bundler-audit 0.7.0.1 → 0.8.0.rc1

data/data/ruby-advisory-db/gems/simple_captcha2/CVE-2019-14282.yml

@@ -1,13 +0,0 @@
----
-gem: simple_captcha2
-cve: 2019-14282
-url: https://github.com/rubygems/rubygems.org/issues/2073
-date: 2019-07-31
-title: Code backdoor in simple_captcha2
-description: |
-  The simple_captcha2 gem 0.2.3 for Ruby, as distributed on RubyGems.org,
-  included a code-execution backdoor inserted by a third party.
-unaffected_versions:
-  - "< 0.2.3"
-  - "> 0.2.3"
-cvss_v3: 9.8

data/data/ruby-advisory-db/gems/simple_form/CVE-2019-16676.yml

@@ -1,15 +0,0 @@
----
-gem: simple_form
-cve: 2019-16676
-ghsa: r74q-gxcg-73hx
-url: https://github.com/plataformatec/simple_form/security/advisories/GHSA-r74q-gxcg-73hx
-title: simple_form Gem for Ruby Incorrect Access Control for forms based on user input
-date: 2019-09-27
-description: |
-  Simple Form before 5.0 has Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`,
-  because a user-supplied string is invoked as a method call.
-  
-  This only happens for pages that build forms based on user input.
-
-patched_versions:
-  - ">= 5.0"

data/data/ruby-advisory-db/gems/sinatra/CVE-2018-11627.yml

@@ -1,16 +0,0 @@
----
-gem: sinatra
-cve: 2018-11627
-url: https://github.com/sinatra/sinatra/issues/1428
-title: XSS via the 400 Bad Request page
-date: 2018-05-31
-description: |
-  Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception.
-
-cvss_v3: 6.1
-
-patched_versions:
-  - ">= 2.0.2"
-unaffected_versions:
-  - "< 2.0.0.beta1"
-  - "2.0.0-alpha"

data/data/ruby-advisory-db/gems/sinatra/CVE-2018-7212.yml

@@ -1,19 +0,0 @@
----
-gem: sinatra
-cve: 2018-7212
-url: https://github.com/sinatra/sinatra/pull/1379
-date: 2018-01-09
-title: sinatra ruby gem path traversal via backslash characters on Windows
-description: |
-  An issue was discovered in rack-protection/lib/rack/protection/path_traversal.rb
-  in Sinatra 2.x before 2.0.1 on Windows. Path traversal is possible via backslash
-  characters.
-
-cvss_v3: 5.3
-cvss_v2: 5.0
-
-patched_versions:
-  - ">= 2.0.1"
-
-unaffected_versions:
-  - "< 2.0.0"

data/data/ruby-advisory-db/gems/slanger/CVE-2019-1010306.yml

@@ -1,16 +0,0 @@
----
-gem: slanger
-cve: 2019-1010306
-ghsa: rg32-m3hf-772v
-url: https://github.com/stevegraham/slanger/pull/238
-date: 2019-07-16
-title: Arbitrary command execution in slanger
-description: |
-  A remote attacker can execute arbitrary commands by sending a crafted request to the server.
-
-  This is due to the use of `Oj.load` instead of `Oj.strict_load` when processing messages.
-
-  Note that `slanger` is no longer maintained.
-patched_versions:
-  - ">= 0.6.1"
-cvss_v3: 9.8

data/data/ruby-advisory-db/gems/smart_proxy_dynflow/CVE-2018-14643.yml

@@ -1,18 +0,0 @@
----
-gem: smart_proxy_dynflow
-cve: 2018-14643
-url: https://github.com/theforeman/smart_proxy_dynflow/pull/54
-date: 2018-09-14
-title: smart_proxy_dynflow gem authentication bypass in Foreman remote execution feature
-description: |
-  An authentication bypass flaw was found in the smart_proxy_dynflow component
-  used by Foreman. A malicious attacker can use this flaw to remotely execute arbitrary
-  commands on machines managed by vulnerable Foreman instances, in a highly privileged
-  context.
-
-cvss_v3: 9.8
-cvss_v2: 10.0
-
-patched_versions:
-  - ~> 0.1.11
-  - ">= 0.2.1"

data/data/ruby-advisory-db/gems/sorcery/CVE-2020-11052.yml

@@ -1,27 +0,0 @@
----
-gem: sorcery
-cve: 2020-11052
-ghsa: jc8m-cxhj-668x
-url: https://github.com/Sorcery/sorcery/security/advisories/GHSA-jc8m-cxhj-668x
-date: 2020-05-07
-title: Improper Restriction of Excessive Authentication Attempts in Sorcery
-description: |-
-  ### Impact
-  Brute force vulnerability when using password authentication via Sorcery.
-  The brute force protection submodule will prevent a brute force attack for
-  the defined lockout period, but once expired protection will not be re-enabled
-  until a user or malicious actor logs in successfully. This does not affect users
-  that do not use the built-in brute force protection submodule, nor users that use
-  permanent account lockout.
-
-  ### Patches
-  Patched as of version `0.15.0`.
-
-  ### Workarounds
-  Currently no workarounds, other than monkey patching the authenticate method
-  provided by Sorcery or upgrading to version `0.15.0`.
-
-cvss_v3: 8.3
-
-patched_versions:
-  - ">= 0.15.0"

data/data/ruby-advisory-db/gems/sounder/CVE-2013-5647.yml

@@ -1,14 +0,0 @@
----
-gem: sounder
-cve: 2013-5647
-osvdb: 96278
-url: https://nvd.nist.gov/vuln/detail/CVE-2013-5647
-title: Sounder Gem for Ruby File Name Handling Arbitrary Command Execution
-date: 2013-08-14
-description: |
-  Sounder Gem for Ruby contains a flaw that is triggered during the handling
-  of file names. This may allow a context-dependent attacker to execute
-  arbitrary commands.
-cvss_v2: 7.5
-patched_versions: 
-  - ">= 1.0.2"

data/data/ruby-advisory-db/gems/spina/CVE-2015-4619.yml

@@ -1,16 +0,0 @@
----
-gem: spina
-cve: 2015-4619
-title: Cross-site request forgery (CSRF) vulnerability in Spina gem
-date: 2015-06-16
-url: http://www.openwall.com/lists/oss-security/2015/06/16/11
-
-description: >-
-  `Spina::ApplicationController` actions didn't have CSRF
-  protection. This causes a CSRF vulnerability across the
-  entire engine which includes administrative functionality
-  such as creating users, changing passwords,
-  and media management.
-
-patched_versions:
-  - ">= 0.6.29"

data/data/ruby-advisory-db/gems/spree/OSVDB-119205.yml

@@ -1,18 +0,0 @@
----
-gem: spree
-osvdb: 119205
-url: https://spreecommerce.com/blog/security-updates-2015-3-3
-title: Spree API Information Disclosure CSRF
-date: 2015-03-05
-description: |
-  Spree contains a flaw in the API as HTTP requests do not require multiple
-  steps, explicit confirmation, or a unique token when performing certain
-  sensitive actions. By tricking a user into following a specially crafted
-  link, a context-dependent attacker can perform a Cross-Site Request Forgery
-  (CSRF / XSRF) attack causing the victim to disclose potentially sensitive
-  information to attackers.
-patched_versions:
-  - ~> 2.2.10
-  - ~> 2.3.8
-  - ~> 2.4.5
-  - ">= 3.0.0.rc4"

data/data/ruby-advisory-db/gems/spree/OSVDB-125699.yml

@@ -1,18 +0,0 @@
----
-gem: spree
-osvdb: 125699
-url: https://spreecommerce.com/blog/security-updates-2015-7-28
-title: |
-  Spree RABL templates rendering allows Arbitrary Code Execution and File
-  Disclosure
-date: 2015-07-28
-description: |
-  Spree contains a flaw where the rendering of arbitrary RABL templates allows
-  for execution arbitrary files on the host system, as well as disclosing the
-  existence of files on the system. This is a different issue than
-  OSVDB-125701.
-patched_versions:
-  - ~> 2.2.13
-  - ~> 2.3.12
-  - ~> 2.4.9
-  - ">= 3.0.3"

data/data/ruby-advisory-db/gems/spree/OSVDB-125701.yml

@@ -1,17 +0,0 @@
----
-gem: spree
-osvdb: 125701
-url: https://spreecommerce.com/blog/security-updates-2015-7-20
-title: |
-  Spree RABL templates rendering allows Arbitrary Code Execution and File
-  Disclosure
-date: 2015-07-20
-description: |
-  Spree contains a flaw where the rendering of arbitrary RABL templates allows
-  for execution arbitrary files on the host system, as well as disclosing the
-  existence of files on the system.
-patched_versions:
-  - ~> 2.2.12
-  - ~> 2.3.11
-  - ~> 2.4.8
-  - ">= 3.0.2"

data/data/ruby-advisory-db/gems/spree/OSVDB-125712.yml

@@ -1,16 +0,0 @@
----
-gem: spree
-osvdb: 125712
-url: https://spreecommerce.com/blog/security-issue-all-versions
-title: |
-  Product Scopes could allow for unauthenticated remote command execution
-date: 2012-07-02
-description: |
-  Product Scopes could allow for unauthenticated remote command execution.
-  This was corrected by removing conditions_any scope and use ARel query
-  building instead.
-patched_versions:
-  - ~> 0.11.4
-  - ~> 0.70.6
-  - ~> 1.0.5
-  - ">= 1.1.2"

data/data/ruby-advisory-db/gems/spree/OSVDB-125713.yml

@@ -1,15 +0,0 @@
----
-gem: spree
-osvdb: 125713
-url: https://spreecommerce.com/blog/security-issue-all-versions
-title: |
-  Potential XSS vulnerability related to the analytics dashboard
-date: 2012-07-02
-description: |
-  Spree has a flaw in its analytics dashboard where keywords are not escaped,
-  leading to potential XSS.
-patched_versions:
-  - ~> 0.11.4
-  - ~> 0.70.6
-  - ~> 1.0.5
-  - ">= 1.1.2"

data/data/ruby-advisory-db/gems/spree/OSVDB-69098.yml

@@ -1,19 +0,0 @@
----
-gem: spree
-cve: 2010-3978
-osvdb: 69098
-url: https://spreecommerce.com/blog/json-hijacking-vulnerability
-title: |
-  Spree Multiple Script JSON Request Validation Weakness Remote Information
-  Disclosure
-date: 2010-11-02
-description: |
-  Spree contains a flaw that may lead to an unauthorized information
-  disclosure. The issue is triggered when the application exchanges data using
-  the JSON service without validating requests, which will disclose sensitive
-  user and order information to a context-dependent attacker when a logged-in
-  user visits a crafted website.
-cvss_v2: 5.0
-patched_versions:
-  - ~> 0.11.2
-  - ">= 0.30.0"

data/data/ruby-advisory-db/gems/spree/OSVDB-73751.yml

@@ -1,11 +0,0 @@
----
-gem: spree
-osvdb: 73751
-url: https://spreecommerce.com/blog/security-fixes
-title: Spree Content Controller Unspecified Arbitrary File Disclosure
-date: 2011-04-19
-description: |
-  Spree Gem for Ruby would allow a user to request a specially crafted URL and
-  expose arbitrary files on the server
-patched_versions:
-  - ">= 0.50.1"

data/data/ruby-advisory-db/gems/spree/OSVDB-76011.yml

@@ -1,15 +0,0 @@
----
-gem: spree
-osvdb: 76011
-url: https://spreecommerce.com/blog/remote-command-product-group
-title: |
-  Spree Search ProductScope Class search[send][] Parameter Arbitrary Command
-  Execution
-date: 2011-10-05
-description: |
-  The ProductScope class fails to properly sanitize user-supplied input via the
-  'search[send][]' parameter resulting in arbitrary command execution. With a
-  specially crafted request, a remote attacker can potentially cause arbitrary
-  command execution.
-patched_versions:
-  - ">= 0.60.2"

data/data/ruby-advisory-db/gems/spree/OSVDB-81505.yml

@@ -1,14 +0,0 @@
----
-gem: spree
-cve: 2008-7310
-osvdb: 81505
-url: https://spreecommerce.com/blog/security-vulnerability-mass-assignment
-title: |
-  Spree Hash Restriction Weakness URL Parsing Order State Value Manipulation
-date: 2008-09-22
-description: |
-  Spree contains a hash restriction weakness that occurs when parsing a
-  modified URL. This may allow an attacker to manipulate order state values.
-cvss_v2: 5.0
-patched_versions:
-  - ">= 0.3.0"

data/data/ruby-advisory-db/gems/spree/OSVDB-81506.yml

@@ -1,16 +0,0 @@
----
-gem: spree
-cve: 2008-7311
-osvdb: 81506
-url: https://spreecommerce.com/blog/security-vulernability-session-cookie-store
-title: |
-  Spree Hardcoded config.action_controller_session Hash Value Cryptographic
-  Protection Weakness
-date: 2008-08-12
-description: |
-  Spree contains a hardcoded flaw related to the
-  config.action_controller_session hash value. This may allow an attacker to
-  more easily bypass cryptographic protection.
-cvss_v2: 5.0
-patched_versions:
-  - ">= 0.3.0"

data/data/ruby-advisory-db/gems/spree/OSVDB-90865.yml

@@ -1,20 +0,0 @@
----
-gem: spree
-cve: 2013-2506
-osvdb: 90865
-url: https://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed
-title: |
-  Spree app/models/spree/user.rb Mass Role Assignment Remote Privilege
-  Escalation
-date: 2013-02-21
-description: |
-  Spree contains a flaw that leads to unauthorized privileges being gained. The
-  issue is triggered as certain input related to mass role assignment in
-  app/models/spree/user.rb is not properly verified before being used to update
-  a user. This may allow a remote attacker to assign arbitrary roles and gain
-  elevated administrative privileges.
-cvss_v2: 4.0
-patched_versions:
-  - ~> 1.1.6
-  - ~> 1.2.0
-  - ">= 1.3.0"

data/data/ruby-advisory-db/gems/spree/OSVDB-91216.yml

@@ -1,17 +0,0 @@
----
-gem: spree
-cve: 2013-1656
-osvdb: 91216
-url: https://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed
-title: |
-  Spree promotion_actions_controller.rb promotion_action Parameter Arbitrary
-  Ruby Object Instantiation Command Execution
-date: 2013-02-21
-description: |
-  Spree contains a flaw that is triggered when handling input passed via the
-  'promotion_action' parameter to promotion_actions_controller.rb. This may
-  allow a remote authenticated attacker to instantiate arbitrary Ruby objects
-  and potentially execute arbitrary commands.
-cvss_v2: 4.3
-patched_versions:
-  - ">= 2.0.0"

data/data/ruby-advisory-db/gems/spree/OSVDB-91217.yml

@@ -1,17 +0,0 @@
----
-gem: spree
-cve: 2013-1656
-osvdb: 91217
-url: https://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed
-title: |
-  Spree payment_methods_controller.rb payment_method Parameter Arbitrary Ruby
-  Object Instantiation Command Execution
-date: 2013-02-21
-description: |
-  Spree contains a flaw that is triggered when handling input passed via the
-  'payment_method' parameter to payment_methods_controller.rb. This may allow
-  a remote authenticated attacker to instantiate arbitrary Ruby objects and
-  potentially execute arbitrary commands.
-cvss_v2: 4.3
-patched_versions:
-  - ">= 2.0.0"

data/data/ruby-advisory-db/gems/spree/OSVDB-91218.yml

@@ -1,17 +0,0 @@
----
-gem: spree
-cve: 2013-1656
-osvdb: 91218
-url: https://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed
-title: |
-  Spree promotions_controller.rb calculator_type Parameter Arbitrary Ruby
-  Object Instantiation Command Execution
-date: 2013-02-21
-description: |
-  Spree contains a flaw that is triggered when handling input passed via the
-  'calculator_type' parameter to promotions_controller.rb. This may allow a
-  remote authenticated attacker to instantiate arbitrary Ruby objects and
-  potentially execute arbitrary commands.
-cvss_v2: 4.3
-patched_versions:
-  - ">= 2.0.0"

data/data/ruby-advisory-db/gems/spree/OSVDB-91219.yml

@@ -1,17 +0,0 @@
----
-gem: spree
-cve: 2013-1656
-osvdb: 91219
-url: https://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed
-title: |
-  Spree promotion_rules_controller.rb promotion_rule Parameter Arbitrary Ruby
-  Object Instantiation Command Execution
-date: 2013-02-21
-description: |
-  Spree contains a flaw that is triggered when handling input passed via the
-  'promotion_rule' parameter to promotion_rules_controller.rb. This may allow
-  a remote authenticated attacker to instantiate arbitrary Ruby objects and
-  potentially execute arbitrary commands.
-cvss_v2: 4.3
-patched_versions:
-  - ">= 2.0.0"

data/data/ruby-advisory-db/gems/spree_auth/OSVDB-90865.yml

@@ -1,16 +0,0 @@
----
-gem: spree_auth
-cve: 2013-2506
-osvdb: 90865
-url: https://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed
-title: |
-  Spree app/models/spree/user.rb Mass Role Assignment Remote Privilege
-  Escalation
-date: 2013-02-21
-description: |
-  Spree contains a flaw that leads to unauthorized privileges being gained. The
-  issue is triggered as certain input related to mass role assignment in
-  app/models/spree/user.rb is not properly verified before being used to update
-  a user. This may allow a remote attacker to assign arbitrary roles and gain
-  elevated administrative privileges.
-cvss_v2: 4.0