bundler-audit 0.7.0.1 → 0.9.0

data/data/ruby-advisory-db/gems/doorkeeper/CVE-2020-10187.yml

@@ -1,34 +0,0 @@
----
-gem: doorkeeper
-ghsa: j7vx-8mqj-cqp9
-cve: 2020-10187
-date: 2020-05-02
-url: https://github.com/doorkeeper-gem/doorkeeper/security/advisories/GHSA-j7vx-8mqj-cqp9
-title: Doorkeeper application secret information disclosure vulnerability
-
-description: |
-  Information disclosure vulnerability. Allows an attacker to see all
-  Doorkeeper::Application model attribute values (including secrets) after
-  authorizing an application to their user.
-
-  An application is vulnerable if the authorized applications controller is
-  enabled (GET /oauth/authorized_applications.json).
-
-  Recommended additional hardening for >= 5.1 is to enable application secrets
-  hashing. This would render the exposed secret useless.
-
-unaffected_versions:
-  - "< 5.0.0"
-
-patched_versions:
-  - "~> 5.0.3"
-  - "~> 5.1.1"
-  - "~> 5.2.5"
-  - ">= 5.3.2"
-
-cvss_v2: 5.5
-cvss_v3: 5.4
-
-related:
-  url:
-    - https://github.com/doorkeeper-gem/doorkeeper/commit/25d038022c2fcad45af5b73f9d003cf38ff491f6

data/data/ruby-advisory-db/gems/doorkeeper/OSVDB-118830.yml

@@ -1,17 +0,0 @@
----
-gem: doorkeeper
-osvdb: 118830
-url: http://www.osvdb.org/show/osvdb/118830
-title: |
-  Doorkeeper Gem for Ruby stores sensitive information
-  in production logs
-date: 2015-02-10
-description: |
-  Doorkeeper Gem for Ruby contains a flaw in lib/doorkeeper/engine.rb.
-  The issue is due to the program storing sensitive information in
-  production logs. This may allow a local attacker to gain access to
-  sensitive information.
-cvss_v2:
-patched_versions:
-  - "~> 1.4.2"
-  - ">= 2.1.2"

data/data/ruby-advisory-db/gems/doorkeeper-openid_connect/CVE-2019-9837.yml

@@ -1,16 +0,0 @@
----
-gem: doorkeeper-openid_connect
-cve: 2019-9837
-date: 2019-03-25
-url: https://github.com/doorkeeper-gem/doorkeeper-openid_connect/blob/master/CHANGELOG.md#v154-2019-02-15
-title: Doorkeeper::OpenidConnect Open Redirect
-description: Doorkeeper::OpenidConnect (aka the OpenID Connect extension for Doorkeeper)
-  1.4.x and 1.5.x before 1.5.4 has an open redirect via the redirect_uri field in
-  an OAuth authorization request (that results in an error response) with the 'openid'
-  scope and a prompt=none value. This allows phishing attacks against the authorization
-  flow.
-cvss_v3: 6.1
-patched_versions:
-  - ">= 1.5.4"
-unaffected_versions:
-  - "< 1.4.0"

data/data/ruby-advisory-db/gems/dragonfly/CVE-2013-1756.yml

@@ -1,16 +0,0 @@
----
-gem: dragonfly
-cve: 2013-1756
-osvdb: 90647
-url: https://nvd.nist.gov/vuln/detail/CVE-2013-1756
-title: Dragonfly Gem for Ruby Crafted Request Parsing Remote Code Execution
-date: 2013-02-19
-description: |
-  Dragonfly Gem for Ruby contains a flaw that is triggered during the parsing
-  of a specially crafted request. This may allow a remote attacker to execute
-  arbitrary code.
-cvss_v2: 7.5
-patched_versions:
-  - ">= 0.9.13"
-unaffected_versions:
-  - "< 0.7.0"

data/data/ruby-advisory-db/gems/dragonfly/CVE-2013-5671.yml

@@ -1,14 +0,0 @@
----
-gem: dragonfly
-cve: 2013-5671
-osvdb: 96798
-url: https://nvd.nist.gov/vuln/detail/CVE-2013-5671
-title: fog-dragonfly Gem for Ruby imagemagickutils.rb Remote Command Execution
-date: 2013-09-03
-description: |
-  fog-dragonfly Gem for Ruby contains a flaw that is due to the program
-  failing to properly sanitize input passed via the imagemagickutils.rb script.
-  This may allow a remote attacker to execute arbitrary commands.
-cvss_v2: 7.5
-patched_versions:
-  - ">= 0.8.4"

data/data/ruby-advisory-db/gems/dragonfly/OSVDB-110439.yml

@@ -1,13 +0,0 @@
----
-gem: dragonfly
-osvdb: 110439
-url: http://osvdb.org/show/osvdb/110439
-title: Dragonfly Gem for Ruby Image Uploading & Processing Remote Command Execution
-date: 2014-08-25
-description: |
-  Dragonfly Gem for Ruby contains a flaw in Uploading & Processing that is due
-  to the gem failing to restrict arbitrary commands to imagemagicks convert.
-  This may allow a remote attacker to gain read/write access to the filesystem
-  and execute arbitrary commands.
-patched_versions:
-  - ">= 1.0.7"

data/data/ruby-advisory-db/gems/dragonfly/OSVDB-97854.yml

@@ -1,12 +0,0 @@
----
-gem: dragonfly
-osvdb: 97854
-url: http://osvdb.org/show/osvdb/97854
-title: Dragonfly Gem for Ruby on Windows Shell Escaping Weakness
-date: 2011-09-01
-description: |
-  Dragonfly Gem for Ruby contains a flaw that is due to the program failing to
-  properly escape a shell that contains injected characters. This may allow a
-  context-dependent attacker to potentially execute arbitrary commands.
-patched_versions:
-  - ">= 0.9.6"

data/data/ruby-advisory-db/gems/easymon/CVE-2018-1000855.yml

@@ -1,16 +0,0 @@
----
-gem: easymon
-date: 2018-11-09
-url: https://github.com/basecamp/easymon/issues/26
-cve: 2018-1000855
-title: Reflected XSS in Firefox in check endpoint
-description: |
-  When passing an invalid check name as parameter to the endpoint where
-  the easymon routes are mounted, a 406 response with a body that contains the invalid
-  check name unescaped is returned. Malicious JavaScript can be injected into that
-  invalid name and have it executed in Firefox
-patched_versions:
-  - ">= 1.4.1"
-related:
-  url:
-    - https://github.com/basecamp/easymon/pull/25

data/data/ruby-advisory-db/gems/echor/CVE-2014-1834.yml

@@ -1,12 +0,0 @@
----
-gem: echor
-cve: 2014-1834
-osvdb: 102129
-url: https://nvd.nist.gov/vuln/detail/CVE-2014-1834
-title: echor Gem for Ruby backplane.rb perform_request Function Arbitrary Command Execution
-date: 2014-01-14
-description: |
-  Echor Gem for Ruby contains a flaw in backplane.rb in the perform_request
-  function that is triggered when a semi-colon (;) is injected into a username
-  or password. This may allow a context-dependent attacker to inject arbitrary
-  commands if the gem is used in a rails application.

data/data/ruby-advisory-db/gems/echor/CVE-2014-1835.yml

@@ -1,11 +0,0 @@
----
-gem: echor
-cve: 2014-1835
-osvdb: 102130
-url: https://nvd.nist.gov/vuln/detail/CVE-2014-1835
-title: echor Gem for Ruby Process Listing Local Plaintext Credential Disclosure
-date: 2014-01-14
-description: |
-  echor Gem for Ruby contains a flaw that is due to the program exposing
-  credential information in the system process listing. This may allow a local
-  attacker to gain access to plaintext credential information.

data/data/ruby-advisory-db/gems/ember-source/CVE-2013-4170.yml

@@ -1,25 +0,0 @@
----
-gem: ember-source
-cve: 2013-4170
-url: https://groups.google.com/forum/#!topic/ember-security/dokLVwwxAdM
-title: |
-  Ember.js Potential XSS Exploit When Binding `tagName` to User-Supplied Data
-date: 2013-07-25
-description: |
-  In general, Ember.js escapes or strips any user-supplied content
-  before inserting it in strings that will be sent to innerHTML.
-  However, the `tagName` property of an `Ember.View` was inserted into
-  such a string without being sanitized. This means that if an
-  application assigns a view's `tagName` to user-supplied data, a
-  specially-crafted payload could execute arbitrary JavaScript in the
-  context of the current domain ("XSS").
-
-  This vulnerability only affects applications that assign or bind
-  user-provided content to `tagName`.
-patched_versions:
-  - ~> 1.0.0.rc1.1
-  - ~> 1.0.0.rc2.1
-  - ~> 1.0.0.rc3.1
-  - ~> 1.0.0.rc4.1
-  - ~> 1.0.0.rc5.1
-  - ">= 1.0.0.rc6.1"

data/data/ruby-advisory-db/gems/ember-source/CVE-2014-0013.yml

@@ -1,33 +0,0 @@
----
-gem: ember-source
-cve: 2014-0013
-url: https://groups.google.com/forum/#!topic/ember-security/2kpXXCxISS4
-title: |
-  Ember.js Potential XSS Exploit With User-Supplied Data When Binding
-  Primitive Values
-date: 2014-01-14
-description: |
-  In general, Ember.js escapes or strips any user-supplied content before
-  inserting it in strings that will be sent to innerHTML.  However, we have
-  identified a vulnerability that could lead to unescaped content being inserted
-  into the innerHTML string without being sanitized.
-
-  When a primitive value is used as the Handlebars context, that value is not
-  properly escaped.  An example of this would be using the `{{each}}` helper to
-  iterate over an array of user-supplied strings and using `{{this}}` inside the
-  block to display each string.
-
-  In applications that contain templates whose context is a primitive value and
-  use the `{{this}}` keyword to display that value, a specially-crafted payload
-  could execute arbitrary JavaScript in the context of the current domain
-  ("XSS").
-
-  This vulnerability affects applications that contain templates whose context is
-  set to a user-supplied primitive value (such as a string or number) and also
-  contain the `{{this}}` special Handlebars variable to display the value.
-patched_versions:
-  - ~> 1.0.1
-  - ~> 1.1.3
-  - ~> 1.2.1
-  - ~> 1.3.1
-  - ">= 1.4.0.beta.2"

data/data/ruby-advisory-db/gems/ember-source/CVE-2014-0014.yml

@@ -1,30 +0,0 @@
----
-gem: ember-source
-cve: 2014-0014
-url: https://groups.google.com/forum/#!topic/ember-security/PSE4RzTi6l4
-title: |
-  Ember.js Potential XSS Exploit With User-Supplied Data When Using {{group}}
-  Helper
-date: 2014-01-14
-description: |
-  In general, Ember.js escapes or strips any user-supplied content before
-  inserting it in strings that will be sent to innerHTML.  However, we have
-  identified a vulnerability that could lead to unescaped content being inserted
-  into the innerHTML string without being sanitized.
-
-  When using the `{{group}}` helper, user supplied content in the template was not
-  being sanitized. Though the vulnerability exists in Ember.js proper, it is only
-  exposed via the use of an experimental plugin.
-
-  In applications that use the `{{group}}` helper, a specially-crafted payload
-  could execute arbitrary JavaScript in the context of the current domain
-  ("XSS").
-
-  This vulnerability only affects applications that use the `{{group}}` helper
-  to display user-provided content.
-patched_versions:
-  - ~> 1.0.1
-  - ~> 1.1.3
-  - ~> 1.2.1
-  - ~> 1.3.1
-  - ">= 1.4.0.beta.2"

data/data/ruby-advisory-db/gems/ember-source/CVE-2014-0046.yml

@@ -1,26 +0,0 @@
----
-gem: ember-source
-cve: 2014-0046
-url: https://groups.google.com/forum/#!topic/ember-security/1h6FRgr8lXQ
-title: Ember.js XSS Vulnerability With {{link-to}} Helper in Non-block Form
-date: 2014-02-07
-description: |
-  In general, Ember.js escapes or strips any user-supplied content before
-  inserting it in strings that will be sent to innerHTML.  However, a change made
-  to the implementation of the {{link-to}} helper means that any user-supplied
-  data bound to the {{link-to}} helper's title attribute will not be escaped
-  correctly.
-
-  In applications that use the {{link-to}} helper in non-block form and bind
-  the title attribute to user-supplied content, a specially-crafted payload
-  could execute arbitrary JavaScript in the context of the current domain
-  ("XSS").
-
-  All users running an affected release and binding user-supplied data to the
-  {{link-to}} helper's title attribute should either upgrade or use one of the
-  workarounds immediately.
-patched_versions:
-  - ~> 1.2.2
-  - ">= 1.3.2"
-unaffected_versions:
-  - "< 1.2.0"

data/data/ruby-advisory-db/gems/ember-source/CVE-2015-1866.yml

@@ -1,26 +0,0 @@
----
-gem: ember-source
-cve: 2015-1866
-url: https://groups.google.com/forum/#!topic/ember-security/nbntfs2EbRU
-title: Ember.js XSS Vulnerability With {{view "select"}} Options
-date: 2015-04-14
-description: |
-  In general, Ember.js escapes or strips any user-supplied content before
-  inserting it in strings that will be sent to innerHTML.  However, a
-  change made to the implementation of the select view means that any
-  user-supplied data bound to an option's label will not be escaped
-  correctly.
-
-  In applications that use Ember's select view and pass user-supplied
-  content to the label, a specially-crafted payload could execute
-  arbitrary JavaScript in the context of the current domain ("XSS").
-
-  All users running an affected release and binding user-supplied data to
-  the select options should either upgrade or use one of the workarounds
-  immediately.
-patched_versions:
-  - ~> 1.10.1
-  - ~> 1.11.2
-  - ">= 1.12.0"
-unaffected_versions:
-  - "< 1.10.0"

data/data/ruby-advisory-db/gems/ember-source/CVE-2015-7565.yml

@@ -1,30 +0,0 @@
----
-gem: ember-source
-cve: 2015-7565
-url: https://groups.google.com/forum/#!topic/ember-security/OfyQkoSuppY
-title: Ember.js XSS Vulnerability with User-Supplied JSON
-date: 2016-01-14
-description: |
-  By default, Ember will escape any values in Handlebars templates that
-  use double curlies (`{{value}}`). Developers can specifically opt out of
-  this escaping behavior by passing an instance of `SafeString` rather
-  than a raw string, which tells Ember that it should not escape the
-  string because the developer has taken responsibility for escapement.
-
-  It is possible for an attacker to create a specially-crafted payload
-  that causes a non-sanitized string to be treated as a `SafeString`, and
-  thus bypass Ember's normal escaping behavior. This could allow an
-  attacker to execute arbitrary JavaScript in the context of the current
-  domain ("XSS").
-
-  All users running an affected release should either upgrade or use of
-  the workarounds immediately.
-patched_versions:
-  - ~> 1.11.4
-  - ~> 1.12.2
-  - ~> 1.13.12
-  - ~> 2.0.3
-  - ~> 2.1.2
-  - ">= 2.2.1"
-unaffected_versions:
-  - "< 1.8.0"

data/data/ruby-advisory-db/gems/enum_column3/OSVDB-94679.yml

@@ -1,9 +0,0 @@
---- 
-gem: enum_column3
-osvdb: 94679
-url: http://osvdb.org/show/osvdb/94679
-title: enum_column3 Gem for Ruby Symbol Creation Remote DoS 
-date: 2013-06-26
-description: The enum_column3 Gem for Ruby contains a flaw that may allow a remote denial of service. The issue is due to the program typecasting unexpected strings to symbols. This may allow a remote attacker to crash the program.
-cvss_v2: 
-patched_versions: 

data/data/ruby-advisory-db/gems/espeak-ruby/CVE-2016-10193.yml

@@ -1,15 +0,0 @@
-cve: 2016-10193
-gem: espeak-ruby
-url: https://github.com/dejan/espeak-ruby/issues/7
-title: espeak-ruby Gem for Ruby Arbitrary Command Execution
-date: 2016-04-13
-
-description: |
-  espeak-ruby passes user modifiable strings directly to a shell
-  command. An attacker can execute malicious commands by modifying
-  the strings that are passed as arguments to the speak, save, bytes
-  and bytes_wav methods in the lib/espeak/speech.rb library.
-
-patched_versions:
-  - '>= 1.0.3'
-

data/data/ruby-advisory-db/gems/excon/CVE-2019-16779.yml

@@ -1,23 +0,0 @@
----
-gem: excon
-cve: 2019-16779
-ghsa: q58g-455p-8vw9
-url: https://github.com/excon/excon/security/advisories/GHSA-q58g-455p-8vw9
-date: 2019-12-16
-title: Race condition when using persistent connections
-description: |-
-  There was a race condition around persistent connections, where a connection
-  which is interrupted (such as by a timeout) would leave data on the socket.
-  Subsequent requests would then read this data, returning content from the
-  previous response. The race condition window appears to be short, and it
-  would be difficult to purposefully exploit this.
-
-  Users can workaround the problem by disabling persistent connections, though
-  this may cause performance implications.
-
-patched_versions:
-  - ">= 0.71.0"
-
-related:
-  url:
-   - https://github.com/excon/excon/commit/ccb57d7a422f020dc74f1de4e8fb505ab46d8a29

data/data/ruby-advisory-db/gems/extlib/CVE-2013-1802.yml

@@ -1,18 +0,0 @@
----
-gem: extlib
-cve: 2013-1802
-osvdb: 90740
-url: https://nvd.nist.gov/vuln/detail/CVE-2013-1802
-title: extlib Gem for Ruby Type Casting Parameter Parsing Remote Code Execution 
-date: 2013-01-08
-
-description: |
-  extlib Gem for Ruby contains a flaw that is triggered when a type casting
-  error occurs during the parsing of parameters. This may allow a
-  context-dependent attacker to potentially execute arbitrary code.
-
-cvss_v2: 9.3
-
-patched_versions:
-  - ">= 0.9.16"
-

data/data/ruby-advisory-db/gems/fastreader/CVE-2013-2615.yml

@@ -1,13 +0,0 @@
----
-gem: fastreader
-cve: 2013-2615
-osvdb: 91232
-url: https://nvd.nist.gov/vuln/detail/CVE-2013-2615
-title: fastreader Gem for Ruby URI Handling Arbitrary Command Injection 
-date: 2013-03-13
-description: |
-  fastreader Gem for Ruby contains a flaw that is triggered during the handling
-  of specially crafted input passed via a URL that contains a ';' character.
-  This may allow a context-dependent attacker to potentially execute arbitrary
-  commands.
-cvss_v2: 9.3