bundler-audit 0.7.0 → 0.7.0.1

data/data/ruby-advisory-db/gems/karo/OSVDB-108573.yml

@@ -0,0 +1,10 @@
+---
+gem: karo
+osvdb: 108573
+url: http://osvdb.org/show/osvdb/108573
+title: karo Gem for Ruby db.rb Metacharacter Handling Remote Command Execution
+date: 2014-06-30
+description: |
+  karo Gem for Ruby contains a flaw in db.rb that is triggered when handling
+  metacharacters. This may allow a remote attacker to execute arbitrary
+  commands.

data/data/ruby-advisory-db/gems/karteek-docsplit/CVE-2013-1933.yml

@@ -0,0 +1,9 @@
+--- 
+gem: karteek-docsplit
+cve: 2013-1933
+osvdb: 92117
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-1933
+title: Karteek Docsplit Gem for Ruby text_extractor.rb File Name Shell Metacharacter Injection Arbitrary Command Execution
+date: 2013-04-08
+description: Karteek Docsplit Gem for Ruby contains a flaw that is due to the program failing to properly sanitize input passed to text_extractor.rb. With a specially crafted file name that contains shell metacharacters, a context-dependent attacker can execute arbitrary commands
+cvss_v2: 9.3

data/data/ruby-advisory-db/gems/kcapifony/CVE-2014-5001.yml

@@ -0,0 +1,8 @@
+---
+gem: kcapifony
+cve: 2014-5001
+osvdb: 108571
+url: https://nvd.nist.gov/vuln/detail/CVE-2014-5001
+title: kcapifony Gem for Ruby /lib/ksymfony1.rb Process List Local Plaintext Password Disclosure
+date: 2014-06-30
+description: kcapifony Gem for Ruby contains a flaw in /lib/ksymfony1.rb that is triggered as the program displays password information in plaintext in the process list. This may allow a local attacker to gain access to password information.

data/data/ruby-advisory-db/gems/kcapifony/OSVDB-108572.yml

@@ -0,0 +1,7 @@
+---
+gem: kcapifony
+osvdb: 108572
+url: http://osvdb.org/show/osvdb/108572
+title: kcapifony Gem for Ruby /lib/ksymfony1.rb Metacharacter Handling Remote Command Execution
+date: 2014-06-30
+description: kcapifony Gem for Ruby contains a flaw in /lib/ksymfony1.rb that is triggered when handling metacharacters. This may allow a remote attacker to execute arbitrary commands.

data/data/ruby-advisory-db/gems/kelredd-pruview/CVE-2013-1947.yml

@@ -0,0 +1,9 @@
+--- 
+gem: kelredd-pruview
+cve: 2013-1947
+osvdb: 92228
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-1947
+title: kelredd-pruview Gem for Ruby /lib/pruview/document.rb File Name Shell Metacharacter Injection Arbitrary Command Execution
+date: 2013-04-04
+description: kelredd-pruview Gem for Ruby contains a flaw in /lib/pruview/document.rb. The issue is triggered during the handling of a specially crafted file name that contains injected shell metacharacters. This may allow a context-dependent attacker to potentially execute arbitrary commands.
+cvss_v2: 9.3

data/data/ruby-advisory-db/gems/kompanee-recipes/OSVDB-108593.yml

@@ -0,0 +1,12 @@
+---
+gem: kompanee-recipes
+osvdb: 108593
+url: http://osvdb.org/show/osvdb/108593
+title: kompanee-recipes Gem for Ruby /lib/kompanee-recipes/heroku.rb Multiple Variable Handling Remote Command Execution Weakness
+date: 2014-06-30
+description: |
+  kompanee-recipes Gem for Ruby contains a flaw in
+  /lib/kompanee-recipes/heroku.rb that is triggered when handling shell
+  metacharacters passed via the 'password', 'user', 'deploy_name', and
+  'application' variables. This may allow a remote attacker to execute
+  arbitrary commands.

data/data/ruby-advisory-db/gems/lawn-login/CVE-2014-5000.yml

@@ -0,0 +1,8 @@
+---
+gem: lawn-login
+cve: 2014-5000
+osvdb: 108576
+url: https://nvd.nist.gov/vuln/detail/CVE-2014-5000
+title: lawn-login Gem for Ruby /lib/lawn.rb Process Table Local Plaintext Password Disclosure
+date: 2014-06-30
+description: lawn-login Gem for Ruby contains a flaw in /lib/lawn.rb that is due to the application exposing password information in plaintext in the process table. This may allow a local attacker to gain access to password information.

data/data/ruby-advisory-db/gems/ldap_fluff/CVE-2012-5604.yml

@@ -0,0 +1,15 @@
+---
+gem: ldap_fluff
+cve: 2012-5604
+osvdb: 90579
+url: https://nvd.nist.gov/vuln/detail/CVE-2012-5604
+title: Red Hat Subscription Asset Manager rubygem-ldap_fluff Active Directory Authentication Bypass
+date: 2012-12-04
+description: Red Hat Subscription Asset Manager contains a flaw in the
+  rubygem-ldap_fluff component. The issue is triggered when using Microsoft
+  Active Directory server as the authentication back-end. This may result in
+  authentication no longer being enforced, allowing a remote attacker to
+  trivially bypass it.
+cvss_v2: 5.0
+patched_versions:
+  - ">= 0.1.3"

data/data/ruby-advisory-db/gems/ldoce/CVE-2013-1911.yml

@@ -0,0 +1,9 @@
+--- 
+gem: ldoce
+cve: 2013-1911
+osvdb: 91870
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-1911
+title: ldoce Gem for Ruby MP3 URL Shell Metacharacter Injection Arbitrary Command Execution
+date: 2013-04-01
+description: ldoce Gem for Ruby contains a flaw that is triggered during the handling of a specially crafted URL or filename for MP3 files that have shell metacharacters injected in to it. This may allow a context-dependent attacker to execute arbitrary commands.
+cvss_v2: 6.8

data/data/ruby-advisory-db/gems/lean-ruport/CVE-2014-4998.yml

@@ -0,0 +1,8 @@
+---
+gem: lean-ruport
+cve: 2014-4998
+osvdb: 108581
+url: https://nvd.nist.gov/vuln/detail/CVE-2014-4998
+title: lean-ruport Gem for Ruby /test/tc_database.rb Process Table Local Plaintext MySQL Password Disclosure
+date: 2014-06-30
+description: lean-ruport Gem for Ruby contains a flaw in /test/tc_database.rb that is due to the application exposing MySQL password information in plaintext in the process table. This may allow a local attacker to gain access to MySQL password information.

data/data/ruby-advisory-db/gems/lingq/OSVDB-108585.yml

@@ -0,0 +1,7 @@
+---
+gem: lingq
+osvdb: 108585
+url: http://osvdb.org/show/osvdb/108585
+title: lingq Gem for Ruby client.rb Metacharacter Handling Remote Command Execution
+date: 2014-06-30
+description: lingq Gem for Ruby contains a flaw in client.rb that is triggered when handling metacharacters. This may allow a remote attacker to execute arbitrary commands. 

data/data/ruby-advisory-db/gems/lita_coin/CVE-2019-15224.yml

@@ -0,0 +1,18 @@
+---
+gem: lita_coin
+cve: 2019-15224
+ghsa: 333g-rpr4-7hxq
+url: https://github.com/rubygems.org/issues/2097
+date: 2019-08-20
+title: Code execution backdoor in lita_coin
+description: |
+  The lita_coin gem 0.0.3 for Ruby, as distributed on RubyGems.org, included a code-execution
+  backdoor inserted by a third party.
+
+  No unaffected version is known to exist, as the gem appears to have been entirely removed.
+unaffected_versions:
+  - "< 0.0.3"
+  - "> 0.0.3"
+related:
+  url:
+    - https://github.com/rubygems/rubygems.org/wiki/Gems-yanked-and-accounts-locked#19-aug-2019

data/data/ruby-advisory-db/gems/loofah/CVE-2018-16468.yml

@@ -0,0 +1,16 @@
+---
+gem: loofah
+cve: 2018-16468
+url: https://github.com/flavorjones/loofah/issues/154
+title: Loofah XSS Vulnerability
+date: 2018-10-30
+description: |
+  In the Loofah gem, through v2.2.2, unsanitized JavaScript may occur in
+  sanitized output when a crafted SVG element is republished.
+
+cvss_v3: 6.4
+patched_versions:
+  - ">=  2.2.3"
+related:
+  url:
+    - https://hackerone.com/reports/429267

data/data/ruby-advisory-db/gems/loofah/CVE-2018-8048.yml

@@ -0,0 +1,11 @@
+---
+gem: loofah
+cve: 2018-8048
+url: https://github.com/flavorjones/loofah/issues/144
+title: Loofah XSS Vulnerability
+date: 2018-03-16
+description: |
+  Loofah allows non-whitelisted attributes to be present in sanitized
+  output when input with specially-crafted HTML fragments.
+patched_versions:
+  - ">=  2.2.1"

data/data/ruby-advisory-db/gems/loofah/CVE-2019-15587.yml

@@ -0,0 +1,13 @@
+---
+gem: loofah
+cve: 2019-15587
+url: https://github.com/flavorjones/loofah/issues/171
+title: Loofah XSS Vulnerability
+date: 2019-10-22
+description: |
+  In the Loofah gem, through v2.3.0, unsanitized JavaScript may occur in
+  sanitized output when a crafted SVG element is republished.
+
+cvss_v3: 6.4
+patched_versions:
+  - ">= 2.3.1"

data/data/ruby-advisory-db/gems/loofah/OSVDB-90945.yml

@@ -0,0 +1,21 @@
+---
+gem: loofah
+osvdb: 90945
+url: http://www.osvdb.org/show/osvdb/90945
+title: Loofah HTML and XSS injection vulnerability
+date: 2012-09-08
+
+description: |
+  Loofah Gem for Ruby contains a flaw that allows a remote cross-site
+  scripting (XSS) attack. This flaw exists because the
+  Loofah::HTML::Document\#text function passes properly sanitized
+  user-supplied input to the Loofah::XssFoliate and
+  Loofah::Helpers\#strip_tags functions which convert input back to
+  text. This may allow an attacker to create a specially crafted
+  request that would execute arbitrary script code in a user's browser
+  within the trust relationship between their browser and the server.
+
+cvss_v2: 5.0
+
+patched_versions:
+  - ">=  0.4.6"

data/data/ruby-advisory-db/gems/lynx/CVE-2014-5002.yml

@@ -0,0 +1,11 @@
+---
+gem: lynx
+cve: 2014-5002
+osvdb: 108580
+url: https://nvd.nist.gov/vuln/detail/CVE-2014-5002
+title: lynx Gem for Ruby command/basic.rb Process Table Local Plaintext Password Disclosure
+date: 2014-06-30
+description: lynx Gem for Ruby contains a flaw in command/basic.rb that is due to the application exposing password information in plaintext in the process table. This may allow a local attacker to gain access to password information.
+
+patched_versions:
+  - '>= 1.0.0'

data/data/ruby-advisory-db/gems/lynx/OSVDB-108579.yml

@@ -0,0 +1,7 @@
+---
+gem: lynx
+osvdb: 108579
+url: http://osvdb.org/show/osvdb/108579
+title: lynx Gem for Ruby lib/lynx/pipe/run.rb Remote Command Execution
+date: 2014-06-30
+description: lynx Gem for Ruby contains a flaw in lib/lynx/pipe/run.rb that may allow a remote attacker to execute arbitrary commands.

data/data/ruby-advisory-db/gems/mail/CVE-2011-0739.yml

@@ -0,0 +1,21 @@
+--- 
+gem: mail
+cve: 2011-0739
+osvdb: 70667
+url: https://nvd.nist.gov/vuln/detail/CVE-2011-0739
+title: >
+  Mail Gem for Ruby lib/mail/network/delivery_methods/sendmail.rb Email From:
+  Address Arbitrary Shell Command Injection 
+date: 2011-01-25
+
+description: |
+  Mail Gem for Ruby contains a flaw related to the failure to properly sanitise
+  input passed from an email from address in the 'deliver()' function in
+  'lib/mail/network/delivery_methods/sendmail.rb' before being used as a
+  command line argument. This may allow a remote attacker to inject arbitrary
+  shell commands.
+
+cvss_v2: 6.8
+
+patched_versions: 
+  - ">= 2.2.15"

data/data/ruby-advisory-db/gems/mail/CVE-2012-2139.yml

@@ -0,0 +1,14 @@
+--- 
+gem: mail
+cve: 2012-2139
+osvdb: 81631
+url: https://nvd.nist.gov/vuln/detail/CVE-2012-2139
+title: Mail Gem for Ruby File Delivery Method to Parameter Traversal Arbitrary File Manipulation
+date: 2012-03-14
+
+description: |
+  Mail Gem for Ruby contains a flaw that allows a remote attacker to traverse outside of a restricted path. The issue is due to the program not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../) supplied via the 'to' parameter within the delivery method. This directory traversal attack would allow the attacker to modify arbitrary files.
+
+cvss_v2: 5.0
+patched_versions: 
+- ">= 2.4.4"

data/data/ruby-advisory-db/gems/mail/CVE-2012-2140.yml

@@ -0,0 +1,16 @@
+--- 
+gem: mail
+cve: 2012-2140
+osvdb: 81632
+url: https://nvd.nist.gov/vuln/detail/CVE-2012-2140
+title: Mail Gem for Ruby Multiple Delivery Method Remote Shell Command Execution
+date: 2012-03-14
+
+description: |
+  Mail Gem for Ruby contains a flaw that occurs within the sendmail and exim
+  delivery methods, which may allow an attacker to execute arbitrary shell
+  commands..
+
+cvss_v2: 7.5
+patched_versions: 
+- ">= 2.4.4"

data/data/ruby-advisory-db/gems/mail/CVE-2015-9097.yml

@@ -0,0 +1,26 @@
+---
+gem: mail
+cve: 2015-9097
+osvdb: 131677
+url: https://hackerone.com/reports/137631
+title: SMTP command injection
+date: 2015-12-09
+description: |
+  Because Mail does not disallow CRLF in email addresses, an attacker can
+  inject SMTP commands in specially crafted email addresses passed to
+  RCPT TO and MAIL FROM.
+
+  Not affected by this vulnerability:
+    * Ruby 2.4.0+ with a fix for CVE-2015-9096.
+    * Applications that do not use SMTP delivery.
+    * Applications that validate email addresses to not include CRLF.
+
+  The injection attack is described in Terada, Takeshi. "SMTP Injection via
+  Recipient Email Addresses." 2015. The attacks described in the paper
+  (Terada, p. 4) can be applied to the library without any modification.
+patched_versions:
+- ">= 2.5.5"
+related:
+  url:
+    - http://www.mbsd.jp/Whitepaper/smtpi.pdf
+    - https://github.com/mikel/mail/pull/1097

data/data/ruby-advisory-db/gems/mapbox-rails/OSVDB-129854.yml

@@ -0,0 +1,25 @@
+---
+gem: mapbox-rails
+osvdb: 129854
+url: https://nodesecurity.io/advisories/49
+title: mapbox-rails Content Injection via TileJSON attribute
+date: 2015-10-24
+description: |
+  Mapbox.js versions 1.x prior to 1.6.5 and 2.x prior to 2.1.7 are vulnerable
+  to a cross-site-scripting attack in certain uncommon usage scenarios.
+
+  If you use L.mapbox.map or L.mapbox.tileLayer to load untrusted TileJSON
+  content from a non-Mapbox URL, it is possible for a malicious user with
+  control over the TileJSON content to inject script content into the
+  "attribution" value of the TileJSON which will be executed in the context of
+  the page using Mapbox.js.
+
+  Such usage is uncommon. The following usage scenarios are not vulnerable:
+
+  * only trusted TileJSON content is loaded
+  * TileJSON content comes only from mapbox.com URLs
+  * a Mapbox map ID is supplied, rather than a TileJSON URL
+
+patched_versions:
+  - '~> 1.6.5'
+  - '>= 2.1.7'

data/data/ruby-advisory-db/gems/mapbox-rails/OSVDB-132871.yml

@@ -0,0 +1,26 @@
+---
+gem: mapbox-rails
+osvdb: 132871
+url: https://nodesecurity.io/advisories/74
+title: mapbox-rails Content Injection via TileJSON Name
+date: 2016-01-12
+description: |
+  Mapbox.js versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 are vulnerable
+  to a cross-site-scripting attack in certain uncommon usage scenarios.
+
+  If you use L.mapbox.map and L.mapbox.shareControl it is possible for a
+  malicious user with control over the TileJSON content to inject script
+  content into the name value of the TileJSON. After clicking on the share
+  control, the malicious code will execute in the context of the page using
+  Mapbox.js.
+
+  Such usage is uncommon. L.mapbox.shareControl is not automatically added to
+  Mapbox.js maps and must be explicitly added. The following usage scenarios
+  are not vulnerable:
+
+  * the map does not use a share control (L.mapbox.sharecontrol)
+  * only trusted TileJSON content is loaded
+
+patched_versions:
+  - '~> 1.6.6'
+  - '>= 2.2.4'

data/data/ruby-advisory-db/gems/marginalia/CVE-2019-1010191.yml

@@ -0,0 +1,17 @@
+---
+gem: marginalia
+cve: 2019-1010191
+url: https://github.com/basecamp/marginalia/pull/73
+date: 2019-07-26
+title: SQL injection vulnerability via Marginalia::Comment
+description: |
+  The 'marginalia' gem is affected by a SQL Injection vulnerability. All SQL 
+  queries are affected when a user controller argument is added as a component.
+
+  This affects users that add a component that is user controller, for instance
+  a parameter or a header.
+
+  The issue is resolved in version 1.6.
+patched_versions:
+  - ">= 1.6"
+cvss_v3: 9.8

data/data/ruby-advisory-db/gems/matestack-ui-core/CVE-2020-5241.yml

@@ -0,0 +1,18 @@
+---
+gem: matestack-ui-core
+cve: 2020-5241
+date: 2020-02-10
+url: https://github.com/matestack/matestack-ui-core/security/advisories/GHSA-3jqw-vv45-mjhh
+title: |
+  matestack-ui-core is vulnerable to XSS/Script injection
+
+description: |
+  matestack-ui-core does not excape strings by default and does not cover this in the docs.
+  matestack-ui-core should escape strings by default in order to prevent XSS/Script injection vulnerability.
+  v0.7.4 fixes that by escaping strings by default.
+
+cvss_v2: 10.0
+cvss_v3: 9.8
+
+patched_versions:
+  - ">= 0.7.4"

data/data/ruby-advisory-db/gems/md2pdf/CVE-2013-1948.yml

@@ -0,0 +1,9 @@
+--- 
+gem: md2pdf
+cve: 2013-1948
+osvdb: 92290
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-1948
+title: md2pdf Gem for Ruby md2pdf/converter.rb File Name Shell Metacharacter Injection Arbitrary Command Execution
+date: 2013-04-13
+description: md2pdf Gem for Ruby contains a flaw that is due to the program failing to properly sanitize input passed to md2pdf/converter.rb. With a specially crafted file name that contains shell metacharacters, a context-dependent attacker can execute arbitrary commands
+cvss_v2: 10.0

data/data/ruby-advisory-db/gems/mini_magick/CVE-2013-2616.yml

@@ -0,0 +1,15 @@
+---
+gem: mini_magick
+cve: 2013-2616
+osvdb: 91231
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-2616
+title: MiniMagick Gem for Ruby URI Handling Arbitrary Command Injection
+date: 2013-03-12
+description: |
+  MiniMagick Gem for Ruby contains a flaw that is triggered during the handling
+  of specially crafted input from an untrusted source passed via a URL that
+  contains a ';' character. This may allow a context-dependent attacker to
+  potentially execute arbitrary commands.
+cvss_v2: 9.3
+patched_versions:
+  - ">= 3.6.0"

data/data/ruby-advisory-db/gems/mini_magick/CVE-2019-13574.yml

@@ -0,0 +1,14 @@
+gem: mini_magick
+cve: 2019-13574
+url: https://benjamin-bouchet.com/blog/vulnerabilite-dans-la-gem-mini_magick-version-4-9-4/
+title: Remote command execution via filename
+date: 2019-07-12
+description: |
+  A remote shell execution vulnerability when using MiniMagick::Image.open with URL coming from unsanitized user input.
+  e.g. `MiniMagick::Image.open("| touch.txt")`
+cvss_v3: 7.5
+patched_versions:
+  - ">= 4.9.4"
+related:
+  url:
+    - https://github.com/minimagick/minimagick/commit/4cd5081e58810d3394d27a67219e8e4e0445d851