bundler-audit 0.7.0.1 → 0.9.0.1

data/.gitmodules

@@ -1,3 +0,0 @@
-[submodule "data/ruby-advisory-db"]
-	path = data/ruby-advisory-db
-	url = https://github.com/rubysec/ruby-advisory-db.git

data/.travis.yml

@@ -1,14 +0,0 @@
-language: ruby
-rvm:
-  - 2.3
-  - 2.4
-  - 2.5
-  - 2.6
-  - 2.7
-  - jruby
-  - truffleruby
-
-matrix:
-  allow_failures:
-    - rvm: jruby
-    - rvm: truffleruby

data/data/ruby-advisory-db/.gitignore

@@ -1 +0,0 @@
-_site

data/data/ruby-advisory-db/.rspec

@@ -1 +0,0 @@
---colour

data/data/ruby-advisory-db/.travis.yml

@@ -1,12 +0,0 @@
-language: ruby
-
-sudo: false
-
-cache: bundler
-
-notifications:
-  irc: chat.freenode.net#rubysec
-
-env:
-  global:
-  - secure: ZXwsZdbCej15IcIazEIjy12o5v5EI8/Hle/VP1EabfbHsA5Mw+lrliMAV80C8Iy+p4mI66WIO/3Ovm64L1nGDBGs3dKUjtDvNPCKHlK2xK7AhvkcJnzbjWTAzWZY17STJO45DUdr/vuVbvQZ8llLosSOBs+grGsszCSEIOibqjU=

data/data/ruby-advisory-db/CONTRIBUTING.md

@@ -1,71 +0,0 @@
-# Contributing Guidelines
-
-* All text must be within 80 columns.
-* YAML must be indented by 2 spaces.
-* Have any questions? Feel free to open an issue.
-* Prior to submitting a pull request, run the tests:
-
-```
-bundle install
-bundle exec rspec
-```
-
-* Follow the schema. Here is an example advisory:
-
-```yaml
-    ---
-    gem: examplegem
-    cve: 2013-0156
-    date: 2013-05-01
-    url: https://github.com/rubysec/ruby-advisory-db/issues/123456
-    title: |
-      Ruby on Rails params_parser.rb Action Pack Type Casting Parameter Parsing
-      Remote Code Execution
-
-    description: |
-      Ruby on Rails contains a flaw in params_parser.rb of the Action Pack.
-      The issue is triggered when a type casting error occurs during the parsing
-      of parameters. This may allow a remote attacker to potentially execute
-      arbitrary code.
-
-    cvss_v2: 10.0
-    cvss_v3: 9.8
-
-    patched_versions:
-      - ~> 2.3.15
-      - ~> 3.0.19
-      - ~> 3.1.10
-      - ">= 3.2.11"
-    unaffected_versions:
-      - ~> 2.4.3
-
-    related:
-      cve:
-        - 2013-1234567
-        - 2013-1234568
-      url:
-        - https://github.com/rubysec/ruby-advisory-db/issues/123457
-
-```
-### Schema
-
-* `gem` \[String\] (required): Name of the affected gem.
-* `framework` \[String\] (optional): Name of the framework which the affected gem belongs to.
-* `platform` \[String\] (optional): If this vulnerability is platform-specific, name of platform this vulnerability affects (e.g. jruby)
-* `cve` \[String\] (optional): Common Vulnerabilities and Exposures (CVE) ID.
-* `osvdb` \[Integer\] (optional): Open Sourced Vulnerability Database (OSVDB) ID.
-* `ghsa` \[String\] (optional): GitHub Security Advisory (GHSA) ID.
-* `url` \[String\] (required): The URL to the full advisory.
-* `title` \[String\] (required): The title of the advisory or individual vulnerability.
-* `date` \[Date\] (required): The public disclosure date of the advisory.
-* `description` \[String\] (required): One or more paragraphs describing the vulnerability.
-* `cvss_v2` \[Float\] (optional): The [CVSSv2] score for the vulnerability.
-* `cvss_v3` \[Float\] (optional): The [CVSSv3] score for the vulnerability.
-* `unaffected_versions` \[Array\<String\>\] (optional): The version requirements for the
-  unaffected versions of the Ruby library.
-* `patched_versions` \[Array\<String\>\] (optional): The version requirements for the
-  patched versions of the Ruby library.
-* `related` \[Hash\<Array\<String\>\>\] (optional): Sometimes an advisory references many urls and cves. Supported keys: `cve` and `url`
-
-[CVSSv2]: https://www.first.org/cvss/v2/guide
-[CVSSv3]: https://www.first.org/cvss/user-guide

data/data/ruby-advisory-db/CONTRIBUTORS.md

@@ -1,41 +0,0 @@
-### Acknowledgements
-
-This database would not be possible without volunteers willing to submit pull requests. In no particular order, we'd like to thank:
-
-* [Postmodern](https://github.com/postmodern/)
-* [Max Veytsman](https://twitter.com/mveytsman)
-* [Pietro Monteiro](https://github.com/pietro)
-* [Eric Hodel](https://github.com/drbrain)
-* [Brendon Murphy](https://github.com/bemurphy)
-* [Oliver Legg](https://github.com/olly)
-* [Larry W. Cashdollar](http://vapid.dhs.org/)
-* [Michael Grosser](https://github.com/grosser)
-* [Sascha Korth](https://github.com/skorth)
-* [David Radcliffe](https://github.com/dwradcliffe)
-* [Jörg Schiller](https://github.com/joergschiller)
-* [Derek Prior](https://github.com/derekprior)
-* [Joel Chippindale](https://github.com/mocoso)
-* [Josef Šimánek](https://github.com/simi)
-* [Amiel Martin](https://github.com/amiel)
-* [Jeremy Olliver](https://github.com/jeremyolliver)
-* [Vasily Vasinov](https://github.com/vasinov)
-* [Phill MV](https://twitter.com/phillmv)
-* [Jon Kessler](https://github.com/jonkessler)
-* [James Harton](https://github.com/jamesotron)
-* [Justin Collins](https://github.com/presidentbeef)
-* [Andy Brody](https://github.com/ab)
-* [Alexey Zapparov](https://github.com/ixti)
-* [Toni Reina](https://github.com/areina)
-* [Bernard Lambeau](https://github.com/blambeau)
-* [Don Morrison](https://github.com/elskwid)
-* [John Poulin](https://github.com/forced-request)
-* [Neal Harris](https://github.com/nealharris)
-* [Justin Bull](https://github.com/f3ndot)
-* [Andrew Selder](https://github.com/aselder)
-* [Vanessa Henderson](https://github.com/VanessaHenderson)
-* [Reed Loden](https://github.com/reedloden)
-* [ecneladis](https://github.com/ecneladis)
-* [Brendan Coles](https://github.com/bcoles)
-* [Florian Wininger](https://github.com/fwininger)
-
-The rubysec.com domain was graciously donated by [Jordi Massaguer](https://github.com/jordimassaguerpla).

data/data/ruby-advisory-db/Gemfile

@@ -1,11 +0,0 @@
-source 'https://rubygems.org'
-
-gem 'faraday'
-gem 'rake'
-gem 'kwalify'
-gem 'rspec'
-
-group :development do
-  gem 'pry'
-  gem 'nokogiri'
-end

data/data/ruby-advisory-db/Gemfile.lock

@@ -1,44 +0,0 @@
-GEM
-  remote: https://rubygems.org/
-  specs:
-    coderay (1.1.2)
-    diff-lcs (1.3)
-    faraday (1.0.0)
-      multipart-post (>= 1.2, < 3)
-    kwalify (0.7.2)
-    method_source (0.9.2)
-    mini_portile2 (2.4.0)
-    multipart-post (2.1.1)
-    nokogiri (1.10.8)
-      mini_portile2 (~> 2.4.0)
-    pry (0.12.2)
-      coderay (~> 1.1.0)
-      method_source (~> 0.9.0)
-    rake (13.0.1)
-    rspec (3.9.0)
-      rspec-core (~> 3.9.0)
-      rspec-expectations (~> 3.9.0)
-      rspec-mocks (~> 3.9.0)
-    rspec-core (3.9.1)
-      rspec-support (~> 3.9.1)
-    rspec-expectations (3.9.0)
-      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.9.0)
-    rspec-mocks (3.9.1)
-      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.9.0)
-    rspec-support (3.9.2)
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  faraday
-  kwalify
-  nokogiri
-  pry
-  rake
-  rspec
-
-BUNDLED WITH
-   1.17.3

data/data/ruby-advisory-db/LICENSE.txt

@@ -1,5 +0,0 @@
-If you submit code or data to the ruby-advisory-db that is copyrighted by yourself, upon submission you hereby agree to release it into the public domain.
-
-However, not all of the ruby-advisory-db can be considered public domain. The ruby-advisory-db may contain some information copyrighted by the Open Source Vulnerability Database (http://osvdb.org). If you use ruby-advisory-db data to build a product or a service, it is your responsibility to familiarize yourself with the terms of their license: http://www.osvdb.org/osvdb_license
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/data/ruby-advisory-db/README.md

@@ -1,133 +0,0 @@
-# Ruby Advisory Database
-
-The Ruby Advisory Database is a community effort to compile all security advisories that are relevant to Ruby libraries.
-
-You can check your own Gemfile.locks against this database by using [bundler-audit](https://github.com/rubysec/bundler-audit).
-
-## Support Ruby security!
-
-Do you know about a vulnerability that isn't listed in this database? Open an issue, submit a PR, or [use this form](https://rubysec.com/advisories/new) which will email the maintainers.
-
-## Directory Structure
-
-The database is a list of directories that match the names of Ruby libraries on
-[rubygems.org]. Within each directory are one or more advisory files
-for the Ruby library. These advisory files are named using
-the advisories' [CVE] identifier number.
-
-    gems/:
-      actionpack/:
-        CVE-2014-0130.yml  CVE-2014-7818.yml  CVE-2014-7829.yml  CVE-2015-7576.yml
-        CVE-2015-7581.yml  CVE-2016-0751.yml  CVE-2016-0752.yml
-
-## Format
-
-Each advisory file contains the advisory information in [YAML] format:
-
-    ---
-    gem: examplegem
-    cve: 2013-0156
-    date: 2013-05-01
-    url: https://github.com/rubysec/ruby-advisory-db/issues/123456
-    title: |
-      Ruby on Rails params_parser.rb Action Pack Type Casting Parameter Parsing
-      Remote Code Execution
-
-    description: |
-      Ruby on Rails contains a flaw in params_parser.rb of the Action Pack.
-      The issue is triggered when a type casting error occurs during the parsing
-      of parameters. This may allow a remote attacker to potentially execute
-      arbitrary code.
-
-    cvss_v2: 10.0
-    cvss_v3: 9.8
-
-    patched_versions:
-      - ~> 2.3.15
-      - ~> 3.0.19
-      - ~> 3.1.10
-      - ">= 3.2.11"
-    unaffected_versions:
-      - ~> 2.4.3
-
-    related:
-      cve:
-        - 2013-1234567
-        - 2013-1234568
-      url:
-        - https://github.com/rubysec/ruby-advisory-db/issues/123457
-
-
-### Schema
-
-* `gem` \[String\] (required): Name of the affected gem.
-* `framework` \[String\] (optional): Name of the framework which the affected
-  gem belongs to.
-* `platform` \[String\] (optional): If this vulnerability is platform-specific, name of platform this vulnerability affects (e.g. jruby)
-* `cve` \[String\] (optional): Common Vulnerabilities and Exposures (CVE) ID.
-* `osvdb` \[Integer\] (optional): Open Sourced Vulnerability Database (OSVDB) ID.
-* `ghsa` \[String\] (optional): GitHub Security Advisory (GHSA) ID.
-* `url` \[String\] (required): The URL to the full advisory.
-* `title` \[String\] (required): The title of the advisory or individual vulnerability.
-* `date` \[Date\] (required): The public disclosure date of the advisory.
-* `description` \[String\] (required): One or more paragraphs describing the vulnerability.
-* `cvss_v2` \[Float\] (optional): The [CVSSv2] score for the vulnerability.
-* `cvss_v3` \[Float\] (optional): The [CVSSv3] score for the vulnerability.
-* `unaffected_versions` \[Array\<String\>\] (optional): The version requirements for the
-  unaffected versions of the Ruby library.
-* `patched_versions` \[Array\<String\>\] (optional): The version requirements for the
-  patched versions of the Ruby library.
-* `related` \[Hash\<Array\<String\>\>\] (optional): Sometimes an advisory references many urls and other identifiers. Supported keys: `cve`, `ghsa`, `osvdb`, and `url`
-
-### Tests
-Prior to submitting a pull request, run the tests:
-
-```
-bundle install
-bundle exec rspec
-```
-
-### GitHub Advisory Sync
-
-There is a script that will create initial yaml files for RubyGem advisories which
-are in the [GitHub Security Advisory API](https://developer.github.com/v4/object/securityadvisory/),
-but are not already in this dataset.  This script can be periodically run to ensure
-this repo has all the data that is present in the GitHub Advisory data.
-
-The GitHub Advisory API requires a token to access it.
-- It can be a completely scopeless token (recommended); it does not require any permissions at all.
-- Get yours at https://github.com/settings/tokens
-
-To run the GitHub Advisory sync, start by executing the rake task:
-```
-GH_API_TOKEN=<your GitHub API Token> bundle exec rake sync_github_advisories
-```
-
-- The rake task will write yaml files for any missing advisories.
-- Those files must be further edited.
-  - Fill in `cvss_v3` field by following the CVE link and getting it from page
-  - Fill in `patched_versions` field, using the comments at the bottom of the file
-  - Fill in `unaffected_versions`, optional, if there are unaffected_versions
-  - delete the GitHub data at the bottom of the yaml file
-  - double check all the data, commit it, and make a PR
-    - *The GitHub Advisory data is structured opposite of RubySec unfortunately:
-       GitHub identifies version range which are vulnerable; RubySec identifies
-      version ranges which are not vulnerable.  This is why some manual
-      work to translate is needed.*
-
-
-## Credits
-
-Please see [CONTRIBUTORS.md].
-
-This database also includes data from the [Open Sourced Vulnerability Database][OSVDB]
-developed by the Open Security Foundation (OSF) and its contributors.
-
-[rubygems.org]: https://rubygems.org/
-[CVE]: https://cve.mitre.org/
-[OSVDB]: http://www.osvdb.org/
-[GHSA]: https://help.github.com/en/articles/about-maintainer-security-advisories
-[CVSSv2]: https://www.first.org/cvss/v2/guide
-[CVSSv3]: https://www.first.org/cvss/user-guide
-[YAML]: http://www.yaml.org/
-[CONTRIBUTORS.md]: https://github.com/rubysec/ruby-advisory-db/blob/master/CONTRIBUTORS.md

data/data/ruby-advisory-db/Rakefile

@@ -1,22 +0,0 @@
-require 'yaml'
-
-namespace :lint do
-  begin
-    require 'rspec/core/rake_task'
-
-    RSpec::Core::RakeTask.new(:yaml)
-  rescue LoadError => e
-    task :spec do
-      abort "Please run `gem install rspec` to install RSpec."
-    end
-  end
-end
-
-desc "Sync GitHub RubyGem Advisories into this project"
-task :sync_github_advisories do
-  require_relative "lib/github_advisory_sync"
-  GitHub::GitHubAdvisorySync.sync
-end
-
-task :lint    => ['lint:yaml']
-task :default => :lint

data/data/ruby-advisory-db/gems/Arabic-Prawn/CVE-2014-2322.yml

@@ -1,12 +0,0 @@
----
-gem: Arabic-Prawn
-cve: 2014-2322
-osvdb: 104365
-url: https://nvd.nist.gov/vuln/detail/CVE-2014-2322
-title: Arabic Prawn Gem for Ruby lib/string_utf_support.rb User Input Handling Remote Command Injection
-date: 2014-03-10
-description: |
-  Arabic Prawn Gem for Ruby contains a flaw in the lib/string_utf_support.rb
-  file. The issue is due to the program failing to sanitize user input. This may
-  allow a remote attacker to inject arbitrary commands.
-cvss_v2: 7.5

data/data/ruby-advisory-db/gems/RedCloth/CVE-2012-6684.yml

@@ -1,21 +0,0 @@
----
-gem: RedCloth
-cve: 2012-6684
-osvdb: 115941
-url: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-6684
-title: RedCloth Gem for Ruby Textile Link Parsing XSS
-date: 2012-02-29
-description: |
-  RedCloth Gem for Ruby contains a flaw that allows a cross-site scripting (XSS)
-  attack. This flaw exists because the program does not validate input when
-  parsing textile links before returning it to users. This may allow a remote
-  attacker to create a specially crafted request that would execute arbitrary
-  script code in a user's browser session within the trust relationship between
-  their browser and the server.
-cvss_v2: 4.3
-patched_versions:
-  - ">= 4.3.0"
-related:
-  url:
-    - https://github.com/jgarber/redcloth/commit/2f6dab4d6aea5cee778d2f37a135637fe3f1573c
-    - http://co3k.org/blog/redcloth-unfixed-xss-en

data/data/ruby-advisory-db/gems/VladTheEnterprising/CVE-2014-4995.yml

@@ -1,13 +0,0 @@
----
-gem: VladTheEnterprising
-cve: 2014-4995
-osvdb: 108728
-url: https://nvd.nist.gov/vuln/detail/CVE-2014-4995
-title: VladTheEnterprising Gem for Ruby /tmp/my.cnf.#{target_host} Symlink Multiple Impact
-date: 2014-06-30
-description: |
-  VladTheEnterprising Gem for Ruby contains a flaw as the program creates
-  temporary files insecurely. It is possible for a local attacker to use
-  a symlink attack against the /tmp/my.cnf.#{target_host} file they can
-  overwrite arbitrary files, gain access to the MySQL root password,
-  or inject arbitrary commands.

data/data/ruby-advisory-db/gems/VladTheEnterprising/CVE-2014-4996.yml

@@ -1,13 +0,0 @@
----
-gem: VladTheEnterprising
-cve: 2014-4996
-osvdb: 108728
-url: https://nvd.nist.gov/vuln/detail/CVE-2014-4996
-title: VladTheEnterprising Gem for Ruby /tmp/my.cnf.#{target_host} Symlink Multiple Impact 
-date: 2014-06-30
-description: |
-  VladTheEnterprising Gem for Ruby contains a flaw as the program creates
-  temporary files insecurely. It is possible for a local attacker to use
-  a symlink attack against the /tmp/my.cnf.#{target_host} file they can
-  overwrite arbitrary files, gain access to the MySQL root password,
-  or inject arbitrary commands.

data/data/ruby-advisory-db/gems/actionmailer/CVE-2013-4389.yml

@@ -1,17 +0,0 @@
----
-gem: actionmailer
-cve: 2013-4389
-osvdb: 98629
-url: https://nvd.nist.gov/vuln/detail/CVE-2013-4389
-title: Action Mailer Gem for Ruby contains a possible DoS Vulnerability
-date: 2013-10-16
-description: Action Mailer Gem for Ruby contains a format string flaw in
-  the Log Subscriber component. The issue is triggered as format string
-  specifiers (e.g. %s and %x) are not properly sanitized in user-supplied
-  input when handling email addresses. This may allow a remote attacker
-  to cause a denial of service
-cvss_v2: 4.3
-unaffected_versions:
-  - ~> 2.3.2
-patched_versions: 
-  - '>= 3.2.15'

data/data/ruby-advisory-db/gems/actionpack/CVE-2012-1099.yml

@@ -1,26 +0,0 @@
---- 
-gem: actionpack
-framework: rails
-cve: 2012-1099
-osvdb: 79727
-url: https://nvd.nist.gov/vuln/detail/CVE-2012-1099
-title:
-  Ruby on Rails actionpack/lib/action_view/helpers/form_options_helper.rb
-  Manually Generated Select Tag Options XSS
-date: 2012-03-01
-
-description: |
-  Ruby on Rails contains a flaw that allows a remote cross-site scripting (XSS) 
-  attack. This flaw exists because the application does not validate manually
-  generated 'select tag options' upon submission to
-  actionpack/lib/action_view/helpers/form_options_helper.rb. This may allow a
-  user to create a specially crafted request that would execute arbitrary
-  script code in a user's browser within the trust relationship between their
-  browser and the server.
-
-cvss_v2: 4.3
-
-patched_versions: 
-  - ~> 3.0.12
-  - ~> 3.1.4
-  - ">= 3.2.2"

data/data/ruby-advisory-db/gems/actionpack/CVE-2012-3424.yml

@@ -1,28 +0,0 @@
----
-gem: actionpack
-framework: rails
-cve: 2012-3424
-osvdb: 84243
-url: https://nvd.nist.gov/vuln/detail/CVE-2012-3424
-title:
-  Ruby on Rails actionpack/lib/action_controller/metal/http_authentication.rb
-  with_http_digest Helper Method Remote DoS
-date: 2012-07-26
-
-description: |
-  Ruby on Rails contains a flaw that may allow a remote denial of service.
-  The issue is triggered when an error occurs in
-  actionpack/lib/action_controller/metal/http_authentication.rb when the
-  with_http_digest helper method is being used. This may allow a remote
-  attacker to cause a loss of availability for the program.
-
-cvss_v2: 5.0
-
-unaffected_versions:
-  - ">= 2.3.5, <= 2.3.14"
-
-patched_versions:
-  - ~> 3.0.16
-  - ~> 3.1.7
-  - ">= 3.2.7"
-

data/data/ruby-advisory-db/gems/actionpack/CVE-2012-3463.yml

@@ -1,26 +0,0 @@
---- 
-gem: actionpack
-framework: rails
-cve: 2012-3463
-osvdb: 84515
-url: https://nvd.nist.gov/vuln/detail/CVE-2012-3463
-title: Ruby on Rails select_tag Helper Method prompt Value XSS
-date: 2012-08-09
-
-description: |
-  Ruby on Rails contains a flaw that allows a remote cross-site scripting (XSS)
-  attack. This flaw exists because input passed via the prompt value is not
-  properly sanitized by the select_tag helper method before returning it to
-  the user. This may allow a user to create a specially crafted request that
-  would execute arbitrary script code in a user's browser within the trust
-  relationship between their browser and the server.
-
-cvss_v2: 4.3
-
-unaffected_versions:
-  - ~> 2.3.0
-
-patched_versions: 
-  - ~> 3.0.17
-  - ~> 3.1.8
-  - ">= 3.2.8"

data/data/ruby-advisory-db/gems/actionpack/CVE-2012-3465.yml

@@ -1,23 +0,0 @@
---- 
-gem: actionpack
-framework: rails
-cve: 2012-3465
-osvdb: 84513
-url: https://nvd.nist.gov/vuln/detail/CVE-2012-3465
-title: Ruby on Rails strip_tags Helper Method XSS
-date: 2012-08-09
-
-description: |
-  Ruby on Rails contains a flaw that allows a remote cross-site scripting (XSS)
-  attack. This flaw exists because the application does not validate input
-  passed via the 'strip_tags' helper method before returning it to the user.
-  This may allow a user to create a specially crafted request that would
-  execute arbitrary script code in a user's browser within the trust
-  relationship between their browser and the server.
-
-cvss_v2: 4.3
-
-patched_versions: 
-  - ~> 3.0.17
-  - ~> 3.1.8
-  - ">= 3.2.8"

data/data/ruby-advisory-db/gems/actionpack/CVE-2013-0156.yml

@@ -1,24 +0,0 @@
---- 
-gem: actionpack
-framework: rails
-cve: 2013-0156
-osvdb: 89026
-url: https://nvd.nist.gov/vuln/detail/CVE-2013-0156
-title:
-  Ruby on Rails params_parser.rb Action Pack Type Casting Parameter Parsing
-  Remote Code Execution 
-date: 2013-01-08
-
-description: |
-  Ruby on Rails contains a flaw in params_parser.rb of the Action Pack.
-  The issue is triggered when a type casting error occurs during the parsing
-  of parameters. This may allow a remote attacker to potentially execute
-  arbitrary code.
-
-cvss_v2: 10.0
-
-patched_versions: 
-  - ~> 2.3.15
-  - ~> 3.0.19
-  - ~> 3.1.10
-  - ">= 3.2.11"

data/data/ruby-advisory-db/gems/actionpack/CVE-2013-1855.yml

@@ -1,20 +0,0 @@
----
-gem: actionpack
-framework: rails
-cve: 2013-1855
-osvdb: 91452
-url: https://nvd.nist.gov/vuln/detail/CVE-2013-1855
-title: XSS vulnerability in sanitize_css in Action Pack
-date: 2013-03-19
-
-description: |
-  There is an XSS vulnerability in the `sanitize_css` method in Action
-  Pack. Carefully crafted text can bypass the sanitization provided in
-  the `sanitize_css` method in Action Pack
-
-cvss_v2: 4.3
-
-patched_versions:
-  - ~> 2.3.18
-  - ~> 3.1.12
-  - ">= 3.2.13"

data/data/ruby-advisory-db/gems/actionpack/CVE-2013-1857.yml

@@ -1,23 +0,0 @@
----
-gem: actionpack
-framework: rails
-cve: 2013-1857
-osvdb: 91454
-url: https://nvd.nist.gov/vuln/detail/CVE-2013-1857
-title: XSS Vulnerability in the `sanitize` helper of Ruby on Rails
-date: 2013-03-19
-
-description: |
-  The sanitize helper in Ruby on Rails is designed to
-  filter HTML and remove all tags and attributes which could be
-  malicious. The code which ensured that URLs only contain supported
-  protocols contained several bugs which could allow an attacker to
-  embed a tag containing a URL which executes arbitrary javascript
-  code.
-
-cvss_v2: 4.3
-
-patched_versions:
-  - ~> 2.3.18
-  - ~> 3.1.12
-  - ">= 3.2.13"

data/data/ruby-advisory-db/gems/actionpack/CVE-2014-0081.yml

@@ -1,24 +0,0 @@
----
-gem: actionpack
-framework: rails
-cve: 2014-0081
-osvdb: 103439
-url: https://nvd.nist.gov/vuln/detail/CVE-2014-0081
-title: XSS Vulnerability in number_to_currency, number_to_percentage and number_to_human
-date: 2014-02-18
-
-description: |
-  Ruby on Rails contains a flaw that allows a cross-site scripting (XSS) attack.
-  This flaw exists because the actionpack/lib/action_view/helpers/number_helper.rb
-  script does not validate input to the 'number_to_currency', 'number_to_percentage',
-  and 'number_to_human' helpers before returning it to users. This may allow a
-  remote attacker to create a specially crafted request that would execute arbitrary
-  script code in a user's browser session within the trust relationship between
-  their browser and the server.
-
-cvss_v2: 4.3
-
-patched_versions:
-  - ~> 3.2.17
-  - ~> 4.0.3
-  - ">= 4.1.0.beta2"