version 1.0.0
// Full source at https://github.com/harvesthq/chosen
    Severity: Major
    Found in app/assets/javascripts/jquery.chosen.js - About 2 days to fix

      File jquery.bigfoot.js has 587 lines of code (exceeds 250 allowed). Consider refactoring.
      Open

      //   _______    ________  _______    ______   ______   ______   _________
// /_______/\  /_______/\/______/\  /_____/\ /_____/\ /_____/\ /________/\
// \::: _  \ \ \__.::._\/\::::__\/__\::::_\/_\:::_ \ \\:::_ \ \\__.::.__\/
//  \::(_)  \/_   \::\ \  \:\ /____/\\:\/___/\\:\ \ \ \\:\ \ \ \  \::\ \
//   \::  _  \ \  _\::\ \__\:\\_  _\/ \:::._\/ \:\ \ \ \\:\ \ \ \  \::\ \
      Severity: Major
      Found in app/assets/javascripts/jquery.bigfoot.js - About 1 day to fix

        Integer Overflow or Wraparound in libxml2 affects Nokogiri
        Open

            nokogiri (1.6.8)
        Severity: Critical
        Found in Gemfile.lock by bundler-audit

        Advisory:

        Criticality: High

        URL: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-cgx6-hpwq-fhv5

        Solution: upgrade to >= 1.13.5

        Loofah XSS Vulnerability
        Open

            loofah (2.0.3)
        Severity: Minor
        Found in Gemfile.lock by bundler-audit

        Advisory: CVE-2018-8048

        Criticality: Medium

        URL: https://github.com/flavorjones/loofah/issues/144

        Solution: upgrade to >= 2.2.1

        Inefficient Regular Expression Complexity in Loofah
        Open

            loofah (2.0.3)
        Severity: Critical
        Found in Gemfile.lock by bundler-audit

        Advisory: CVE-2022-23514

        Criticality: High

        URL: https://github.com/flavorjones/loofah/security/advisories/GHSA-486f-hjj9-9vhh

        Solution: upgrade to >= 2.19.1

        Prototype pollution attack through jQuery $.extend
        Open

            jquery-rails (4.2.1)
        Severity: Minor
        Found in Gemfile.lock by bundler-audit

        Advisory: CVE-2019-11358

        Criticality: Medium

        URL: https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/

        Solution: upgrade to >= 4.3.4

        Nokogiri Command Injection Vulnerability via Nokogiri::CSS::Tokenizer#load_file
        Open

            nokogiri (1.6.8)
        Severity: Minor
        Found in Gemfile.lock by bundler-audit

        Advisory: CVE-2019-5477

        Criticality: Critical

        URL: https://github.com/sparklemotion/nokogiri/issues/1915

        Solution: upgrade to >= 1.10.4

        Potential XSS vulnerability in jQuery
        Open

            jquery-rails (4.2.1)
        Severity: Minor
        Found in Gemfile.lock by bundler-audit

        Advisory: CVE-2020-11023

        Criticality: Medium

        URL: https://blog.jquery.com/2020/04/10/jquery-3-5-0-released

        Solution: upgrade to >= 4.4.0

        Regular Expression Denial of Service in Addressable templates
        Open

            addressable (2.3.6)
        Severity: Critical
        Found in Gemfile.lock by bundler-audit

        Advisory: CVE-2021-32740

        Criticality: High

        URL: https://github.com/advisories/GHSA-jxhc-q857-3j6g

        Solution: upgrade to >= 2.8.0

        Severity
        Category
        Status
        Source
        Language