bundler-audit 0.7.0 → 0.7.0.1

data/data/ruby-advisory-db/gems/simple_captcha2/CVE-2019-14282.yml

@@ -0,0 +1,13 @@
+---
+gem: simple_captcha2
+cve: 2019-14282
+url: https://github.com/rubygems/rubygems.org/issues/2073
+date: 2019-07-31
+title: Code backdoor in simple_captcha2
+description: |
+  The simple_captcha2 gem 0.2.3 for Ruby, as distributed on RubyGems.org,
+  included a code-execution backdoor inserted by a third party.
+unaffected_versions:
+  - "< 0.2.3"
+  - "> 0.2.3"
+cvss_v3: 9.8

data/data/ruby-advisory-db/gems/simple_form/CVE-2019-16676.yml

@@ -0,0 +1,15 @@
+---
+gem: simple_form
+cve: 2019-16676
+ghsa: r74q-gxcg-73hx
+url: https://github.com/plataformatec/simple_form/security/advisories/GHSA-r74q-gxcg-73hx
+title: simple_form Gem for Ruby Incorrect Access Control for forms based on user input
+date: 2019-09-27
+description: |
+  Simple Form before 5.0 has Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`,
+  because a user-supplied string is invoked as a method call.
+  
+  This only happens for pages that build forms based on user input.
+
+patched_versions:
+  - ">= 5.0"

data/data/ruby-advisory-db/gems/sinatra/CVE-2018-11627.yml

@@ -0,0 +1,16 @@
+---
+gem: sinatra
+cve: 2018-11627
+url: https://github.com/sinatra/sinatra/issues/1428
+title: XSS via the 400 Bad Request page
+date: 2018-05-31
+description: |
+  Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception.
+
+cvss_v3: 6.1
+
+patched_versions:
+  - ">= 2.0.2"
+unaffected_versions:
+  - "< 2.0.0.beta1"
+  - "2.0.0-alpha"

data/data/ruby-advisory-db/gems/sinatra/CVE-2018-7212.yml

@@ -0,0 +1,19 @@
+---
+gem: sinatra
+cve: 2018-7212
+url: https://github.com/sinatra/sinatra/pull/1379
+date: 2018-01-09
+title: sinatra ruby gem path traversal via backslash characters on Windows
+description: |
+  An issue was discovered in rack-protection/lib/rack/protection/path_traversal.rb
+  in Sinatra 2.x before 2.0.1 on Windows. Path traversal is possible via backslash
+  characters.
+
+cvss_v3: 5.3
+cvss_v2: 5.0
+
+patched_versions:
+  - ">= 2.0.1"
+
+unaffected_versions:
+  - "< 2.0.0"

data/data/ruby-advisory-db/gems/slanger/CVE-2019-1010306.yml

@@ -0,0 +1,16 @@
+---
+gem: slanger
+cve: 2019-1010306
+ghsa: rg32-m3hf-772v
+url: https://github.com/stevegraham/slanger/pull/238
+date: 2019-07-16
+title: Arbitrary command execution in slanger
+description: |
+  A remote attacker can execute arbitrary commands by sending a crafted request to the server.
+
+  This is due to the use of `Oj.load` instead of `Oj.strict_load` when processing messages.
+
+  Note that `slanger` is no longer maintained.
+patched_versions:
+  - ">= 0.6.1"
+cvss_v3: 9.8

data/data/ruby-advisory-db/gems/smart_proxy_dynflow/CVE-2018-14643.yml

@@ -0,0 +1,18 @@
+---
+gem: smart_proxy_dynflow
+cve: 2018-14643
+url: https://github.com/theforeman/smart_proxy_dynflow/pull/54
+date: 2018-09-14
+title: smart_proxy_dynflow gem authentication bypass in Foreman remote execution feature
+description: |
+  An authentication bypass flaw was found in the smart_proxy_dynflow component
+  used by Foreman. A malicious attacker can use this flaw to remotely execute arbitrary
+  commands on machines managed by vulnerable Foreman instances, in a highly privileged
+  context.
+
+cvss_v3: 9.8
+cvss_v2: 10.0
+
+patched_versions:
+  - ~> 0.1.11
+  - ">= 0.2.1"

data/data/ruby-advisory-db/gems/sorcery/CVE-2020-11052.yml

@@ -0,0 +1,27 @@
+---
+gem: sorcery
+cve: 2020-11052
+ghsa: jc8m-cxhj-668x
+url: https://github.com/Sorcery/sorcery/security/advisories/GHSA-jc8m-cxhj-668x
+date: 2020-05-07
+title: Improper Restriction of Excessive Authentication Attempts in Sorcery
+description: |-
+  ### Impact
+  Brute force vulnerability when using password authentication via Sorcery.
+  The brute force protection submodule will prevent a brute force attack for
+  the defined lockout period, but once expired protection will not be re-enabled
+  until a user or malicious actor logs in successfully. This does not affect users
+  that do not use the built-in brute force protection submodule, nor users that use
+  permanent account lockout.
+
+  ### Patches
+  Patched as of version `0.15.0`.
+
+  ### Workarounds
+  Currently no workarounds, other than monkey patching the authenticate method
+  provided by Sorcery or upgrading to version `0.15.0`.
+
+cvss_v3: 8.3
+
+patched_versions:
+  - ">= 0.15.0"

data/data/ruby-advisory-db/gems/sounder/CVE-2013-5647.yml

@@ -0,0 +1,14 @@
+---
+gem: sounder
+cve: 2013-5647
+osvdb: 96278
+url: https://nvd.nist.gov/vuln/detail/CVE-2013-5647
+title: Sounder Gem for Ruby File Name Handling Arbitrary Command Execution
+date: 2013-08-14
+description: |
+  Sounder Gem for Ruby contains a flaw that is triggered during the handling
+  of file names. This may allow a context-dependent attacker to execute
+  arbitrary commands.
+cvss_v2: 7.5
+patched_versions: 
+  - ">= 1.0.2"

data/data/ruby-advisory-db/gems/spina/CVE-2015-4619.yml

@@ -0,0 +1,16 @@
+---
+gem: spina
+cve: 2015-4619
+title: Cross-site request forgery (CSRF) vulnerability in Spina gem
+date: 2015-06-16
+url: http://www.openwall.com/lists/oss-security/2015/06/16/11
+
+description: >-
+  `Spina::ApplicationController` actions didn't have CSRF
+  protection. This causes a CSRF vulnerability across the
+  entire engine which includes administrative functionality
+  such as creating users, changing passwords,
+  and media management.
+
+patched_versions:
+  - ">= 0.6.29"

data/data/ruby-advisory-db/gems/spree/OSVDB-119205.yml

@@ -0,0 +1,18 @@
+---
+gem: spree
+osvdb: 119205
+url: https://spreecommerce.com/blog/security-updates-2015-3-3
+title: Spree API Information Disclosure CSRF
+date: 2015-03-05
+description: |
+  Spree contains a flaw in the API as HTTP requests do not require multiple
+  steps, explicit confirmation, or a unique token when performing certain
+  sensitive actions. By tricking a user into following a specially crafted
+  link, a context-dependent attacker can perform a Cross-Site Request Forgery
+  (CSRF / XSRF) attack causing the victim to disclose potentially sensitive
+  information to attackers.
+patched_versions:
+  - ~> 2.2.10
+  - ~> 2.3.8
+  - ~> 2.4.5
+  - ">= 3.0.0.rc4"

data/data/ruby-advisory-db/gems/spree/OSVDB-125699.yml

@@ -0,0 +1,18 @@
+---
+gem: spree
+osvdb: 125699
+url: https://spreecommerce.com/blog/security-updates-2015-7-28
+title: |
+  Spree RABL templates rendering allows Arbitrary Code Execution and File
+  Disclosure
+date: 2015-07-28
+description: |
+  Spree contains a flaw where the rendering of arbitrary RABL templates allows
+  for execution arbitrary files on the host system, as well as disclosing the
+  existence of files on the system. This is a different issue than
+  OSVDB-125701.
+patched_versions:
+  - ~> 2.2.13
+  - ~> 2.3.12
+  - ~> 2.4.9
+  - ">= 3.0.3"

data/data/ruby-advisory-db/gems/spree/OSVDB-125701.yml

@@ -0,0 +1,17 @@
+---
+gem: spree
+osvdb: 125701
+url: https://spreecommerce.com/blog/security-updates-2015-7-20
+title: |
+  Spree RABL templates rendering allows Arbitrary Code Execution and File
+  Disclosure
+date: 2015-07-20
+description: |
+  Spree contains a flaw where the rendering of arbitrary RABL templates allows
+  for execution arbitrary files on the host system, as well as disclosing the
+  existence of files on the system.
+patched_versions:
+  - ~> 2.2.12
+  - ~> 2.3.11
+  - ~> 2.4.8
+  - ">= 3.0.2"

data/data/ruby-advisory-db/gems/spree/OSVDB-125712.yml

@@ -0,0 +1,16 @@
+---
+gem: spree
+osvdb: 125712
+url: https://spreecommerce.com/blog/security-issue-all-versions
+title: |
+  Product Scopes could allow for unauthenticated remote command execution
+date: 2012-07-02
+description: |
+  Product Scopes could allow for unauthenticated remote command execution.
+  This was corrected by removing conditions_any scope and use ARel query
+  building instead.
+patched_versions:
+  - ~> 0.11.4
+  - ~> 0.70.6
+  - ~> 1.0.5
+  - ">= 1.1.2"

data/data/ruby-advisory-db/gems/spree/OSVDB-125713.yml

@@ -0,0 +1,15 @@
+---
+gem: spree
+osvdb: 125713
+url: https://spreecommerce.com/blog/security-issue-all-versions
+title: |
+  Potential XSS vulnerability related to the analytics dashboard
+date: 2012-07-02
+description: |
+  Spree has a flaw in its analytics dashboard where keywords are not escaped,
+  leading to potential XSS.
+patched_versions:
+  - ~> 0.11.4
+  - ~> 0.70.6
+  - ~> 1.0.5
+  - ">= 1.1.2"

data/data/ruby-advisory-db/gems/spree/OSVDB-69098.yml

@@ -0,0 +1,19 @@
+---
+gem: spree
+cve: 2010-3978
+osvdb: 69098
+url: https://spreecommerce.com/blog/json-hijacking-vulnerability
+title: |
+  Spree Multiple Script JSON Request Validation Weakness Remote Information
+  Disclosure
+date: 2010-11-02
+description: |
+  Spree contains a flaw that may lead to an unauthorized information
+  disclosure. The issue is triggered when the application exchanges data using
+  the JSON service without validating requests, which will disclose sensitive
+  user and order information to a context-dependent attacker when a logged-in
+  user visits a crafted website.
+cvss_v2: 5.0
+patched_versions:
+  - ~> 0.11.2
+  - ">= 0.30.0"

data/data/ruby-advisory-db/gems/spree/OSVDB-73751.yml

@@ -0,0 +1,11 @@
+---
+gem: spree
+osvdb: 73751
+url: https://spreecommerce.com/blog/security-fixes
+title: Spree Content Controller Unspecified Arbitrary File Disclosure
+date: 2011-04-19
+description: |
+  Spree Gem for Ruby would allow a user to request a specially crafted URL and
+  expose arbitrary files on the server
+patched_versions:
+  - ">= 0.50.1"

data/data/ruby-advisory-db/gems/spree/OSVDB-76011.yml

@@ -0,0 +1,15 @@
+---
+gem: spree
+osvdb: 76011
+url: https://spreecommerce.com/blog/remote-command-product-group
+title: |
+  Spree Search ProductScope Class search[send][] Parameter Arbitrary Command
+  Execution
+date: 2011-10-05
+description: |
+  The ProductScope class fails to properly sanitize user-supplied input via the
+  'search[send][]' parameter resulting in arbitrary command execution. With a
+  specially crafted request, a remote attacker can potentially cause arbitrary
+  command execution.
+patched_versions:
+  - ">= 0.60.2"

data/data/ruby-advisory-db/gems/spree/OSVDB-81505.yml

@@ -0,0 +1,14 @@
+---
+gem: spree
+cve: 2008-7310
+osvdb: 81505
+url: https://spreecommerce.com/blog/security-vulnerability-mass-assignment
+title: |
+  Spree Hash Restriction Weakness URL Parsing Order State Value Manipulation
+date: 2008-09-22
+description: |
+  Spree contains a hash restriction weakness that occurs when parsing a
+  modified URL. This may allow an attacker to manipulate order state values.
+cvss_v2: 5.0
+patched_versions:
+  - ">= 0.3.0"

data/data/ruby-advisory-db/gems/spree/OSVDB-81506.yml

@@ -0,0 +1,16 @@
+---
+gem: spree
+cve: 2008-7311
+osvdb: 81506
+url: https://spreecommerce.com/blog/security-vulernability-session-cookie-store
+title: |
+  Spree Hardcoded config.action_controller_session Hash Value Cryptographic
+  Protection Weakness
+date: 2008-08-12
+description: |
+  Spree contains a hardcoded flaw related to the
+  config.action_controller_session hash value. This may allow an attacker to
+  more easily bypass cryptographic protection.
+cvss_v2: 5.0
+patched_versions:
+  - ">= 0.3.0"

data/data/ruby-advisory-db/gems/spree/OSVDB-90865.yml

@@ -0,0 +1,20 @@
+---
+gem: spree
+cve: 2013-2506
+osvdb: 90865
+url: https://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed
+title: |
+  Spree app/models/spree/user.rb Mass Role Assignment Remote Privilege
+  Escalation
+date: 2013-02-21
+description: |
+  Spree contains a flaw that leads to unauthorized privileges being gained. The
+  issue is triggered as certain input related to mass role assignment in
+  app/models/spree/user.rb is not properly verified before being used to update
+  a user. This may allow a remote attacker to assign arbitrary roles and gain
+  elevated administrative privileges.
+cvss_v2: 4.0
+patched_versions:
+  - ~> 1.1.6
+  - ~> 1.2.0
+  - ">= 1.3.0"

data/data/ruby-advisory-db/gems/spree/OSVDB-91216.yml

@@ -0,0 +1,17 @@
+---
+gem: spree
+cve: 2013-1656
+osvdb: 91216
+url: https://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed
+title: |
+  Spree promotion_actions_controller.rb promotion_action Parameter Arbitrary
+  Ruby Object Instantiation Command Execution
+date: 2013-02-21
+description: |
+  Spree contains a flaw that is triggered when handling input passed via the
+  'promotion_action' parameter to promotion_actions_controller.rb. This may
+  allow a remote authenticated attacker to instantiate arbitrary Ruby objects
+  and potentially execute arbitrary commands.
+cvss_v2: 4.3
+patched_versions:
+  - ">= 2.0.0"

data/data/ruby-advisory-db/gems/spree/OSVDB-91217.yml

@@ -0,0 +1,17 @@
+---
+gem: spree
+cve: 2013-1656
+osvdb: 91217
+url: https://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed
+title: |
+  Spree payment_methods_controller.rb payment_method Parameter Arbitrary Ruby
+  Object Instantiation Command Execution
+date: 2013-02-21
+description: |
+  Spree contains a flaw that is triggered when handling input passed via the
+  'payment_method' parameter to payment_methods_controller.rb. This may allow
+  a remote authenticated attacker to instantiate arbitrary Ruby objects and
+  potentially execute arbitrary commands.
+cvss_v2: 4.3
+patched_versions:
+  - ">= 2.0.0"

data/data/ruby-advisory-db/gems/spree/OSVDB-91218.yml

@@ -0,0 +1,17 @@
+---
+gem: spree
+cve: 2013-1656
+osvdb: 91218
+url: https://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed
+title: |
+  Spree promotions_controller.rb calculator_type Parameter Arbitrary Ruby
+  Object Instantiation Command Execution
+date: 2013-02-21
+description: |
+  Spree contains a flaw that is triggered when handling input passed via the
+  'calculator_type' parameter to promotions_controller.rb. This may allow a
+  remote authenticated attacker to instantiate arbitrary Ruby objects and
+  potentially execute arbitrary commands.
+cvss_v2: 4.3
+patched_versions:
+  - ">= 2.0.0"

data/data/ruby-advisory-db/gems/spree/OSVDB-91219.yml

@@ -0,0 +1,17 @@
+---
+gem: spree
+cve: 2013-1656
+osvdb: 91219
+url: https://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed
+title: |
+  Spree promotion_rules_controller.rb promotion_rule Parameter Arbitrary Ruby
+  Object Instantiation Command Execution
+date: 2013-02-21
+description: |
+  Spree contains a flaw that is triggered when handling input passed via the
+  'promotion_rule' parameter to promotion_rules_controller.rb. This may allow
+  a remote authenticated attacker to instantiate arbitrary Ruby objects and
+  potentially execute arbitrary commands.
+cvss_v2: 4.3
+patched_versions:
+  - ">= 2.0.0"

data/data/ruby-advisory-db/gems/spree_auth/OSVDB-90865.yml

@@ -0,0 +1,16 @@
+---
+gem: spree_auth
+cve: 2013-2506
+osvdb: 90865
+url: https://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed
+title: |
+  Spree app/models/spree/user.rb Mass Role Assignment Remote Privilege
+  Escalation
+date: 2013-02-21
+description: |
+  Spree contains a flaw that leads to unauthorized privileges being gained. The
+  issue is triggered as certain input related to mass role assignment in
+  app/models/spree/user.rb is not properly verified before being used to update
+  a user. This may allow a remote attacker to assign arbitrary roles and gain
+  elevated administrative privileges.
+cvss_v2: 4.0