bundler-audit 0.4.0 → 0.7.0.1

data/data/ruby-advisory-db/gems/auto_awesomplete/OSVDB-132800.yml

@@ -0,0 +1,11 @@
+---
+gem: auto_awesomplete
+osvdb: 132800
+url: https://github.com/Tab10id/auto_awesomplete/issues/2
+title: |
+  auto_awesomplete Gem for Ruby allows arbitrary search execution
+date: 2016-01-08
+description: |
+  auto_awesomplete Gem for Ruby contains a flaw that is triggered when handling the
+  'params[:default_class_name]' option. This allows users to search any object
+  of all given ActiveRecord classes.

data/data/ruby-advisory-db/gems/auto_select2/OSVDB-132800.yml

@@ -0,0 +1,13 @@
+---
+gem: auto_select2
+osvdb: 132800
+url: https://github.com/Loriowar/auto_select2/issues/4
+title: |
+  auto_select2 Gem for Ruby allows arbitrary search execution
+date: 2016-01-08
+description: |
+  auto_select2 Gem for Ruby contains a flaw that is triggered when handling the
+  'params[:default_class_name]' option. This allows users to search any object
+  of all given ActiveRecord classes.
+patched_versions:
+  - ">= 0.5.0"

data/data/ruby-advisory-db/gems/awesome-bot/CVE-2019-15224.yml

@@ -0,0 +1,19 @@
+---
+gem: awesome-bot
+cve: 2019-15224
+ghsa: 333g-rpr4-7hxq
+url: https://github.com/rubygems/rubygems.org/issues/2097
+date: 2019-08-20
+title: Code execution backdoor in awesome-bot
+description: |
+  The awesome-bot gem 1.18.0 for Ruby, as distributed on RubyGems.org, included a code-execution
+  backdoor inserted by a third party.
+
+  Users of an affected version should consider downgrading to the last non-affected version of
+  1.17.2 or upgrading to 1.19.x.
+unaffected_versions:
+  - "< 1.18.0"
+  - "> 1.18.0"
+related:
+  url:
+    - https://github.com/rubygems/rubygems.org/wiki/Gems-yanked-and-accounts-locked#19-aug-2019

data/data/ruby-advisory-db/gems/awesome_spawn/CVE-2014-0156.yml

@@ -0,0 +1,19 @@
+---
+gem: awesome_spawn
+cve: 2014-0156
+url: https://github.com/ManageIQ/awesome_spawn/commit/e524f85f1c6e292ef7d117d7818521307ac269ff
+title: OS command injection flaw in awesome_spawn
+date: 2014-03-28
+
+description: >-
+  Awesome spawn contains OS command injection vulnerability, which allows
+  execution of additional commands passed to Awesome spawn as arguments, e.g.
+  AwesomeSpawn.run('ls',:params => {'-l' => ";touch haxored"}). If untrusted
+  input was included in command arguments, attacker could use this flaw to
+  execute arbitrary command.
+  
+cvss_v2:  6.8
+
+patched_versions:
+  - "~> 1.2.0"
+  - ">= 1.3.0"

data/data/ruby-advisory-db/gems/backup-agoddard/CVE-2014-4993.yml

@@ -0,0 +1,8 @@
+---
+gem: backup-agoddard
+cve: 2014-4993
+osvdb: 108578
+url: https://nvd.nist.gov/vuln/detail/CVE-2014-4993
+title: backup-agoddard Gem for Ruby /lib/backup/cli/utility.rb Process Table Local Plaintext Password Disclosure
+date: 2014-06-30
+description: backup-agoddard Gem for Ruby contains a flaw in /lib/backup/cli/utility.rb that is due to the application exposing password information in plaintext in the process table. This may allow a local attacker to gain access to password information.

data/data/ruby-advisory-db/gems/backup_checksum/CVE-2014-4993.yml

@@ -0,0 +1,12 @@
+---
+gem: backup_checksum
+cve: 2014-4993
+osvdb: 108569
+url: https://nvd.nist.gov/vuln/detail/CVE-2014-4993
+title: backup_checksum Gem for Ruby /lib/backup/cli/utility.rb Process List Local Plaintext Password Disclosure
+date: 2014-06-30
+description: |
+  backup_checksum Gem for Ruby contains a flaw in /lib/backup/cli/utility.rb
+  that is triggered as the program displays password information in plaintext
+  in the process list. This may allow a local attacker to gain access to
+  password information.

data/data/ruby-advisory-db/gems/backup_checksum/OSVDB-108570.yml

@@ -0,0 +1,10 @@
+---
+gem: backup_checksum
+osvdb: 108570
+url: http://osvdb.org/show/osvdb/108570
+title: backup_checksum Gem for Ruby /lib/backup/cli/utility.rb Metacharacter Handling Remote Command Execution
+date: 2014-06-30
+description: |
+  backup_checksum Gem for Ruby contains a flaw in /lib/backup/cli/utility.rb
+  that is triggered when handling metacharacters. This may allow a remote
+  attacker to execute arbitrary commands.

data/data/ruby-advisory-db/gems/bcrypt-ruby/OSVDB-62067.yml

@@ -0,0 +1,19 @@
+---
+gem: bcrypt-ruby
+platform: jruby
+osvdb: 62067
+url: http://www.mindrot.org/files/jBCrypt/internat.adv
+title: bcrypt-ruby Gem for Ruby incorrect encoding of non US-ASCII characters (JRuby only)
+date: 2010-02-01
+description: |
+  bcrypt-ruby Gem for Ruby suffered from a bug related to character
+  encoding that substantially reduced the entropy of hashed passwords
+  containing non US-ASCII characters. An incorrect encoding step
+  transparently replaced such characters by '?' prior to hashing. In the
+  worst case of a password consisting solely of non-US-ASCII characters,
+  this would cause its hash to be equivalent to all other such passwords
+  of the same length. This issue only affects the JRuby implementation.
+
+  This gem has been renamed. Please use "bcrypt" from now on.
+patched_versions:
+  - ">= 2.1.4"

data/data/ruby-advisory-db/gems/bcrypt/OSVDB-62067.yml

@@ -0,0 +1,17 @@
+---
+gem: bcrypt
+platform: jruby
+osvdb: 62067
+url: http://www.mindrot.org/files/jBCrypt/internat.adv
+title: bcrypt-ruby Gem for Ruby incorrect encoding of non US-ASCII characters (JRuby only)
+date: 2010-02-01
+description: |
+  bcrypt-ruby Gem for Ruby suffered from a bug related to character
+  encoding that substantially reduced the entropy of hashed passwords
+  containing non US-ASCII characters. An incorrect encoding step
+  transparently replaced such characters by '?' prior to hashing. In the
+  worst case of a password consisting solely of non-US-ASCII characters,
+  this would cause its hash to be equivalent to all other such passwords
+  of the same length. This issue only affects the JRuby implementation.
+patched_versions:
+  - ">= 2.1.4"

data/data/ruby-advisory-db/gems/bibtex-ruby/CVE-2019-10780.yml

@@ -0,0 +1,16 @@
+---
+gem: bibtex-ruby
+cve: 2019-10780
+ghsa: c5r5-7pfh-6qg6
+url: https://github.com/advisories/GHSA-c5r5-7pfh-6qg6
+date: 2020-02-14
+title: OS command injection in BibTeX-Ruby
+description: |
+  BibTeX-ruby before 5.1.0 allows shell command injection due to unsanitized
+  user input being passed directly to the built-in Ruby Kernel.open method through
+  BibTeX.open.
+
+cvss_v3: 9.8
+
+patched_versions:
+  - ">= 5.1.0"

data/data/ruby-advisory-db/gems/bio-basespace-sdk/CVE-2013-7111.yml

@@ -0,0 +1,8 @@
+---
+gem: bio-basespace-sdk
+cve: 2013-7111
+osvdb: 101031
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-7111
+title: Bio Basespace SDK Gem for Ruby Command Line API Key Disclosure
+date: 2013-12-14
+description: Bio Basespace SDK Gem for Ruby contains a flaw that is due to the API client code passing the API_KEY to a curl command. This may allow a local attacker to gain access to API key information by monitoring the process table.

data/data/ruby-advisory-db/gems/bitcoin_vanity/CVE-2019-15224.yml

@@ -0,0 +1,18 @@
+---
+gem: bitcoin_vanity
+cve: 2019-15224
+ghsa: 333g-rpr4-7hxq
+url: https://github.com/rubygems/rubygems.org/issues/2097
+date: 2019-08-20
+title: Code execution backdoor in bitcoin_vanity
+description: |
+  The bitcoin_vanity gem 4.3.3 for Ruby, as distributed on RubyGems.org, included a code-execution
+  backdoor inserted by a third party.
+
+  No unaffected version is known to exist, as the gem appears to have been entirely removed.
+unaffected_versions:
+  - "< 4.3.3"
+  - "> 4.3.3"
+related:
+  url:
+    - https://github.com/rubygems/rubygems.org/wiki/Gems-yanked-and-accounts-locked#19-aug-2019

data/data/ruby-advisory-db/gems/blockchain_wallet/CVE-2019-15224.yml

@@ -0,0 +1,19 @@
+---
+gem: blockchain_wallet
+cve: 2019-15224
+ghsa: 333g-rpr4-7hxq
+url: https://github.com/rubygems.org/issues/2097
+date: 2019-08-20
+title: Code execution backdoor in blockchain_wallet
+description: |
+  The blockchain_wallet gem 0.0.6 through 0.0.7 for Ruby, as distributed on RubyGems.org, included
+  a code-execution backdoor inserted by a third party.
+
+  Users of an affected version should consider downgrading to the last non-affected version of
+  0.0.5.
+unaffected_versions:
+  - "< 0.0.6"
+  - "> 0.0.7"
+related:
+  url:
+    - https://github.com/rubygems/rubygems.org/wiki/Gems-yanked-and-accounts-locked#19-aug-2019

data/data/ruby-advisory-db/gems/bootstrap-sass/CVE-2016-10735.yml

@@ -0,0 +1,20 @@
+---
+gem: bootstrap-sass
+cve: 2016-10735
+url: https://blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0/
+title: XSS vulnerability via data-target in bootstrap-sass
+date: 2016-07-27
+
+description: |
+  In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2,
+  XSS is possible in the data-target attribute.
+
+cvss_v2: 4.3
+cvss_v3: 6.1
+
+patched_versions:
+  - '>= 3.4.0'
+
+related:
+  url:
+    - https://github.com/twbs/bootstrap/issues/20184

data/data/ruby-advisory-db/gems/bootstrap-sass/CVE-2019-10842.yml

@@ -0,0 +1,25 @@
+---
+gem: bootstrap-sass
+cve: 2019-10842
+url: https://github.com/twbs/bootstrap-sass/issues/1195
+title: Remote code execution in bootstrap-sass
+date: 2019-04-04
+
+description: |
+  Arbitrary code execution (via backdoor code, when 
+  downloaded from rubygems.org) was discovered in 
+  bootstrap-sass 3.2.0.3.
+  
+  Users are advised to upgrade immediately to 3.2.0.4
+  
+  An unauthenticated attacker can craft the ___cfduid cookie value
+  with base64 arbitrary code to be executed via eval(), which can
+  be leveraged to execute arbitrary code on the target system. 
+  (Note that there are three underscore characters in the cookie name. 
+  This is unrelated to the __cfduid cookie that is legitimately used by 
+  Cloudflare.)
+
+unaffected_versions:
+  - "<= 3.2.0.2"
+patched_versions:
+  - ">= 3.2.0.4"

data/data/ruby-advisory-db/gems/bootstrap-sass/CVE-2019-8331.yml

@@ -0,0 +1,20 @@
+---
+gem: bootstrap-sass
+cve: 2019-8331
+url: https://blog.getbootstrap.com/2019/02/13/bootstrap-4-3-1-and-3-4-1/
+title: XSS vulnerability in bootstrap-sass
+date: 2019-02-15
+
+description: |
+  In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible
+  in the tooltip or popover data-template attribute.
+
+cvss_v2: 4.3
+cvss_v3: 6.1
+
+patched_versions:
+  - '>= 3.4.1'
+
+related:
+  url:
+    - https://github.com/twbs/bootstrap-sass/releases/tag/v3.4.1

data/data/ruby-advisory-db/gems/bootstrap/CVE-2016-10735.yml

@@ -0,0 +1,20 @@
+---
+gem: bootstrap
+cve: 2016-10735
+url: https://blog.getbootstrap.com/2018/07/12/bootstrap-4-1-2/
+title: XSS vulnerability via data-target in bootstrap
+date: 2016-07-27
+
+description: |
+  In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2,
+  XSS is possible in the data-target attribute.
+
+cvss_v2: 4.3
+cvss_v3: 6.1
+
+patched_versions:
+  - '>= 4.0.0-beta.2'
+
+related:
+  url:
+    - https://github.com/twbs/bootstrap/issues/20184

data/data/ruby-advisory-db/gems/bootstrap/CVE-2018-14040.yml

@@ -0,0 +1,24 @@
+---
+gem: bootstrap
+cve: 2018-14040
+url: https://blog.getbootstrap.com/2018/07/12/bootstrap-4-1-2/
+title: XSS vulnerabilities via data-parent, data-target, data-container in bootstrap
+date: 2018-07-03
+
+description: |
+  In Bootstrap before 4.1.2, XSS is possible in collapse data-parent
+  attribute (CVE-2018-14040), data-target property of scrollspy
+  (CVE-2018-14041), data-container property of tooltip (CVE-2018-14042)
+
+cvss_v2: 4.3
+cvss_v3: 6.1
+
+patched_versions:
+  - '>= 4.1.2'
+
+related:
+  cve:
+    - 2018-14041
+    - 2018-14042
+  url:
+    - https://github.com/twbs/bootstrap/issues/26423

data/data/ruby-advisory-db/gems/bootstrap/CVE-2019-8331.yml

@@ -0,0 +1,20 @@
+---
+gem: bootstrap
+cve: 2019-8331
+url: https://blog.getbootstrap.com/2019/02/13/bootstrap-4-3-1-and-3-4-1/
+title: XSS vulnerability in bootstrap
+date: 2019-02-15
+
+description: |
+  In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible
+  in the tooltip or popover data-template attribute.
+
+cvss_v2: 4.3
+cvss_v3: 6.1
+
+patched_versions:
+  - '>= 4.3.1'
+
+related:
+  url:
+    - https://github.com/twbs/bootstrap-rubygem/releases/tag/v4.3.1

data/data/ruby-advisory-db/gems/brakeman/CVE-2019-18409.yml

@@ -0,0 +1,26 @@
+---
+gem: brakeman
+cve: 2019-18409
+date: 2019-10-24
+url: https://brakemanscanner.org/blog/2019/10/14/brakeman-4-dot-7-dot-1-released
+title: brakeman world writable files allow local privilege escalation
+
+description: |
+  The ruby_parser-legacy (aka legacy) gem 1.0.0 for Ruby allows local
+  privilege escalation because of world-writable files. For example,
+  if the brakeman gem (which has a legacy dependency) 4.5.0 through 4.7.0 is used,
+  a local user can insert malicious code into the
+  ruby_parser-legacy-1.0.0/lib/ruby_parser/legacy/ruby_parser.rb file.
+
+cvss_v2: 4.6
+cvss_v3: 7.8
+
+patched_versions:
+  - ">= 4.7.1"
+
+unaffected_versions:
+  - "<= 4.4.0"
+
+related:
+  url:
+    - https://github.com/zenspider/ruby_parser-legacy/issues/1

data/data/ruby-advisory-db/gems/brbackup/CVE-2014-5004.yml

@@ -0,0 +1,11 @@
+---
+gem: brbackup
+cve: 2014-5004
+osvdb: 108901
+url: https://nvd.nist.gov/vuln/detail/CVE-2014-5004
+title: brbackup Gem for Ruby Process List Local Plaintext Password Disclosure
+date: 2014-07-09
+description: |
+  brbackup Gem for Ruby contains a flaw that is due to the program exposing
+  password information in plaintext in the process list. This may allow a
+  local attacker to gain access to password information.

data/data/ruby-advisory-db/gems/brbackup/OSVDB-108899.yml

@@ -0,0 +1,12 @@
+---
+gem: brbackup
+osvdb: 108899
+url: http://osvdb.org/show/osvdb/108899
+title: brbackup Gem for Ruby /lib/brbackup.rb name Parameter SQL Injection
+date: 2014-07-09
+description: |
+  brbackup Gem for Ruby contains a flaw that may allow carrying out an SQL
+  injection attack. The issue is due to the /lib/brbackup.rb script not
+  properly sanitizing user-supplied input to the 'name' parameter. This may
+  allow a remote attacker to inject or manipulate SQL queries in the back-end
+  database, allowing for the manipulation or disclosure of arbitrary data.

data/data/ruby-advisory-db/gems/brbackup/OSVDB-108900.yml

@@ -0,0 +1,11 @@
+---
+gem: brbackup
+osvdb: 108900
+url: http://osvdb.org/show/osvdb/108900
+title: brbackup Gem for Ruby dbuser Variable Shell Metacharacter Injection Remote Command Execution
+date: 2014-07-09
+description: |
+  brbackup Gem for Ruby contains a flaw that is triggered as input passed
+  via the 'dbuser' variable is not properly sanitized. This may allow a
+  remote attacker to inject shell metacharacters and execute arbitrary
+  commands.

data/data/ruby-advisory-db/gems/bson/CVE-2015-4411.yml

@@ -0,0 +1,21 @@
+---
+gem: bson
+cve: 2015-4411
+ghsa: qh4w-7pw3-p4rp
+url: https://github.com/advisories/GHSA-qh4w-7pw3-p4rp
+date: 2020-04-29
+title: Potential denial of service in bson rubygem
+description: |
+  The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4
+  as used in rubygem-moped allows remote attackers to cause a denial of service (worker
+  resource consumption) via a crafted string. NOTE: This issue is due to an incomplete
+  fix to CVE-2015-4410.
+
+cvss_v3: 7.5
+
+patched_versions:
+  - ">= 3.0.4"
+
+related:
+  cve:
+  - 2015-4410

data/data/ruby-advisory-db/gems/bson/CVE-2015-4412.yml

@@ -0,0 +1,18 @@
+---
+gem: bson
+cve: 2015-4412
+url: http://sakurity.com/blog/2015/06/04/mongo_ruby_regexp.html
+title: Data Injection Vulnerability in bson Rubygem
+date: 2015-06-04
+
+description: >-
+  A flaw in the ObjectId validation regular expression can enable attackers to inject arbitrary information into a given BSON object.
+
+patched_versions:
+  - "~> 1.12.3"
+  - ">= 3.0.4"
+
+related:
+  url:
+    - https://github.com/mongodb/mongo-ruby-driver/compare/6ae981167759d5819ba3d41e374e5b2af5b79077~1...9859a3ab9773a8a883eb8438b665a921cc991c71
+    - https://github.com/mongodb/bson-ruby/compare/7446d7c6764dfda8dc4480ce16d5c023e74be5ca...28f34978a85b689a4480b4d343389bf4886522e7