bundler-audit 0.7.0.1 → 0.9.0.1

data/data/ruby-advisory-db/gems/airbrake-ruby/CVE-2019-16060.yml

@@ -1,18 +0,0 @@
----
-gem: airbrake-ruby
-cve: 2019-16060
-date: 2019-04-10
-url: https://github.com/airbrake/airbrake-ruby/issues/468
-title: Blacklist keys are no longer being filtered in airbrake-ruby
-description: |
-  A flaw in airbrake-ruby v4.2.3 prevented user data from being filtered
-  prior to sending to Airbrake. Such data could be user passwords. Therefore, an app
-  could leak user passwords without knowing it.
-unaffected_versions:
-  - "< 4.2.3"
-  - "> 4.2.3"
-patched_versions:
-  - ">= 4.2.4"
-related:
-  url:
-    - https://github.com/airbrake/airbrake-ruby/pull/469

data/data/ruby-advisory-db/gems/archive-tar-minitar/CVE-2016-10173.yml

@@ -1,16 +0,0 @@
----
-gem: archive-tar-minitar
-cve: 2016-10173
-url: https://github.com/atoulme/minitar/issues/5
-title: Archive-Tar-Minitar Directory Traversal Vulnerability
-date: 2016-08-22
-description: |
-  Minitar allows attackers to overwrite arbitrary files during archive
-  extraction via a .. (dot dot) in an extracted filename. Analogous
-  vulnerabilities for unzip and tar:
-  https://www.cvedetails.com/cve/CVE-2001-1268/ and
-  http://www.cvedetails.com/cve/CVE-2001-1267/
-
-  Credit: ecneladis
-patched_versions:
-  - ">= 0.6.0"

data/data/ruby-advisory-db/gems/as/OSVDB-112683.yml

@@ -1,10 +0,0 @@
----
-gem: as
-osvdb: 112683
-url: http://osvdb.org/show/osvdb/112683
-title: as Gem for Ruby Process List Local Plaintext Credentials Disclosure
-date: 2014-09-25
-description: |
-  as Gem for Ruby contains a flaw that is due to the program displaying
-  credential information in plaintext in the process list. This may
-  allow a local attacker to gain access to credential information.

data/data/ruby-advisory-db/gems/authlogic/CVE-2012-6497.yml

@@ -1,15 +0,0 @@
----
-gem: authlogic
-cve: 2012-6497
-osvdb: 89064
-url: https://nvd.nist.gov/vuln/detail/CVE-2012-6497
-title: Ruby on Rails Authlogic Gem secret_token.rb Known secret_token Value Weakness
-date: 2012-12-21
-description: |
-  Ruby on Rails contains a flaw in the Authlogic gem. The issue is triggered
-  when the program makes an unsafe method call for find_by_id. With a specially
-  crafted parameter in an environment that knows the secret_token value in
-  secret_token.rb, a remote attacker to more easily conduct SQL injection
-  attacks.
-patched_versions:
-  - ">= 3.3.0"

data/data/ruby-advisory-db/gems/auto_awesomplete/OSVDB-132800.yml

@@ -1,11 +0,0 @@
----
-gem: auto_awesomplete
-osvdb: 132800
-url: https://github.com/Tab10id/auto_awesomplete/issues/2
-title: |
-  auto_awesomplete Gem for Ruby allows arbitrary search execution
-date: 2016-01-08
-description: |
-  auto_awesomplete Gem for Ruby contains a flaw that is triggered when handling the
-  'params[:default_class_name]' option. This allows users to search any object
-  of all given ActiveRecord classes.

data/data/ruby-advisory-db/gems/auto_select2/OSVDB-132800.yml

@@ -1,13 +0,0 @@
----
-gem: auto_select2
-osvdb: 132800
-url: https://github.com/Loriowar/auto_select2/issues/4
-title: |
-  auto_select2 Gem for Ruby allows arbitrary search execution
-date: 2016-01-08
-description: |
-  auto_select2 Gem for Ruby contains a flaw that is triggered when handling the
-  'params[:default_class_name]' option. This allows users to search any object
-  of all given ActiveRecord classes.
-patched_versions:
-  - ">= 0.5.0"

data/data/ruby-advisory-db/gems/awesome-bot/CVE-2019-15224.yml

@@ -1,19 +0,0 @@
----
-gem: awesome-bot
-cve: 2019-15224
-ghsa: 333g-rpr4-7hxq
-url: https://github.com/rubygems/rubygems.org/issues/2097
-date: 2019-08-20
-title: Code execution backdoor in awesome-bot
-description: |
-  The awesome-bot gem 1.18.0 for Ruby, as distributed on RubyGems.org, included a code-execution
-  backdoor inserted by a third party.
-
-  Users of an affected version should consider downgrading to the last non-affected version of
-  1.17.2 or upgrading to 1.19.x.
-unaffected_versions:
-  - "< 1.18.0"
-  - "> 1.18.0"
-related:
-  url:
-    - https://github.com/rubygems/rubygems.org/wiki/Gems-yanked-and-accounts-locked#19-aug-2019

data/data/ruby-advisory-db/gems/awesome_spawn/CVE-2014-0156.yml

@@ -1,19 +0,0 @@
----
-gem: awesome_spawn
-cve: 2014-0156
-url: https://github.com/ManageIQ/awesome_spawn/commit/e524f85f1c6e292ef7d117d7818521307ac269ff
-title: OS command injection flaw in awesome_spawn
-date: 2014-03-28
-
-description: >-
-  Awesome spawn contains OS command injection vulnerability, which allows
-  execution of additional commands passed to Awesome spawn as arguments, e.g.
-  AwesomeSpawn.run('ls',:params => {'-l' => ";touch haxored"}). If untrusted
-  input was included in command arguments, attacker could use this flaw to
-  execute arbitrary command.
-  
-cvss_v2:  6.8
-
-patched_versions:
-  - "~> 1.2.0"
-  - ">= 1.3.0"

data/data/ruby-advisory-db/gems/backup-agoddard/CVE-2014-4993.yml

@@ -1,8 +0,0 @@
----
-gem: backup-agoddard
-cve: 2014-4993
-osvdb: 108578
-url: https://nvd.nist.gov/vuln/detail/CVE-2014-4993
-title: backup-agoddard Gem for Ruby /lib/backup/cli/utility.rb Process Table Local Plaintext Password Disclosure
-date: 2014-06-30
-description: backup-agoddard Gem for Ruby contains a flaw in /lib/backup/cli/utility.rb that is due to the application exposing password information in plaintext in the process table. This may allow a local attacker to gain access to password information.

data/data/ruby-advisory-db/gems/backup_checksum/CVE-2014-4993.yml

@@ -1,12 +0,0 @@
----
-gem: backup_checksum
-cve: 2014-4993
-osvdb: 108569
-url: https://nvd.nist.gov/vuln/detail/CVE-2014-4993
-title: backup_checksum Gem for Ruby /lib/backup/cli/utility.rb Process List Local Plaintext Password Disclosure
-date: 2014-06-30
-description: |
-  backup_checksum Gem for Ruby contains a flaw in /lib/backup/cli/utility.rb
-  that is triggered as the program displays password information in plaintext
-  in the process list. This may allow a local attacker to gain access to
-  password information.

data/data/ruby-advisory-db/gems/backup_checksum/OSVDB-108570.yml

@@ -1,10 +0,0 @@
----
-gem: backup_checksum
-osvdb: 108570
-url: http://osvdb.org/show/osvdb/108570
-title: backup_checksum Gem for Ruby /lib/backup/cli/utility.rb Metacharacter Handling Remote Command Execution
-date: 2014-06-30
-description: |
-  backup_checksum Gem for Ruby contains a flaw in /lib/backup/cli/utility.rb
-  that is triggered when handling metacharacters. This may allow a remote
-  attacker to execute arbitrary commands.

data/data/ruby-advisory-db/gems/bcrypt/OSVDB-62067.yml

@@ -1,17 +0,0 @@
----
-gem: bcrypt
-platform: jruby
-osvdb: 62067
-url: http://www.mindrot.org/files/jBCrypt/internat.adv
-title: bcrypt-ruby Gem for Ruby incorrect encoding of non US-ASCII characters (JRuby only)
-date: 2010-02-01
-description: |
-  bcrypt-ruby Gem for Ruby suffered from a bug related to character
-  encoding that substantially reduced the entropy of hashed passwords
-  containing non US-ASCII characters. An incorrect encoding step
-  transparently replaced such characters by '?' prior to hashing. In the
-  worst case of a password consisting solely of non-US-ASCII characters,
-  this would cause its hash to be equivalent to all other such passwords
-  of the same length. This issue only affects the JRuby implementation.
-patched_versions:
-  - ">= 2.1.4"

data/data/ruby-advisory-db/gems/bcrypt-ruby/OSVDB-62067.yml

@@ -1,19 +0,0 @@
----
-gem: bcrypt-ruby
-platform: jruby
-osvdb: 62067
-url: http://www.mindrot.org/files/jBCrypt/internat.adv
-title: bcrypt-ruby Gem for Ruby incorrect encoding of non US-ASCII characters (JRuby only)
-date: 2010-02-01
-description: |
-  bcrypt-ruby Gem for Ruby suffered from a bug related to character
-  encoding that substantially reduced the entropy of hashed passwords
-  containing non US-ASCII characters. An incorrect encoding step
-  transparently replaced such characters by '?' prior to hashing. In the
-  worst case of a password consisting solely of non-US-ASCII characters,
-  this would cause its hash to be equivalent to all other such passwords
-  of the same length. This issue only affects the JRuby implementation.
-
-  This gem has been renamed. Please use "bcrypt" from now on.
-patched_versions:
-  - ">= 2.1.4"

data/data/ruby-advisory-db/gems/bibtex-ruby/CVE-2019-10780.yml

@@ -1,16 +0,0 @@
----
-gem: bibtex-ruby
-cve: 2019-10780
-ghsa: c5r5-7pfh-6qg6
-url: https://github.com/advisories/GHSA-c5r5-7pfh-6qg6
-date: 2020-02-14
-title: OS command injection in BibTeX-Ruby
-description: |
-  BibTeX-ruby before 5.1.0 allows shell command injection due to unsanitized
-  user input being passed directly to the built-in Ruby Kernel.open method through
-  BibTeX.open.
-
-cvss_v3: 9.8
-
-patched_versions:
-  - ">= 5.1.0"

data/data/ruby-advisory-db/gems/bio-basespace-sdk/CVE-2013-7111.yml

@@ -1,8 +0,0 @@
----
-gem: bio-basespace-sdk
-cve: 2013-7111
-osvdb: 101031
-url: https://nvd.nist.gov/vuln/detail/CVE-2013-7111
-title: Bio Basespace SDK Gem for Ruby Command Line API Key Disclosure
-date: 2013-12-14
-description: Bio Basespace SDK Gem for Ruby contains a flaw that is due to the API client code passing the API_KEY to a curl command. This may allow a local attacker to gain access to API key information by monitoring the process table.

data/data/ruby-advisory-db/gems/bitcoin_vanity/CVE-2019-15224.yml

@@ -1,18 +0,0 @@
----
-gem: bitcoin_vanity
-cve: 2019-15224
-ghsa: 333g-rpr4-7hxq
-url: https://github.com/rubygems/rubygems.org/issues/2097
-date: 2019-08-20
-title: Code execution backdoor in bitcoin_vanity
-description: |
-  The bitcoin_vanity gem 4.3.3 for Ruby, as distributed on RubyGems.org, included a code-execution
-  backdoor inserted by a third party.
-
-  No unaffected version is known to exist, as the gem appears to have been entirely removed.
-unaffected_versions:
-  - "< 4.3.3"
-  - "> 4.3.3"
-related:
-  url:
-    - https://github.com/rubygems/rubygems.org/wiki/Gems-yanked-and-accounts-locked#19-aug-2019

data/data/ruby-advisory-db/gems/blockchain_wallet/CVE-2019-15224.yml

@@ -1,19 +0,0 @@
----
-gem: blockchain_wallet
-cve: 2019-15224
-ghsa: 333g-rpr4-7hxq
-url: https://github.com/rubygems.org/issues/2097
-date: 2019-08-20
-title: Code execution backdoor in blockchain_wallet
-description: |
-  The blockchain_wallet gem 0.0.6 through 0.0.7 for Ruby, as distributed on RubyGems.org, included
-  a code-execution backdoor inserted by a third party.
-
-  Users of an affected version should consider downgrading to the last non-affected version of
-  0.0.5.
-unaffected_versions:
-  - "< 0.0.6"
-  - "> 0.0.7"
-related:
-  url:
-    - https://github.com/rubygems/rubygems.org/wiki/Gems-yanked-and-accounts-locked#19-aug-2019

data/data/ruby-advisory-db/gems/bootstrap/CVE-2016-10735.yml

@@ -1,20 +0,0 @@
----
-gem: bootstrap
-cve: 2016-10735
-url: https://blog.getbootstrap.com/2018/07/12/bootstrap-4-1-2/
-title: XSS vulnerability via data-target in bootstrap
-date: 2016-07-27
-
-description: |
-  In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2,
-  XSS is possible in the data-target attribute.
-
-cvss_v2: 4.3
-cvss_v3: 6.1
-
-patched_versions:
-  - '>= 4.0.0-beta.2'
-
-related:
-  url:
-    - https://github.com/twbs/bootstrap/issues/20184

data/data/ruby-advisory-db/gems/bootstrap/CVE-2018-14040.yml

@@ -1,24 +0,0 @@
----
-gem: bootstrap
-cve: 2018-14040
-url: https://blog.getbootstrap.com/2018/07/12/bootstrap-4-1-2/
-title: XSS vulnerabilities via data-parent, data-target, data-container in bootstrap
-date: 2018-07-03
-
-description: |
-  In Bootstrap before 4.1.2, XSS is possible in collapse data-parent
-  attribute (CVE-2018-14040), data-target property of scrollspy
-  (CVE-2018-14041), data-container property of tooltip (CVE-2018-14042)
-
-cvss_v2: 4.3
-cvss_v3: 6.1
-
-patched_versions:
-  - '>= 4.1.2'
-
-related:
-  cve:
-    - 2018-14041
-    - 2018-14042
-  url:
-    - https://github.com/twbs/bootstrap/issues/26423

data/data/ruby-advisory-db/gems/bootstrap/CVE-2019-8331.yml

@@ -1,20 +0,0 @@
----
-gem: bootstrap
-cve: 2019-8331
-url: https://blog.getbootstrap.com/2019/02/13/bootstrap-4-3-1-and-3-4-1/
-title: XSS vulnerability in bootstrap
-date: 2019-02-15
-
-description: |
-  In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible
-  in the tooltip or popover data-template attribute.
-
-cvss_v2: 4.3
-cvss_v3: 6.1
-
-patched_versions:
-  - '>= 4.3.1'
-
-related:
-  url:
-    - https://github.com/twbs/bootstrap-rubygem/releases/tag/v4.3.1

data/data/ruby-advisory-db/gems/bootstrap-sass/CVE-2016-10735.yml

@@ -1,20 +0,0 @@
----
-gem: bootstrap-sass
-cve: 2016-10735
-url: https://blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0/
-title: XSS vulnerability via data-target in bootstrap-sass
-date: 2016-07-27
-
-description: |
-  In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2,
-  XSS is possible in the data-target attribute.
-
-cvss_v2: 4.3
-cvss_v3: 6.1
-
-patched_versions:
-  - '>= 3.4.0'
-
-related:
-  url:
-    - https://github.com/twbs/bootstrap/issues/20184

data/data/ruby-advisory-db/gems/bootstrap-sass/CVE-2019-10842.yml

@@ -1,25 +0,0 @@
----
-gem: bootstrap-sass
-cve: 2019-10842
-url: https://github.com/twbs/bootstrap-sass/issues/1195
-title: Remote code execution in bootstrap-sass
-date: 2019-04-04
-
-description: |
-  Arbitrary code execution (via backdoor code, when 
-  downloaded from rubygems.org) was discovered in 
-  bootstrap-sass 3.2.0.3.
-  
-  Users are advised to upgrade immediately to 3.2.0.4
-  
-  An unauthenticated attacker can craft the ___cfduid cookie value
-  with base64 arbitrary code to be executed via eval(), which can
-  be leveraged to execute arbitrary code on the target system. 
-  (Note that there are three underscore characters in the cookie name. 
-  This is unrelated to the __cfduid cookie that is legitimately used by 
-  Cloudflare.)
-
-unaffected_versions:
-  - "<= 3.2.0.2"
-patched_versions:
-  - ">= 3.2.0.4"

data/data/ruby-advisory-db/gems/bootstrap-sass/CVE-2019-8331.yml

@@ -1,20 +0,0 @@
----
-gem: bootstrap-sass
-cve: 2019-8331
-url: https://blog.getbootstrap.com/2019/02/13/bootstrap-4-3-1-and-3-4-1/
-title: XSS vulnerability in bootstrap-sass
-date: 2019-02-15
-
-description: |
-  In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible
-  in the tooltip or popover data-template attribute.
-
-cvss_v2: 4.3
-cvss_v3: 6.1
-
-patched_versions:
-  - '>= 3.4.1'
-
-related:
-  url:
-    - https://github.com/twbs/bootstrap-sass/releases/tag/v3.4.1

data/data/ruby-advisory-db/gems/brakeman/CVE-2019-18409.yml

@@ -1,26 +0,0 @@
----
-gem: brakeman
-cve: 2019-18409
-date: 2019-10-24
-url: https://brakemanscanner.org/blog/2019/10/14/brakeman-4-dot-7-dot-1-released
-title: brakeman world writable files allow local privilege escalation
-
-description: |
-  The ruby_parser-legacy (aka legacy) gem 1.0.0 for Ruby allows local
-  privilege escalation because of world-writable files. For example,
-  if the brakeman gem (which has a legacy dependency) 4.5.0 through 4.7.0 is used,
-  a local user can insert malicious code into the
-  ruby_parser-legacy-1.0.0/lib/ruby_parser/legacy/ruby_parser.rb file.
-
-cvss_v2: 4.6
-cvss_v3: 7.8
-
-patched_versions:
-  - ">= 4.7.1"
-
-unaffected_versions:
-  - "<= 4.4.0"
-
-related:
-  url:
-    - https://github.com/zenspider/ruby_parser-legacy/issues/1

data/data/ruby-advisory-db/gems/brbackup/CVE-2014-5004.yml

@@ -1,11 +0,0 @@
----
-gem: brbackup
-cve: 2014-5004
-osvdb: 108901
-url: https://nvd.nist.gov/vuln/detail/CVE-2014-5004
-title: brbackup Gem for Ruby Process List Local Plaintext Password Disclosure
-date: 2014-07-09
-description: |
-  brbackup Gem for Ruby contains a flaw that is due to the program exposing
-  password information in plaintext in the process list. This may allow a
-  local attacker to gain access to password information.

data/data/ruby-advisory-db/gems/brbackup/OSVDB-108899.yml

@@ -1,12 +0,0 @@
----
-gem: brbackup
-osvdb: 108899
-url: http://osvdb.org/show/osvdb/108899
-title: brbackup Gem for Ruby /lib/brbackup.rb name Parameter SQL Injection
-date: 2014-07-09
-description: |
-  brbackup Gem for Ruby contains a flaw that may allow carrying out an SQL
-  injection attack. The issue is due to the /lib/brbackup.rb script not
-  properly sanitizing user-supplied input to the 'name' parameter. This may
-  allow a remote attacker to inject or manipulate SQL queries in the back-end
-  database, allowing for the manipulation or disclosure of arbitrary data.

data/data/ruby-advisory-db/gems/brbackup/OSVDB-108900.yml

@@ -1,11 +0,0 @@
----
-gem: brbackup
-osvdb: 108900
-url: http://osvdb.org/show/osvdb/108900
-title: brbackup Gem for Ruby dbuser Variable Shell Metacharacter Injection Remote Command Execution
-date: 2014-07-09
-description: |
-  brbackup Gem for Ruby contains a flaw that is triggered as input passed
-  via the 'dbuser' variable is not properly sanitized. This may allow a
-  remote attacker to inject shell metacharacters and execute arbitrary
-  commands.

data/data/ruby-advisory-db/gems/bson/CVE-2015-4411.yml

@@ -1,21 +0,0 @@
----
-gem: bson
-cve: 2015-4411
-ghsa: qh4w-7pw3-p4rp
-url: https://github.com/advisories/GHSA-qh4w-7pw3-p4rp
-date: 2020-04-29
-title: Potential denial of service in bson rubygem
-description: |
-  The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4
-  as used in rubygem-moped allows remote attackers to cause a denial of service (worker
-  resource consumption) via a crafted string. NOTE: This issue is due to an incomplete
-  fix to CVE-2015-4410.
-
-cvss_v3: 7.5
-
-patched_versions:
-  - ">= 3.0.4"
-
-related:
-  cve:
-  - 2015-4410

data/data/ruby-advisory-db/gems/bson/CVE-2015-4412.yml

@@ -1,18 +0,0 @@
----
-gem: bson
-cve: 2015-4412
-url: http://sakurity.com/blog/2015/06/04/mongo_ruby_regexp.html
-title: Data Injection Vulnerability in bson Rubygem
-date: 2015-06-04
-
-description: >-
-  A flaw in the ObjectId validation regular expression can enable attackers to inject arbitrary information into a given BSON object.
-
-patched_versions:
-  - "~> 1.12.3"
-  - ">= 3.0.4"
-
-related:
-  url:
-    - https://github.com/mongodb/mongo-ruby-driver/compare/6ae981167759d5819ba3d41e374e5b2af5b79077~1...9859a3ab9773a8a883eb8438b665a921cc991c71
-    - https://github.com/mongodb/bson-ruby/compare/7446d7c6764dfda8dc4480ce16d5c023e74be5ca...28f34978a85b689a4480b4d343389bf4886522e7

data/data/ruby-advisory-db/gems/builder/OSVDB-95668.yml

@@ -1,13 +0,0 @@
----
-gem: builder
-osvdb: 95668
-url: http://osvdb.org/show/osvdb/95668
-title: Builder Gem for Ruby Tag Name Handling Private Method Exposure
-date: 2007-06-15
-description: |
-  Builder Gem for Ruby contains a flaw in the handling of tag names. The issue
-  is triggered when the program reads tag names from XML data and then calls a
-  method with that name. With a specially crafted file, a context-dependent
-  attacker can call private methods and manipulate data.
-patched_versions:
-  - ">= 2.1.2"

data/data/ruby-advisory-db/gems/bundler/CVE-2013-0334.yml

@@ -1,15 +0,0 @@
----
-gem: bundler
-cve: 2013-0334
-osvdb: 110004
-url: https://nvd.nist.gov/vuln/detail/CVE-2013-0334
-title: Bundler Gem for Ruby Multiple Top-level Source Lines Gemfile Handling Gem Installation Spoofing
-date: 2014-08-13
-description: |
-  Bundler Gem for Ruby contains a flaw that is triggered when handling
-  a gemfile that contains multiple top-level source lines. This may allow a
-  context-dependent attacker to install specially crafted gems on a remote
-  system, leading to arbitrary code execution.
-cvss_v2: 5.0
-patched_versions:
-  - ">= 1.7.0"

data/data/ruby-advisory-db/gems/bundler/OSVDB-115090.yml

@@ -1,13 +0,0 @@
----
-gem: bundler
-osvdb: 115090
-url: http://www.osvdb.org/show/osvdb/115090
-title: Bundler Gem for Ruby Missing SSL Certificate Validation MitM Spoofing 
-date: 2013-02-12
-description: |
-  Bundler Gem for Ruby contains a flaw as SSL certificates are not properly
-  validated. By spoofing the SSL server via a certificate that appears valid,
-  an attacker with the ability to intercept network traffic (e.g. MiTM, DNS
-  cache poisoning) can disclose and optionally manipulate transmitted data. 
-patched_versions:
-  - ">= 1.3.0.pre.8"

data/data/ruby-advisory-db/gems/bundler/OSVDB-115091.yml

@@ -1,12 +0,0 @@
----
-gem: bundler
-osvdb: 115091
-url: http://www.osvdb.org/show/osvdb/115091
-title: Bundler Gem for Ruby Redirection Remote HTTP Basic Authentication Credential Disclosure
-date: 2013-02-12
-description: |
-   Bundler Gem for Ruby contains a flaw that is triggered during the
-   redirection to other hosts. This may allow a remote attacker to gain access
-   to HTTP basic authentication credential information.
-patched_versions:
-  - ">= 1.3.0.pre.8"

data/data/ruby-advisory-db/gems/bundler/OSVDB-115917.yml

@@ -1,12 +0,0 @@
----
-gem: bundler
-osvdb: 115917
-url: http://www.osvdb.org/show/osvdb/115917
-title: Bundler Gem for Ruby install Command Process Listing Local Plaintext Credential Disclosure
-date: 2011-09-20
-description: |
-  Bundler Gem for Ruby contains a flaw that is due to the program listing
-  credential information in plaintext in the install command process listing.
-  This may allow a local attacker to gain access to credential information.
-patched_versions:
-  - ">= 1.1.rc"

data/data/ruby-advisory-db/gems/cairo/CVE-2017-7475.yml

@@ -1,15 +0,0 @@
----
-gem: cairo
-cve: 2017-7475
-ghsa: 5v3f-73gv-x7x5
-url: https://bugs.freedesktop.org/show_bug.cgi?id=100763
-date: 2017-11-15
-title: cairo NULL pointer dereference
-description: |
-  Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related
-  to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash.
-
-cvss_v3: 5.5
-
-patched_versions:
-- ">= 1.15.5"

data/data/ruby-advisory-db/gems/cap-strap/CVE-2014-4992.yml

@@ -1,8 +0,0 @@
----
-gem: cap-strap
-cve: 2014-4992
-osvdb: 108574
-url: https://nvd.nist.gov/vuln/detail/CVE-2014-4992
-title: cap-strap Gem for Ruby Process Table Local Plaintext Credential Disclosure
-date: 2014-06-30
-description: cap-strap Gem for Ruby contains a flaw that is due to the application exposing credential information in plaintext in the process table listing. This may allow a local attacker to gain access to credential information.

data/data/ruby-advisory-db/gems/cap-strap/OSVDB-108575.yml

@@ -1,7 +0,0 @@
----
-gem: cap-strap
-osvdb: 108575
-url: http://osvdb.org/show/osvdb/108575
-title: cap-strap Gem for Ruby Hardcoded Password Crypt Hash Salt Weakness
-date: 2014-06-30
-description: cap-strap Gem for Ruby contains a flaw that is due to the application using a hardcoded default 'sa' salt for password encryption. This may allow a local attacker to more easily decrypt passwords.

data/data/ruby-advisory-db/gems/capistrano-colors/CVE-2019-15224.yml

@@ -1,19 +0,0 @@
----
-gem: capistrano-colors
-cve: 2019-15224
-ghsa: 333g-rpr4-7hxq
-url: https://github.com/rubygems.org/issues/2097
-date: 2019-08-20
-title: Code execution backdoor in capistrano-colors
-description: |
-  The capistrano-colors 0.5.5 gem for Ruby, as distributed on RubyGems.org, included a
-  code-execution backdoor inserted by a third party.
-
-  Users of an affected version should consider downgrading to the last non-affected version of
-  0.5.4.
-unaffected_versions:
-  - "< 0.5.5"
-  - "> 0.5.5"
-related:
-  url:
-    - https://github.com/rubygems/rubygems.org/wiki/Gems-yanked-and-accounts-locked#19-aug-2019