bundler-audit 0.7.0.1 → 0.9.0

data/data/ruby-advisory-db/gems/bootstrap-sass/CVE-2016-10735.yml

@@ -1,20 +0,0 @@
----
-gem: bootstrap-sass
-cve: 2016-10735
-url: https://blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0/
-title: XSS vulnerability via data-target in bootstrap-sass
-date: 2016-07-27
-
-description: |
-  In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2,
-  XSS is possible in the data-target attribute.
-
-cvss_v2: 4.3
-cvss_v3: 6.1
-
-patched_versions:
-  - '>= 3.4.0'
-
-related:
-  url:
-    - https://github.com/twbs/bootstrap/issues/20184

data/data/ruby-advisory-db/gems/bootstrap-sass/CVE-2019-10842.yml

@@ -1,25 +0,0 @@
----
-gem: bootstrap-sass
-cve: 2019-10842
-url: https://github.com/twbs/bootstrap-sass/issues/1195
-title: Remote code execution in bootstrap-sass
-date: 2019-04-04
-
-description: |
-  Arbitrary code execution (via backdoor code, when 
-  downloaded from rubygems.org) was discovered in 
-  bootstrap-sass 3.2.0.3.
-  
-  Users are advised to upgrade immediately to 3.2.0.4
-  
-  An unauthenticated attacker can craft the ___cfduid cookie value
-  with base64 arbitrary code to be executed via eval(), which can
-  be leveraged to execute arbitrary code on the target system. 
-  (Note that there are three underscore characters in the cookie name. 
-  This is unrelated to the __cfduid cookie that is legitimately used by 
-  Cloudflare.)
-
-unaffected_versions:
-  - "<= 3.2.0.2"
-patched_versions:
-  - ">= 3.2.0.4"

data/data/ruby-advisory-db/gems/bootstrap-sass/CVE-2019-8331.yml

@@ -1,20 +0,0 @@
----
-gem: bootstrap-sass
-cve: 2019-8331
-url: https://blog.getbootstrap.com/2019/02/13/bootstrap-4-3-1-and-3-4-1/
-title: XSS vulnerability in bootstrap-sass
-date: 2019-02-15
-
-description: |
-  In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible
-  in the tooltip or popover data-template attribute.
-
-cvss_v2: 4.3
-cvss_v3: 6.1
-
-patched_versions:
-  - '>= 3.4.1'
-
-related:
-  url:
-    - https://github.com/twbs/bootstrap-sass/releases/tag/v3.4.1

data/data/ruby-advisory-db/gems/brakeman/CVE-2019-18409.yml

@@ -1,26 +0,0 @@
----
-gem: brakeman
-cve: 2019-18409
-date: 2019-10-24
-url: https://brakemanscanner.org/blog/2019/10/14/brakeman-4-dot-7-dot-1-released
-title: brakeman world writable files allow local privilege escalation
-
-description: |
-  The ruby_parser-legacy (aka legacy) gem 1.0.0 for Ruby allows local
-  privilege escalation because of world-writable files. For example,
-  if the brakeman gem (which has a legacy dependency) 4.5.0 through 4.7.0 is used,
-  a local user can insert malicious code into the
-  ruby_parser-legacy-1.0.0/lib/ruby_parser/legacy/ruby_parser.rb file.
-
-cvss_v2: 4.6
-cvss_v3: 7.8
-
-patched_versions:
-  - ">= 4.7.1"
-
-unaffected_versions:
-  - "<= 4.4.0"
-
-related:
-  url:
-    - https://github.com/zenspider/ruby_parser-legacy/issues/1

data/data/ruby-advisory-db/gems/brbackup/CVE-2014-5004.yml

@@ -1,11 +0,0 @@
----
-gem: brbackup
-cve: 2014-5004
-osvdb: 108901
-url: https://nvd.nist.gov/vuln/detail/CVE-2014-5004
-title: brbackup Gem for Ruby Process List Local Plaintext Password Disclosure
-date: 2014-07-09
-description: |
-  brbackup Gem for Ruby contains a flaw that is due to the program exposing
-  password information in plaintext in the process list. This may allow a
-  local attacker to gain access to password information.

data/data/ruby-advisory-db/gems/brbackup/OSVDB-108899.yml

@@ -1,12 +0,0 @@
----
-gem: brbackup
-osvdb: 108899
-url: http://osvdb.org/show/osvdb/108899
-title: brbackup Gem for Ruby /lib/brbackup.rb name Parameter SQL Injection
-date: 2014-07-09
-description: |
-  brbackup Gem for Ruby contains a flaw that may allow carrying out an SQL
-  injection attack. The issue is due to the /lib/brbackup.rb script not
-  properly sanitizing user-supplied input to the 'name' parameter. This may
-  allow a remote attacker to inject or manipulate SQL queries in the back-end
-  database, allowing for the manipulation or disclosure of arbitrary data.

data/data/ruby-advisory-db/gems/brbackup/OSVDB-108900.yml

@@ -1,11 +0,0 @@
----
-gem: brbackup
-osvdb: 108900
-url: http://osvdb.org/show/osvdb/108900
-title: brbackup Gem for Ruby dbuser Variable Shell Metacharacter Injection Remote Command Execution
-date: 2014-07-09
-description: |
-  brbackup Gem for Ruby contains a flaw that is triggered as input passed
-  via the 'dbuser' variable is not properly sanitized. This may allow a
-  remote attacker to inject shell metacharacters and execute arbitrary
-  commands.

data/data/ruby-advisory-db/gems/bson/CVE-2015-4411.yml

@@ -1,21 +0,0 @@
----
-gem: bson
-cve: 2015-4411
-ghsa: qh4w-7pw3-p4rp
-url: https://github.com/advisories/GHSA-qh4w-7pw3-p4rp
-date: 2020-04-29
-title: Potential denial of service in bson rubygem
-description: |
-  The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4
-  as used in rubygem-moped allows remote attackers to cause a denial of service (worker
-  resource consumption) via a crafted string. NOTE: This issue is due to an incomplete
-  fix to CVE-2015-4410.
-
-cvss_v3: 7.5
-
-patched_versions:
-  - ">= 3.0.4"
-
-related:
-  cve:
-  - 2015-4410

data/data/ruby-advisory-db/gems/bson/CVE-2015-4412.yml

@@ -1,18 +0,0 @@
----
-gem: bson
-cve: 2015-4412
-url: http://sakurity.com/blog/2015/06/04/mongo_ruby_regexp.html
-title: Data Injection Vulnerability in bson Rubygem
-date: 2015-06-04
-
-description: >-
-  A flaw in the ObjectId validation regular expression can enable attackers to inject arbitrary information into a given BSON object.
-
-patched_versions:
-  - "~> 1.12.3"
-  - ">= 3.0.4"
-
-related:
-  url:
-    - https://github.com/mongodb/mongo-ruby-driver/compare/6ae981167759d5819ba3d41e374e5b2af5b79077~1...9859a3ab9773a8a883eb8438b665a921cc991c71
-    - https://github.com/mongodb/bson-ruby/compare/7446d7c6764dfda8dc4480ce16d5c023e74be5ca...28f34978a85b689a4480b4d343389bf4886522e7

data/data/ruby-advisory-db/gems/builder/OSVDB-95668.yml

@@ -1,13 +0,0 @@
----
-gem: builder
-osvdb: 95668
-url: http://osvdb.org/show/osvdb/95668
-title: Builder Gem for Ruby Tag Name Handling Private Method Exposure
-date: 2007-06-15
-description: |
-  Builder Gem for Ruby contains a flaw in the handling of tag names. The issue
-  is triggered when the program reads tag names from XML data and then calls a
-  method with that name. With a specially crafted file, a context-dependent
-  attacker can call private methods and manipulate data.
-patched_versions:
-  - ">= 2.1.2"

data/data/ruby-advisory-db/gems/bundler/CVE-2013-0334.yml

@@ -1,15 +0,0 @@
----
-gem: bundler
-cve: 2013-0334
-osvdb: 110004
-url: https://nvd.nist.gov/vuln/detail/CVE-2013-0334
-title: Bundler Gem for Ruby Multiple Top-level Source Lines Gemfile Handling Gem Installation Spoofing
-date: 2014-08-13
-description: |
-  Bundler Gem for Ruby contains a flaw that is triggered when handling
-  a gemfile that contains multiple top-level source lines. This may allow a
-  context-dependent attacker to install specially crafted gems on a remote
-  system, leading to arbitrary code execution.
-cvss_v2: 5.0
-patched_versions:
-  - ">= 1.7.0"

data/data/ruby-advisory-db/gems/bundler/OSVDB-115090.yml

@@ -1,13 +0,0 @@
----
-gem: bundler
-osvdb: 115090
-url: http://www.osvdb.org/show/osvdb/115090
-title: Bundler Gem for Ruby Missing SSL Certificate Validation MitM Spoofing 
-date: 2013-02-12
-description: |
-  Bundler Gem for Ruby contains a flaw as SSL certificates are not properly
-  validated. By spoofing the SSL server via a certificate that appears valid,
-  an attacker with the ability to intercept network traffic (e.g. MiTM, DNS
-  cache poisoning) can disclose and optionally manipulate transmitted data. 
-patched_versions:
-  - ">= 1.3.0.pre.8"

data/data/ruby-advisory-db/gems/bundler/OSVDB-115091.yml

@@ -1,12 +0,0 @@
----
-gem: bundler
-osvdb: 115091
-url: http://www.osvdb.org/show/osvdb/115091
-title: Bundler Gem for Ruby Redirection Remote HTTP Basic Authentication Credential Disclosure
-date: 2013-02-12
-description: |
-   Bundler Gem for Ruby contains a flaw that is triggered during the
-   redirection to other hosts. This may allow a remote attacker to gain access
-   to HTTP basic authentication credential information.
-patched_versions:
-  - ">= 1.3.0.pre.8"

data/data/ruby-advisory-db/gems/bundler/OSVDB-115917.yml

@@ -1,12 +0,0 @@
----
-gem: bundler
-osvdb: 115917
-url: http://www.osvdb.org/show/osvdb/115917
-title: Bundler Gem for Ruby install Command Process Listing Local Plaintext Credential Disclosure
-date: 2011-09-20
-description: |
-  Bundler Gem for Ruby contains a flaw that is due to the program listing
-  credential information in plaintext in the install command process listing.
-  This may allow a local attacker to gain access to credential information.
-patched_versions:
-  - ">= 1.1.rc"

data/data/ruby-advisory-db/gems/cairo/CVE-2017-7475.yml

@@ -1,15 +0,0 @@
----
-gem: cairo
-cve: 2017-7475
-ghsa: 5v3f-73gv-x7x5
-url: https://bugs.freedesktop.org/show_bug.cgi?id=100763
-date: 2017-11-15
-title: cairo NULL pointer dereference
-description: |
-  Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related
-  to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash.
-
-cvss_v3: 5.5
-
-patched_versions:
-- ">= 1.15.5"

data/data/ruby-advisory-db/gems/cap-strap/CVE-2014-4992.yml

@@ -1,8 +0,0 @@
----
-gem: cap-strap
-cve: 2014-4992
-osvdb: 108574
-url: https://nvd.nist.gov/vuln/detail/CVE-2014-4992
-title: cap-strap Gem for Ruby Process Table Local Plaintext Credential Disclosure
-date: 2014-06-30
-description: cap-strap Gem for Ruby contains a flaw that is due to the application exposing credential information in plaintext in the process table listing. This may allow a local attacker to gain access to credential information.

data/data/ruby-advisory-db/gems/cap-strap/OSVDB-108575.yml

@@ -1,7 +0,0 @@
----
-gem: cap-strap
-osvdb: 108575
-url: http://osvdb.org/show/osvdb/108575
-title: cap-strap Gem for Ruby Hardcoded Password Crypt Hash Salt Weakness
-date: 2014-06-30
-description: cap-strap Gem for Ruby contains a flaw that is due to the application using a hardcoded default 'sa' salt for password encryption. This may allow a local attacker to more easily decrypt passwords.

data/data/ruby-advisory-db/gems/capistrano-colors/CVE-2019-15224.yml

@@ -1,19 +0,0 @@
----
-gem: capistrano-colors
-cve: 2019-15224
-ghsa: 333g-rpr4-7hxq
-url: https://github.com/rubygems.org/issues/2097
-date: 2019-08-20
-title: Code execution backdoor in capistrano-colors
-description: |
-  The capistrano-colors 0.5.5 gem for Ruby, as distributed on RubyGems.org, included a
-  code-execution backdoor inserted by a third party.
-
-  Users of an affected version should consider downgrading to the last non-affected version of
-  0.5.4.
-unaffected_versions:
-  - "< 0.5.5"
-  - "> 0.5.5"
-related:
-  url:
-    - https://github.com/rubygems/rubygems.org/wiki/Gems-yanked-and-accounts-locked#19-aug-2019

data/data/ruby-advisory-db/gems/chartkick/CVE-2019-12732.yml

@@ -1,21 +0,0 @@
----
-gem: chartkick
-cve: 2019-12732
-url: https://github.com/ankane/chartkick/issues/488
-title: XSS Vulnerability in Chartkick Ruby Gem
-date: 2019-06-04
-description: |
-  Chartkick is vulnerable to a cross-site scripting (XSS) attack if
-  both the following conditions are met:
-
-  Condition 1:
-    It's used with `ActiveSupport.escape_html_entities_in_json = false`
-    (this is not the default for Rails)
-    OR used with a non-Rails framework like Sinatra.
-
-  Condition 2:
-    Untrusted data or options are passed to a chart.
-
-    <%= line_chart params[:data], min: params[:min] %>
-patched_versions:
-  - ">= 3.2.0"

data/data/ruby-advisory-db/gems/chartkick/CVE-2019-18841.yml

@@ -1,13 +0,0 @@
----
-gem: chartkick
-cve: 2019-18841
-url: https://github.com/ankane/chartkick.js/issues/117
-title: Prototype Pollution in Chartkick.js 3.1.x
-date: 2019-11-09
-description: |
-  A specially crafted response in data loaded via URL
-  can cause prototype pollution in JavaScript.
-unaffected_versions:
-  - "< 3.1.0"
-patched_versions:
-  - ">= 3.3.0"

data/data/ruby-advisory-db/gems/chloride/CVE-2018-6517.yml

@@ -1,17 +0,0 @@
----
-gem: chloride
-cve: 2018-6517
-url: https://puppet.com/security/cve/CVE-2018-6517
-date: 2019-03-08
-title: Improper handling of ssh known_hosts file with Chloride
-
-description: |
-  Prior to version 0.3.0, chloride's use of net-ssh resulted in host fingerprints
-  for previously unknown hosts getting added to the user's known_hosts file without
-  confirmation. In version 0.3.0 this is updated so that the user's known_hosts file
-  is not updated by chloride.
-
-cvss_v3: 5.0
-
-patched_versions:
-  - ">= 0.3.0"

data/data/ruby-advisory-db/gems/ciborg/CVE-2014-5003.yml

@@ -1,8 +0,0 @@
----
-gem: ciborg
-cve: 2014-5003
-osvdb: 108586
-url: https://nvd.nist.gov/vuln/detail/CVE-2014-5003
-title: ciborg Gem for Ruby default.rb /tmp/perlbrew-installer Local Symlink File Overwrite
-date: 2014-06-30
-description: ciborg Gem for Ruby contains a flaw as default.rb creates temporary files insecurely. It is possible for a local attacker to use a symlink attack against the /tmp/perlbrew-installer file to cause the program to unexpectedly overwrite an arbitrary file.

data/data/ruby-advisory-db/gems/cocaine/CVE-2013-4457.yml

@@ -1,15 +0,0 @@
----
-gem: cocaine
-cve: 2013-4457
-osvdb: 98835
-url: https://nvd.nist.gov/vuln/detail/CVE-2013-4457
-title: Cocaine Gem for Ruby contains a flaw
-date: 2013-10-22
-description: Cocaine Gem for Ruby contains a flaw that is due to the method
-  of variable interpolation used by the program. With a specially crafted
-  object, a context-dependent attacker can execute arbitrary commands.
-cvss_v2: 6.8
-unaffected_versions:
-  - < 0.4.0
-patched_versions: 
-  - '>= 0.5.3'

data/data/ruby-advisory-db/gems/codders-dataset/CVE-2014-4991.yml

@@ -1,8 +0,0 @@
----
-gem: codders-dataset
-cve: 2014-4991
-osvdb: 108582
-url: https://nvd.nist.gov/vuln/detail/CVE-2014-4991
-title: codders-dataset Gem for Ruby lib/dataset/database/mysql.rb and lib/dataset/database/postgresql.rb Process Table Local Plaintext Credential Disclosure
-date: 2014-06-30
-description: (1) lib/dataset/database/mysql.rb and (2) lib/dataset/database/postgresql.rb in the codders-dataset gem 1.3.2.1 for Ruby place credentials on the mysqldump command line, which allows local users to obtain sensitive information by listing the process.

data/data/ruby-advisory-db/gems/coin_base/CVE-2019-15224.yml

@@ -1,18 +0,0 @@
----
-gem: coin_base
-cve: 2019-15224
-ghsa: 333g-rpr4-7hxq
-url: https://github.com/rubygems.org/issues/2097
-date: 2019-08-20
-title: Code execution backdoor in coin_base
-description: |
-  The coin_base gem 4.2.1 through 4.2.2 for Ruby, as distributed on RubyGems.org, included a
-  code-execution backdoor inserted by a third party.
-
-  No unaffected version is known to exist, as the gem appears to have been entirely removed.
-unaffected_versions:
-  - "< 4.2.1"
-  - "> 4.2.2"
-related:
-  url:
-    - https://github.com/rubygems/rubygems.org/wiki/Gems-yanked-and-accounts-locked#19-aug-2019

data/data/ruby-advisory-db/gems/colorscore/CVE-2015-7541.yml

@@ -1,21 +0,0 @@
----
-gem: colorscore
-cve: 2015-7541
-osvdb: 132516
-url: http://seclists.org/oss-sec/2016/q1/17
-title: colorscore Gem for Ruby lib/colorscore/histogram.rb Arbitrary Command Injection
-date: 2016-01-04
-description: |
-  The contents of the `image_path`, `colors`, and `depth` variables generated
-  from possibly user-supplied input are passed directly to the shell via
-  `convert ...`.
-
-  If a user supplies a value that includes shell metacharacters such as ';', an
-  attacker may be able to execute shell commands on the remote system as the
-  user id of the Ruby process.
-
-  To resolve this issue, the aforementioned variables (especially `image_path`)
-  must be sanitized for shell metacharacters.
-
-patched_versions: 
-  - '>= 0.0.5'