漏洞公告

rest-client allows local users to obtain sensitive information by reading the log

SQL Injection in Active Record

Rails vulnerable to Cross-site Scripting

Denial-of-Service Memory Exhaustion in qs

Root Path Disclosure in send

activesupport vulnerable to Denial of Service via large XML document depth

Array data injection vulnerability in activerecord

Regular Expression Denial of Service in marked

Arabic Prawn allows remote attackers to execute arbitrary commands via shell metacharacters

Directory traversal vulnerability in actionpack

rails-html-sanitizer Cross-site Scripting vulnerability

Symlink Arbitrary File Overwrite in tar

Local API Login Credentials Disclosure in paratrooper-pingdom

Moderate severity vulnerability that affects handlebars

File Descriptor Leak Can Cause DoS Vulnerability in hapi

VBScript Content Injection in marked

Regular Expression Denial of Service in uglify-js

sentry-raven allows remote attackers to cause a denial of service via a large exponent value in a scientific number

Active Record subject to strong parameters protection bypass

actionpack is vulnerable to denial of service because of a wildcard controller route

Moderate severity vulnerability that affects validator

Paratrooper-newrelic Exposes of Sensitive Information to an Unauthorized Actor

facter, hiera, mcollective-client, and puppet affected by untrusted search path vulnerability