Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/39370?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/39370?format=api", "purl": "pkg:gem/nokogiri@1.5.1", "type": "gem", "namespace": "", "name": "nokogiri", "version": "1.5.1", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "1.19.3", "latest_non_vulnerable_version": "1.19.3", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/3152?format=api", "vulnerability_id": "VCID-14kb-seu7-9bcc", "summary": "", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-16932.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-16932.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2017-16932", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.21755", "scoring_system": "epss", "scoring_elements": "0.95885", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.21755", "scoring_system": "epss", "scoring_elements": "0.95889", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.21755", "scoring_system": "epss", "scoring_elements": "0.95886", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.21755", "scoring_system": "epss", "scoring_elements": "0.95872", "published_at": "2026-06-11T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2017-16932" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16932", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16932" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/issues/1714", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/issues/1714" }, { "reference_url": "https://usn.ubuntu.com/3739-1", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://usn.ubuntu.com/3739-1" }, { "reference_url": "https://usn.ubuntu.com/usn/usn-3504-1/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/usn/usn-3504-1/" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1517316", "reference_id": "1517316", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1517316" }, { "reference_url": "https://usn.ubuntu.com/3739-1/", "reference_id": "3739-1", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-04T13:30:08Z/" } ], "url": "https://usn.ubuntu.com/3739-1/" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=882613", "reference_id": "882613", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=882613" }, { "reference_url": "https://github.com/GNOME/libxml2/commit/899a5d9f0ed13b8e32449a08a361e0de127dd961", "reference_id": "899a5d9f0ed13b8e32449a08a361e0de127dd961", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-04T13:30:08Z/" } ], "url": "https://github.com/GNOME/libxml2/commit/899a5d9f0ed13b8e32449a08a361e0de127dd961" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/899a5d9f0ed13b8e32449a08a361e0de127dd961", "reference_id": "899a5d9f0ed13b8e32449a08a361e0de127dd961", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-04T13:30:08Z/" } ], "url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/899a5d9f0ed13b8e32449a08a361e0de127dd961" }, { "reference_url": "https://blog.clamav.net/2018/07/clamav-01001-has-been-released.html", "reference_id": "clamav-01001-has-been-released.html", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-04T13:30:08Z/" } ], "url": "https://blog.clamav.net/2018/07/clamav-01001-has-been-released.html" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16932", "reference_id": "CVE-2017-16932", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16932" }, { "reference_url": "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-16932.html", "reference_id": "CVE-2017-16932.HTML", "reference_type": "", "scores": [], "url": "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-16932.html" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2017-16932.yml", "reference_id": "CVE-2017-16932.YML", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2017-16932.yml" }, { "reference_url": "https://github.com/advisories/GHSA-x2fm-93ww-ggvx", "reference_id": "GHSA-x2fm-93ww-ggvx", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-x2fm-93ww-ggvx" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html", "reference_id": "msg00004.html", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-04T13:30:08Z/" } ], "url": "https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2017/11/msg00041.html", "reference_id": "msg00041.html", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-04T13:30:08Z/" } ], "url": "https://lists.debian.org/debian-lts-announce/2017/11/msg00041.html" }, { "reference_url": "http://xmlsoft.org/news.html", "reference_id": "news.html", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-04T13:30:08Z/" } ], "url": "http://xmlsoft.org/news.html" }, { "reference_url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E", "reference_id": "r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-04T13:30:08Z/" } ], "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E", "reference_id": "rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-04T13:30:08Z/" } ], "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E" }, { "reference_url": "https://bugzilla.gnome.org/show_bug.cgi?id=759579", "reference_id": "show_bug.cgi?id=759579", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-04T13:30:08Z/" } ], "url": "https://bugzilla.gnome.org/show_bug.cgi?id=759579" }, { "reference_url": "https://usn.ubuntu.com/3504-1/", "reference_id": "USN-3504-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/3504-1/" }, { "reference_url": "https://usn.ubuntu.com/3504-2/", "reference_id": "USN-3504-2", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/3504-2/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/13035?format=api", "purl": "pkg:gem/nokogiri@1.8.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-18br-sw9t-9ue7" }, { "vulnerability": "VCID-2577-3bpb-pkgr" }, { "vulnerability": "VCID-2vtx-kt21-wuac" }, { "vulnerability": "VCID-3kej-ecyc-2ka6" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-4kgk-drcy-4beq" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-ahe3-n9yg-sqgq" }, { "vulnerability": "VCID-ahte-mbyn-2fh6" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-bgqs-y35v-vuae" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-eqeg-fdfg-vyag" }, { "vulnerability": "VCID-g7g7-vevx-hkej" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-hwva-pek4-5fb7" }, { "vulnerability": "VCID-kqcu-jg4b-ykcd" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-ngg9-hp6h-sqfz" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-nt7b-her7-z3g8" }, { "vulnerability": "VCID-pk8z-1yjq-uqh5" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-qtu6-c9d8-1ydh" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-sn7m-5bry-13fp" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-v77z-t5z4-93cq" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-x37v-jdmd-wbes" }, { "vulnerability": "VCID-x3bk-gdmn-xyhu" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-yr3x-bvad-mfcc" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.8.1" } ], "aliases": [ "CVE-2017-16932", "GHSA-x2fm-93ww-ggvx" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-14kb-seu7-9bcc" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/359435?format=api", "vulnerability_id": "VCID-14st-5sfb-jfhk", "summary": "Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171\n## Summary\n\nNokogiri v1.18.3 upgrades its dependency libxml2 to\n[v2.13.6](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.6).\n\nlibxml2 v2.13.6 addresses:\n\n- CVE-2025-24928\n - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/847\n- CVE-2024-56171\n - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/828\n\n## Impact\n\n### CVE-2025-24928\n\nStack-buffer overflow is possible when reporting DTD validation\nerrors if the input contains a long (~3kb) QName prefix.\n\n### CVE-2024-56171\n\nUse-after-free is possible during validation against untrusted\nXML Schemas (.xsd) and, potentially, validation of untrusted documents\nagainst trusted Schemas if they make use of `xsd:keyref` in combination\nwith recursively defined types that have additional identity constraints.", "references": [ { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-vvfq-8hwr-qm4m.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-vvfq-8hwr-qm4m.yml" }, { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vvfq-8hwr-qm4m", "reference_id": "", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vvfq-8hwr-qm4m" }, { "reference_url": "https://github.com/advisories/GHSA-vvfq-8hwr-qm4m", "reference_id": "GHSA-vvfq-8hwr-qm4m", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-vvfq-8hwr-qm4m" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/377245?format=api", "purl": "pkg:gem/nokogiri@1.18.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.18.3" } ], "aliases": [ "GHSA-vvfq-8hwr-qm4m" ], "risk_score": 1.4, "exploitability": "0.5", "weighted_severity": "2.7", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-14st-5sfb-jfhk" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/9706?format=api", "vulnerability_id": "VCID-18br-sw9t-9ue7", "summary": "", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-3518.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-3518.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-3518", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0025", "scoring_system": "epss", "scoring_elements": "0.48672", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.0025", "scoring_system": "epss", "scoring_elements": "0.48814", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.0025", "scoring_system": "epss", "scoring_elements": "0.48828", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.0025", "scoring_system": "epss", "scoring_elements": "0.48809", "published_at": "2026-06-12T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-3518" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1954242", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1954242" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3518", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3518" }, { "reference_url": "http://seclists.org/fulldisclosure/2021/Jul/54", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://seclists.org/fulldisclosure/2021/Jul/54" }, { "reference_url": "http://seclists.org/fulldisclosure/2021/Jul/55", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://seclists.org/fulldisclosure/2021/Jul/55" }, { "reference_url": "http://seclists.org/fulldisclosure/2021/Jul/58", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://seclists.org/fulldisclosure/2021/Jul/58" }, { "reference_url": "http://seclists.org/fulldisclosure/2021/Jul/59", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://seclists.org/fulldisclosure/2021/Jul/59" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/blob/2edbbef95f1dc12c1ddc5ebda71b9159026245fe/CHANGELOG.md?plain=1#L722", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/blob/2edbbef95f1dc12c1ddc5ebda71b9159026245fe/CHANGELOG.md?plain=1#L722" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/" }, { "reference_url": "https://nokogiri.org/CHANGELOG.html#1114-2021-05-14", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nokogiri.org/CHANGELOG.html#1114-2021-05-14" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20210625-0002", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20210625-0002" }, { "reference_url": "https://support.apple.com/kb/HT212601", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://support.apple.com/kb/HT212601" }, { "reference_url": "https://support.apple.com/kb/HT212602", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://support.apple.com/kb/HT212602" }, { "reference_url": "https://support.apple.com/kb/HT212604", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://support.apple.com/kb/HT212604" }, { "reference_url": "https://support.apple.com/kb/HT212605", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://support.apple.com/kb/HT212605" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=987737", "reference_id": "987737", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=987737" }, { "reference_url": "https://security.archlinux.org/AVG-1883", "reference_id": "AVG-1883", "reference_type": "", "scores": [ { "value": "High", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1883" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3518", "reference_id": "CVE-2021-3518", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3518" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2021-3518.yml", "reference_id": "CVE-2021-3518.YML", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2021-3518.yml" }, { "reference_url": "https://github.com/advisories/GHSA-v4f8-2847-rwm7", "reference_id": "GHSA-v4f8-2847-rwm7", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-v4f8-2847-rwm7" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:2569", "reference_id": "RHSA-2021:2569", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:2569" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1389", "reference_id": "RHSA-2022:1389", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1389" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1390", "reference_id": "RHSA-2022:1390", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1390" }, { "reference_url": "https://usn.ubuntu.com/4991-1/", "reference_id": "USN-4991-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/4991-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/23358?format=api", "purl": "pkg:gem/nokogiri@1.11.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-2vtx-kt21-wuac" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-ahe3-n9yg-sqgq" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-yr3x-bvad-mfcc" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.11.4" } ], "aliases": [ "CVE-2021-3518", "GHSA-v4f8-2847-rwm7" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-18br-sw9t-9ue7" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/9716?format=api", "vulnerability_id": "VCID-2577-3bpb-pkgr", "summary": "", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-3537.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-3537.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-3537", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00111", "scoring_system": "epss", "scoring_elements": "0.29373", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00111", "scoring_system": "epss", "scoring_elements": "0.29386", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.00111", "scoring_system": "epss", "scoring_elements": "0.29363", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00111", "scoring_system": "epss", "scoring_elements": "0.29163", "published_at": "2026-06-11T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-3537" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1956522", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1956522" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3537", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3537" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/blob/2edbbef95f1dc12c1ddc5ebda71b9159026245fe/CHANGELOG.md?plain=1#L722", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/blob/2edbbef95f1dc12c1ddc5ebda71b9159026245fe/CHANGELOG.md?plain=1#L722" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/" }, { "reference_url": "https://nokogiri.org/CHANGELOG.html#1114-2021-05-14", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nokogiri.org/CHANGELOG.html#1114-2021-05-14" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20210625-0002", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20210625-0002" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=988123", "reference_id": "988123", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=988123" }, { "reference_url": "https://security.archlinux.org/AVG-1883", "reference_id": "AVG-1883", "reference_type": "", "scores": [ { "value": "High", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1883" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3537", "reference_id": "CVE-2021-3537", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3537" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2021-3537.yml", "reference_id": "CVE-2021-3537.YML", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2021-3537.yml" }, { "reference_url": "https://github.com/advisories/GHSA-286v-pcf5-25rc", "reference_id": "GHSA-286v-pcf5-25rc", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-286v-pcf5-25rc" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:2569", "reference_id": "RHSA-2021:2569", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:2569" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1389", "reference_id": "RHSA-2022:1389", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1389" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1390", "reference_id": "RHSA-2022:1390", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1390" }, { "reference_url": "https://usn.ubuntu.com/4991-1/", "reference_id": "USN-4991-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/4991-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/23358?format=api", "purl": "pkg:gem/nokogiri@1.11.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-2vtx-kt21-wuac" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-ahe3-n9yg-sqgq" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-yr3x-bvad-mfcc" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.11.4" } ], "aliases": [ "CVE-2021-3537", "GHSA-286v-pcf5-25rc" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-2577-3bpb-pkgr" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/197186?format=api", "vulnerability_id": "VCID-2vtx-kt21-wuac", "summary": "xml external entity injection", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-41098.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-41098.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-41098", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00251", "scoring_system": "epss", "scoring_elements": "0.48835", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00251", "scoring_system": "epss", "scoring_elements": "0.48698", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00251", "scoring_system": "epss", "scoring_elements": "0.48839", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00251", "scoring_system": "epss", "scoring_elements": "0.48853", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-41098" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2021-41098.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2021-41098.yml" }, { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/commit/5bf729ff3cc84709ee3c3248c981584088bf9f6d", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/commit/5bf729ff3cc84709ee3c3248c981584088bf9f6d" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-2rr5-8q37-2w7h", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-2rr5-8q37-2w7h" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41098", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41098" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2008914", "reference_id": "2008914", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2008914" }, { "reference_url": "https://security.archlinux.org/AVG-2424", "reference_id": "AVG-2424", "reference_type": "", "scores": [ { "value": "High", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-2424" }, { "reference_url": "https://github.com/advisories/GHSA-2rr5-8q37-2w7h", "reference_id": "GHSA-2rr5-8q37-2w7h", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-2rr5-8q37-2w7h" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/382547?format=api", "purl": "pkg:gem/nokogiri@1.12.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-ahe3-n9yg-sqgq" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-yr3x-bvad-mfcc" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.12.5" } ], "aliases": [ "CVE-2021-41098", "GHSA-2rr5-8q37-2w7h" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-2vtx-kt21-wuac" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/9717?format=api", "vulnerability_id": "VCID-3kej-ecyc-2ka6", "summary": "", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-3541.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-3541.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-3541", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0006", "scoring_system": "epss", "scoring_elements": "0.19112", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.0006", "scoring_system": "epss", "scoring_elements": "0.19282", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.0006", "scoring_system": "epss", "scoring_elements": "0.19302", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.0006", "scoring_system": "epss", "scoring_elements": "0.1928", "published_at": "2026-06-14T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-3541" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3541", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3541" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20210805-0007/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://security.netapp.com/advisory/ntap-20210805-0007/" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1950515", "reference_id": "1950515", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1950515" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=988603", "reference_id": "988603", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=988603" }, { "reference_url": "https://security.archlinux.org/AVG-1883", "reference_id": "AVG-1883", "reference_type": "", "scores": [ { "value": "High", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1883" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:2569", "reference_id": "RHSA-2021:2569", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:2569" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1389", "reference_id": "RHSA-2022:1389", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1389" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1390", "reference_id": "RHSA-2022:1390", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1390" }, { "reference_url": "https://usn.ubuntu.com/4991-1/", "reference_id": "USN-4991-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/4991-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/23358?format=api", "purl": "pkg:gem/nokogiri@1.11.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-2vtx-kt21-wuac" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-ahe3-n9yg-sqgq" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-yr3x-bvad-mfcc" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.11.4" } ], "aliases": [ "CVE-2021-3541" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-3kej-ecyc-2ka6" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/115096?format=api", "vulnerability_id": "VCID-3z3h-7s7d-zbaz", "summary": "security update", "references": [ { "reference_url": "http://lists.opensuse.org/opensuse-updates/2015-12/msg00120.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://lists.opensuse.org/opensuse-updates/2015-12/msg00120.html" }, { "reference_url": "http://lists.opensuse.org/opensuse-updates/2016-01/msg00031.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://lists.opensuse.org/opensuse-updates/2016-01/msg00031.html" }, { "reference_url": "http://marc.info/?l=bugtraq&m=145382616617563&w=2", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://marc.info/?l=bugtraq&m=145382616617563&w=2" }, { "reference_url": "http://rhn.redhat.com/errata/RHSA-2015-2549.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://rhn.redhat.com/errata/RHSA-2015-2549.html" }, { "reference_url": "http://rhn.redhat.com/errata/RHSA-2015-2550.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://rhn.redhat.com/errata/RHSA-2015-2550.html" }, { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-5312.json", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-5312.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2015-5312", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.01078", "scoring_system": "epss", "scoring_elements": "0.78308", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.01078", "scoring_system": "epss", "scoring_elements": "0.78232", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.01078", "scoring_system": "epss", "scoring_elements": "0.783", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.01078", "scoring_system": "epss", "scoring_elements": "0.78313", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2015-5312" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1276693", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1276693" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1819", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1819" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5312", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5312" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7497", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7497" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7498", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7498" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7499", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7499" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7500", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7500" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7941", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7941" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7942", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7942" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8035", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8035" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8241", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8241" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8317", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8317" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8710", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8710" }, { "reference_url": "https://git.gnome.org/browse/libxml2/commit/?id=69030714cde66d525a8884bda01b9e8f0abf8e1e", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://git.gnome.org/browse/libxml2/commit/?id=69030714cde66d525a8884bda01b9e8f0abf8e1e" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/commit/4205af1a2a546f79d1b48df2ad8b27299c0099c5", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/sparklemotion/nokogiri/commit/4205af1a2a546f79d1b48df2ad8b27299c0099c5" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/pull/1378", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/sparklemotion/nokogiri/pull/1378" }, { "reference_url": "https://groups.google.com/forum/#!topic/ruby-security-ann/aSbgDiwb24s", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://groups.google.com/forum/#!topic/ruby-security-ann/aSbgDiwb24s" }, { "reference_url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04944172", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04944172" }, { "reference_url": "http://www.debian.org/security/2015/dsa-3430", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.debian.org/security/2015/dsa-3430" }, { "reference_url": "http://www.ubuntu.com/usn/USN-2834-1", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.ubuntu.com/usn/USN-2834-1" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5312", "reference_id": "CVE-2015-5312", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5312" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2015-5312.yml", "reference_id": "CVE-2015-5312.YML", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2015-5312.yml" }, { "reference_url": "https://github.com/advisories/GHSA-xjqg-9jvg-fgx2", "reference_id": "GHSA-xjqg-9jvg-fgx2", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-xjqg-9jvg-fgx2" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2015:2549", "reference_id": "RHSA-2015:2549", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2015:2549" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2015:2550", "reference_id": "RHSA-2015:2550", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2015:2550" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:1089", "reference_id": "RHSA-2016:1089", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:1089" }, { "reference_url": "https://usn.ubuntu.com/2834-1/", "reference_id": "USN-2834-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/2834-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/13532?format=api", "purl": "pkg:gem/nokogiri@1.6.7.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14kb-seu7-9bcc" }, { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-18br-sw9t-9ue7" }, { "vulnerability": "VCID-2577-3bpb-pkgr" }, { "vulnerability": "VCID-2vtx-kt21-wuac" }, { "vulnerability": "VCID-3kej-ecyc-2ka6" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-4kgk-drcy-4beq" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-ahe3-n9yg-sqgq" }, { "vulnerability": "VCID-ahte-mbyn-2fh6" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-bgqs-y35v-vuae" }, { "vulnerability": "VCID-cnnd-sgk1-8qcu" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-eqeg-fdfg-vyag" }, { "vulnerability": "VCID-g7g7-vevx-hkej" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-hwva-pek4-5fb7" }, { "vulnerability": "VCID-jf45-a4cp-v7a7" }, { "vulnerability": "VCID-kqcu-jg4b-ykcd" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-mc8f-xxy6-u7f7" }, { "vulnerability": "VCID-ngg9-hp6h-sqfz" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-nt7b-her7-z3g8" }, { "vulnerability": "VCID-pk8z-1yjq-uqh5" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-qtu6-c9d8-1ydh" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-sn7m-5bry-13fp" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-v77z-t5z4-93cq" }, { "vulnerability": "VCID-va8n-ev2d-53a2" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-x37v-jdmd-wbes" }, { "vulnerability": "VCID-x3bk-gdmn-xyhu" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-yr3x-bvad-mfcc" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zwze-jyd4-6qhm" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.7.1" } ], "aliases": [ "CVE-2015-5312", "GHSA-xjqg-9jvg-fgx2" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-3z3h-7s7d-zbaz" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/163827?format=api", "vulnerability_id": "VCID-47qk-3n97-wfb7", "summary": "Nokogiri is an open source XML and HTML library for the Ruby programming language. Nokogiri `1.13.8` and `1.13.9` fail to check the return value from `xmlTextReaderExpand` in the method `Nokogiri::XML::Reader#attribute_hash`. This can lead to a null pointer exception when invalid markup is being parsed. For applications using `XML::Reader` to parse untrusted inputs, this may potentially be a vector for a denial of service attack. Users are advised to upgrade to Nokogiri `>= 1.13.10`. Users may be able to search their code for calls to either `XML::Reader#attributes` or `XML::Reader#attribute_hash` to determine if they are affected.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-23476.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-23476.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-23476", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00271", "scoring_system": "epss", "scoring_elements": "0.50944", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00271", "scoring_system": "epss", "scoring_elements": "0.50956", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.00271", "scoring_system": "epss", "scoring_elements": "0.50941", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00271", "scoring_system": "epss", "scoring_elements": "0.50808", "published_at": "2026-06-11T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-23476" }, { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2153279", "reference_id": "2153279", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2153279" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/commit/85410e38410f670cbbc8c5b00d07b843caee88ce", "reference_id": "85410e38410f670cbbc8c5b00d07b843caee88ce", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:48:08Z/" } ], "url": "https://github.com/sparklemotion/nokogiri/commit/85410e38410f670cbbc8c5b00d07b843caee88ce" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/commit/9fe0761c47c0d4270d1a5220cfd25de080350d50", "reference_id": "9fe0761c47c0d4270d1a5220cfd25de080350d50", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:48:08Z/" } ], "url": "https://github.com/sparklemotion/nokogiri/commit/9fe0761c47c0d4270d1a5220cfd25de080350d50" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23476", "reference_id": "CVE-2022-23476", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23476" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2022-23476.yml", "reference_id": "CVE-2022-23476.YML", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2022-23476.yml" }, { "reference_url": "https://github.com/advisories/GHSA-qv4q-mr5r-qprj", "reference_id": "GHSA-qv4q-mr5r-qprj", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-qv4q-mr5r-qprj" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-qv4q-mr5r-qprj", "reference_id": "GHSA-qv4q-mr5r-qprj", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:48:08Z/" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-qv4q-mr5r-qprj" }, { "reference_url": "https://security.gentoo.org/glsa/202408-13", "reference_id": "GLSA-202408-13", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202408-13" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/28165?format=api", "purl": "pkg:gem/nokogiri@1.13.10", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-z2bq-warv-47c1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.13.10" } ], "aliases": [ "CVE-2022-23476", "GHSA-qv4q-mr5r-qprj" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-47qk-3n97-wfb7" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/12378?format=api", "vulnerability_id": "VCID-49ww-fg7b-zugq", "summary": "", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-40303.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-40303.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-40303", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0023", "scoring_system": "epss", "scoring_elements": "0.4612", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.0023", "scoring_system": "epss", "scoring_elements": "0.46134", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.0023", "scoring_system": "epss", "scoring_elements": "0.46127", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.0023", "scoring_system": "epss", "scoring_elements": "0.45982", "published_at": "2026-06-11T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-40303" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40303", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40303" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40304", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40304" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://nokogiri.org/CHANGELOG.html#1139-2022-10-18", "reference_id": "", "reference_type": "", "scores": [], "url": "https://nokogiri.org/CHANGELOG.html#1139-2022-10-18" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1022224", "reference_id": "1022224", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1022224" }, { "reference_url": "http://seclists.org/fulldisclosure/2022/Dec/21", "reference_id": "21", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-29T04:23:26Z/" } ], "url": "http://seclists.org/fulldisclosure/2022/Dec/21" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136266", "reference_id": "2136266", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136266" }, { "reference_url": "http://seclists.org/fulldisclosure/2022/Dec/24", "reference_id": "24", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-29T04:23:26Z/" } ], "url": "http://seclists.org/fulldisclosure/2022/Dec/24" }, { "reference_url": "http://seclists.org/fulldisclosure/2022/Dec/25", "reference_id": "25", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-29T04:23:26Z/" } ], "url": "http://seclists.org/fulldisclosure/2022/Dec/25" }, { "reference_url": "http://seclists.org/fulldisclosure/2022/Dec/26", "reference_id": "26", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-29T04:23:26Z/" } ], "url": "http://seclists.org/fulldisclosure/2022/Dec/26" }, { "reference_url": "http://seclists.org/fulldisclosure/2022/Dec/27", "reference_id": "27", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-29T04:23:26Z/" } ], "url": "http://seclists.org/fulldisclosure/2022/Dec/27" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/c846986356fc149915a74972bf198abc266bc2c0", "reference_id": "c846986356fc149915a74972bf198abc266bc2c0", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-29T04:23:26Z/" } ], "url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/c846986356fc149915a74972bf198abc266bc2c0" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40303", "reference_id": "CVE-2022-40303", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40303" }, { "reference_url": "https://security.gentoo.org/glsa/202210-39", "reference_id": "GLSA-202210-39", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202210-39" }, { "reference_url": "https://support.apple.com/kb/HT213531", "reference_id": "HT213531", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-29T04:23:26Z/" } ], "url": "https://support.apple.com/kb/HT213531" }, { "reference_url": "https://support.apple.com/kb/HT213533", "reference_id": "HT213533", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-29T04:23:26Z/" } ], "url": "https://support.apple.com/kb/HT213533" }, { "reference_url": "https://support.apple.com/kb/HT213534", "reference_id": "HT213534", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-29T04:23:26Z/" } ], "url": "https://support.apple.com/kb/HT213534" }, { "reference_url": "https://support.apple.com/kb/HT213535", "reference_id": "HT213535", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-29T04:23:26Z/" } ], "url": "https://support.apple.com/kb/HT213535" }, { "reference_url": "https://support.apple.com/kb/HT213536", "reference_id": "HT213536", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-29T04:23:26Z/" } ], "url": "https://support.apple.com/kb/HT213536" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20221209-0003/", "reference_id": "ntap-20221209-0003", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-29T04:23:26Z/" } ], "url": "https://security.netapp.com/advisory/ntap-20221209-0003/" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8841", "reference_id": "RHSA-2022:8841", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8841" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0173", "reference_id": "RHSA-2023:0173", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0173" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0338", "reference_id": "RHSA-2023:0338", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0338" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:0413", "reference_id": "RHSA-2024:0413", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:0413" }, { "reference_url": "https://usn.ubuntu.com/5760-1/", "reference_id": "USN-5760-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5760-1/" }, { "reference_url": "https://usn.ubuntu.com/5760-2/", "reference_id": "USN-5760-2", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5760-2/" }, { "reference_url": "https://usn.ubuntu.com/7659-1/", "reference_id": "USN-7659-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7659-1/" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/-/tags/v2.10.3", "reference_id": "v2.10.3", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-29T04:23:26Z/" } ], "url": "https://gitlab.gnome.org/GNOME/libxml2/-/tags/v2.10.3" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/27390?format=api", "purl": "pkg:gem/nokogiri@1.13.9", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-z2bq-warv-47c1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.13.9" } ], "aliases": [ "CVE-2022-40303" ], "risk_score": 3.4, "exploitability": "0.5", "weighted_severity": "6.8", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-49ww-fg7b-zugq" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/115094?format=api", "vulnerability_id": "VCID-4e3h-nwws-abh1", "summary": "security update", "references": [ { "reference_url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172710.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172710.html" }, { "reference_url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172943.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172943.html" }, { "reference_url": "http://lists.opensuse.org/opensuse-updates/2015-12/msg00120.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://lists.opensuse.org/opensuse-updates/2015-12/msg00120.html" }, { "reference_url": "http://lists.opensuse.org/opensuse-updates/2016-01/msg00031.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://lists.opensuse.org/opensuse-updates/2016-01/msg00031.html" }, { "reference_url": "http://rhn.redhat.com/errata/RHSA-2015-1419.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://rhn.redhat.com/errata/RHSA-2015-1419.html" }, { "reference_url": "http://rhn.redhat.com/errata/RHSA-2015-2550.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://rhn.redhat.com/errata/RHSA-2015-2550.html" }, { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-1819.json", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-1819.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2015-1819", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.02045", "scoring_system": "epss", "scoring_elements": "0.84223", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.02045", "scoring_system": "epss", "scoring_elements": "0.84287", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.02045", "scoring_system": "epss", "scoring_elements": "0.84279", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.02045", "scoring_system": "epss", "scoring_elements": "0.84282", "published_at": "2026-06-14T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2015-1819" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1819", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1819" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5312", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5312" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7497", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7497" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7498", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7498" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7499", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7499" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7500", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7500" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7941", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7941" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7942", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7942" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8035", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8035" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8241", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8241" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8317", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8317" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8710", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8710" }, { "reference_url": "https://git.gnome.org/browse/libxml2/commit/?id=213f1fe0d76d30eaed6e5853057defc43e6df2c9", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://git.gnome.org/browse/libxml2/commit/?id=213f1fe0d76d30eaed6e5853057defc43e6df2c9" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/commit/8f3de6d88d0da11fb62a45daa61b85ce71b4af59", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/sparklemotion/nokogiri/commit/8f3de6d88d0da11fb62a45daa61b85ce71b4af59" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/issues/1374", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/issues/1374" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/pull/1376", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/sparklemotion/nokogiri/pull/1376" }, { "reference_url": "http://www.debian.org/security/2015/dsa-3430", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.debian.org/security/2015/dsa-3430" }, { "reference_url": "http://www.ubuntu.com/usn/USN-2812-1", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.ubuntu.com/usn/USN-2812-1" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1211278", "reference_id": "1211278", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1211278" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=782782", "reference_id": "782782", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=782782" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1819", "reference_id": "CVE-2015-1819", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1819" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2015-1819.yml", "reference_id": "CVE-2015-1819.YML", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2015-1819.yml" }, { "reference_url": "https://github.com/advisories/GHSA-q7wx-62r7-j2x7", "reference_id": "GHSA-q7wx-62r7-j2x7", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-q7wx-62r7-j2x7" }, { "reference_url": "https://security.gentoo.org/glsa/201507-08", "reference_id": "GLSA-201507-08", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.gentoo.org/glsa/201507-08" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2015:1419", "reference_id": "RHSA-2015:1419", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2015:1419" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2015:2550", "reference_id": "RHSA-2015:2550", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2015:2550" }, { "reference_url": "https://usn.ubuntu.com/2812-1/", "reference_id": "USN-2812-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/2812-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/13489?format=api", "purl": "pkg:gem/nokogiri@1.6.6.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14kb-seu7-9bcc" }, { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-18br-sw9t-9ue7" }, { "vulnerability": "VCID-2577-3bpb-pkgr" }, { "vulnerability": "VCID-2vtx-kt21-wuac" }, { "vulnerability": "VCID-3kej-ecyc-2ka6" }, { "vulnerability": "VCID-3z3h-7s7d-zbaz" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-4kgk-drcy-4beq" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-ahe3-n9yg-sqgq" }, { "vulnerability": "VCID-ahte-mbyn-2fh6" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-bgqs-y35v-vuae" }, { "vulnerability": "VCID-cnnd-sgk1-8qcu" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-eqeg-fdfg-vyag" }, { "vulnerability": "VCID-g7g7-vevx-hkej" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-hwva-pek4-5fb7" }, { "vulnerability": "VCID-jf45-a4cp-v7a7" }, { "vulnerability": "VCID-kqcu-jg4b-ykcd" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-mc8f-xxy6-u7f7" }, { "vulnerability": "VCID-ngg9-hp6h-sqfz" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-nt7b-her7-z3g8" }, { "vulnerability": "VCID-pk8z-1yjq-uqh5" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-qtu6-c9d8-1ydh" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-sn7m-5bry-13fp" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-u51x-afpr-a7gt" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-v77z-t5z4-93cq" }, { "vulnerability": "VCID-va8n-ev2d-53a2" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-x37v-jdmd-wbes" }, { "vulnerability": "VCID-x3bk-gdmn-xyhu" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-yr3x-bvad-mfcc" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zwze-jyd4-6qhm" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.6.4" }, { "url": "http://public2.vulnerablecode.io/api/packages/388436?format=api", "purl": "pkg:gem/nokogiri@1.6.7.rc4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14kb-seu7-9bcc" }, { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-18br-sw9t-9ue7" }, { "vulnerability": "VCID-2577-3bpb-pkgr" }, { "vulnerability": "VCID-2vtx-kt21-wuac" }, { "vulnerability": "VCID-3kej-ecyc-2ka6" }, { "vulnerability": "VCID-3z3h-7s7d-zbaz" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-4kgk-drcy-4beq" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-ahe3-n9yg-sqgq" }, { "vulnerability": "VCID-ahte-mbyn-2fh6" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-bgqs-y35v-vuae" }, { "vulnerability": "VCID-cnnd-sgk1-8qcu" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-eqeg-fdfg-vyag" }, { "vulnerability": "VCID-g7g7-vevx-hkej" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-hwva-pek4-5fb7" }, { "vulnerability": "VCID-jf45-a4cp-v7a7" }, { "vulnerability": "VCID-kqcu-jg4b-ykcd" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-mc8f-xxy6-u7f7" }, { "vulnerability": "VCID-ngg9-hp6h-sqfz" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-nt7b-her7-z3g8" }, { "vulnerability": "VCID-pk8z-1yjq-uqh5" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-qtu6-c9d8-1ydh" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-sn7m-5bry-13fp" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-u51x-afpr-a7gt" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-v77z-t5z4-93cq" }, { "vulnerability": "VCID-va8n-ev2d-53a2" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-x37v-jdmd-wbes" }, { "vulnerability": "VCID-x3bk-gdmn-xyhu" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-yr3x-bvad-mfcc" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zwze-jyd4-6qhm" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.7.rc4" } ], "aliases": [ "CVE-2015-1819", "GHSA-q7wx-62r7-j2x7" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-4e3h-nwws-abh1" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/5810?format=api", "vulnerability_id": "VCID-4kgk-drcy-4beq", "summary": "", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-8048.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-8048.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2018-8048", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00689", "scoring_system": "epss", "scoring_elements": "0.72341", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00689", "scoring_system": "epss", "scoring_elements": "0.72251", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00689", "scoring_system": "epss", "scoring_elements": "0.72347", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.00689", "scoring_system": "epss", "scoring_elements": "0.72334", "published_at": "2026-06-12T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2018-8048" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8048", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8048" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/flavorjones/loofah", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/flavorjones/loofah" }, { "reference_url": "https://github.com/flavorjones/loofah/commit/f739cf8eac5851f328b8044281d6653f74eff116", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/flavorjones/loofah/commit/f739cf8eac5851f328b8044281d6653f74eff116" }, { "reference_url": "https://github.com/flavorjones/loofah/issues/144", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/flavorjones/loofah/issues/144" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/pull/1746", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/pull/1746" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20191122-0003", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20191122-0003" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20191122-0003/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://security.netapp.com/advisory/ntap-20191122-0003/" }, { "reference_url": "https://www.debian.org/security/2018/dsa-4171", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.debian.org/security/2018/dsa-4171" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2018/03/19/5", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2018/03/19/5" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1559071", "reference_id": "1559071", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1559071" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=893596", "reference_id": "893596", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=893596" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8048", "reference_id": "CVE-2018-8048", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8048" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/loofah/CVE-2018-8048.yml", "reference_id": "CVE-2018-8048.YML", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/loofah/CVE-2018-8048.yml" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2018-8048.yml", "reference_id": "CVE-2018-8048.YML", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2018-8048.yml" }, { "reference_url": "https://github.com/advisories/GHSA-x7rv-cr6v-4vm4", "reference_id": "GHSA-x7rv-cr6v-4vm4", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-x7rv-cr6v-4vm4" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/13113?format=api", "purl": "pkg:gem/nokogiri@1.8.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-18br-sw9t-9ue7" }, { "vulnerability": "VCID-2577-3bpb-pkgr" }, { "vulnerability": "VCID-2vtx-kt21-wuac" }, { "vulnerability": "VCID-3kej-ecyc-2ka6" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-ahe3-n9yg-sqgq" }, { "vulnerability": "VCID-ahte-mbyn-2fh6" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-bgqs-y35v-vuae" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-eqeg-fdfg-vyag" }, { "vulnerability": "VCID-g7g7-vevx-hkej" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-hwva-pek4-5fb7" }, { "vulnerability": "VCID-kqcu-jg4b-ykcd" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-ngg9-hp6h-sqfz" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-qtu6-c9d8-1ydh" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-sn7m-5bry-13fp" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-v77z-t5z4-93cq" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-x37v-jdmd-wbes" }, { "vulnerability": "VCID-x3bk-gdmn-xyhu" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-yr3x-bvad-mfcc" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.8.3" } ], "aliases": [ "CVE-2018-8048", "GHSA-x7rv-cr6v-4vm4" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-4kgk-drcy-4beq" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/361663?format=api", "vulnerability_id": "VCID-7cqg-h2ws-hfh1", "summary": "Unsafe parsing of unclosed comments\nParsing an unclosed comment can result in `Conditional jump or move depends on uninitialised value(s)` and unsafe memory access.", "references": [ { "reference_url": "https://github.com/sparklemotion/nokogiri/blob/master/CHANGELOG.rdoc#167rc4--2015-11-22", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/sparklemotion/nokogiri/blob/master/CHANGELOG.rdoc#167rc4--2015-11-22" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/blob/v1.6.6.x/CHANGELOG.rdoc#1664--2015-11-19", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/sparklemotion/nokogiri/blob/v1.6.6.x/CHANGELOG.rdoc#1664--2015-11-19" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/commit/0948e9fa38c949661983a33752fdcb94a453e272", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/sparklemotion/nokogiri/commit/0948e9fa38c949661983a33752fdcb94a453e272" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/commit/3ab1b2339f7bb3a00590c8d288a24a9dbfe5aec4", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/sparklemotion/nokogiri/commit/3ab1b2339f7bb3a00590c8d288a24a9dbfe5aec4" }, { "reference_url": "https://groups.google.com/forum/#!topic/nokogiri-talk/nFl0mfcJpbk", "reference_id": "", "reference_type": "", "scores": [], "url": "https://groups.google.com/forum/#!topic/nokogiri-talk/nFl0mfcJpbk" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/13489?format=api", "purl": "pkg:gem/nokogiri@1.6.6.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14kb-seu7-9bcc" }, { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-18br-sw9t-9ue7" }, { "vulnerability": "VCID-2577-3bpb-pkgr" }, { "vulnerability": "VCID-2vtx-kt21-wuac" }, { "vulnerability": "VCID-3kej-ecyc-2ka6" }, { "vulnerability": "VCID-3z3h-7s7d-zbaz" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-4kgk-drcy-4beq" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-ahe3-n9yg-sqgq" }, { "vulnerability": "VCID-ahte-mbyn-2fh6" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-bgqs-y35v-vuae" }, { "vulnerability": "VCID-cnnd-sgk1-8qcu" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-eqeg-fdfg-vyag" }, { "vulnerability": "VCID-g7g7-vevx-hkej" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-hwva-pek4-5fb7" }, { "vulnerability": "VCID-jf45-a4cp-v7a7" }, { "vulnerability": "VCID-kqcu-jg4b-ykcd" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-mc8f-xxy6-u7f7" }, { "vulnerability": "VCID-ngg9-hp6h-sqfz" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-nt7b-her7-z3g8" }, { "vulnerability": "VCID-pk8z-1yjq-uqh5" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-qtu6-c9d8-1ydh" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-sn7m-5bry-13fp" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-u51x-afpr-a7gt" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-v77z-t5z4-93cq" }, { "vulnerability": "VCID-va8n-ev2d-53a2" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-x37v-jdmd-wbes" }, { "vulnerability": "VCID-x3bk-gdmn-xyhu" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-yr3x-bvad-mfcc" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zwze-jyd4-6qhm" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.6.4" }, { "url": "http://public2.vulnerablecode.io/api/packages/388436?format=api", "purl": "pkg:gem/nokogiri@1.6.7.rc4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14kb-seu7-9bcc" }, { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-18br-sw9t-9ue7" }, { "vulnerability": "VCID-2577-3bpb-pkgr" }, { "vulnerability": "VCID-2vtx-kt21-wuac" }, { "vulnerability": "VCID-3kej-ecyc-2ka6" }, { "vulnerability": "VCID-3z3h-7s7d-zbaz" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-4kgk-drcy-4beq" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-ahe3-n9yg-sqgq" }, { "vulnerability": "VCID-ahte-mbyn-2fh6" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-bgqs-y35v-vuae" }, { "vulnerability": "VCID-cnnd-sgk1-8qcu" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-eqeg-fdfg-vyag" }, { "vulnerability": "VCID-g7g7-vevx-hkej" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-hwva-pek4-5fb7" }, { "vulnerability": "VCID-jf45-a4cp-v7a7" }, { "vulnerability": "VCID-kqcu-jg4b-ykcd" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-mc8f-xxy6-u7f7" }, { "vulnerability": "VCID-ngg9-hp6h-sqfz" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-nt7b-her7-z3g8" }, { "vulnerability": "VCID-pk8z-1yjq-uqh5" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-qtu6-c9d8-1ydh" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-sn7m-5bry-13fp" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-u51x-afpr-a7gt" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-v77z-t5z4-93cq" }, { "vulnerability": "VCID-va8n-ev2d-53a2" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-x37v-jdmd-wbes" }, { "vulnerability": "VCID-x3bk-gdmn-xyhu" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-yr3x-bvad-mfcc" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zwze-jyd4-6qhm" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.7.rc4" } ], "aliases": [ "GMS-2015-43" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-7cqg-h2ws-hfh1" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/209272?format=api", "vulnerability_id": "VCID-7qnq-6za5-6ubz", "summary": "Nokogiri vulnerable to DoS while parsing XML documents", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-6460.json", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-6460.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2013-6460", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.02521", "scoring_system": "epss", "scoring_elements": "0.85791", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.02521", "scoring_system": "epss", "scoring_elements": "0.85798", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.02521", "scoring_system": "epss", "scoring_elements": "0.85788", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.02521", "scoring_system": "epss", "scoring_elements": "0.85738", "published_at": "2026-06-11T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2013-6460" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6460", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6460" }, { "reference_url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-6460", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-6460" }, { "reference_url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90058", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90058" }, { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://groups.google.com/forum/#!topic/ruby-security-ann/DeJpjTAg1FA", "reference_id": "", "reference_type": "", "scores": [], "url": "https://groups.google.com/forum/#!topic/ruby-security-ann/DeJpjTAg1FA" }, { "reference_url": "https://web.archive.org/web/20200229074427/https://www.securityfocus.com/bid/64513", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20200229074427/https://www.securityfocus.com/bid/64513" }, { "reference_url": "https://web.archive.org/web/20200229074427/https://www.securityfocus.com/bid/64513/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://web.archive.org/web/20200229074427/https://www.securityfocus.com/bid/64513/" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2013/12/27/2", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2013/12/27/2" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1046663", "reference_id": "1046663", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1046663" }, { "reference_url": "https://access.redhat.com/security/cve/cve-2013-6460", "reference_id": "CVE-2013-6460", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://access.redhat.com/security/cve/cve-2013-6460" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6460", "reference_id": "CVE-2013-6460", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6460" }, { "reference_url": "https://security-tracker.debian.org/tracker/CVE-2013-6460", "reference_id": "CVE-2013-6460", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security-tracker.debian.org/tracker/CVE-2013-6460" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2013-6460.yml", "reference_id": "CVE-2013-6460.YML", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2013-6460.yml" }, { "reference_url": "https://github.com/advisories/GHSA-62qp-3fxm-9wxf", "reference_id": "GHSA-62qp-3fxm-9wxf", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-62qp-3fxm-9wxf" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/20783?format=api", "purl": "pkg:gem/nokogiri@1.5.11", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14kb-seu7-9bcc" }, { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-18br-sw9t-9ue7" }, { "vulnerability": "VCID-2577-3bpb-pkgr" }, { "vulnerability": "VCID-2vtx-kt21-wuac" }, { "vulnerability": "VCID-3kej-ecyc-2ka6" }, { "vulnerability": "VCID-3z3h-7s7d-zbaz" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-4e3h-nwws-abh1" }, { "vulnerability": "VCID-4kgk-drcy-4beq" }, { "vulnerability": "VCID-7cqg-h2ws-hfh1" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-ahe3-n9yg-sqgq" }, { "vulnerability": "VCID-ahte-mbyn-2fh6" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-bgqs-y35v-vuae" }, { "vulnerability": "VCID-cnnd-sgk1-8qcu" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-djuu-6gdw-cuav" }, { "vulnerability": "VCID-eqeg-fdfg-vyag" }, { "vulnerability": "VCID-g7g7-vevx-hkej" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-hwva-pek4-5fb7" }, { "vulnerability": "VCID-jf45-a4cp-v7a7" }, { "vulnerability": "VCID-kqcu-jg4b-ykcd" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-mc8f-xxy6-u7f7" }, { "vulnerability": "VCID-ngg9-hp6h-sqfz" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-nt7b-her7-z3g8" }, { "vulnerability": "VCID-payk-mek8-kka3" }, { "vulnerability": "VCID-pk8z-1yjq-uqh5" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-qtu6-c9d8-1ydh" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-sn7m-5bry-13fp" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-v77z-t5z4-93cq" }, { "vulnerability": "VCID-va8n-ev2d-53a2" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-x37v-jdmd-wbes" }, { "vulnerability": "VCID-x3bk-gdmn-xyhu" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-yr3x-bvad-mfcc" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zwze-jyd4-6qhm" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.5.11" }, { "url": "http://public2.vulnerablecode.io/api/packages/388476?format=api", "purl": "pkg:gem/nokogiri@1.6.0.rc1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14kb-seu7-9bcc" }, { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-18br-sw9t-9ue7" }, { "vulnerability": "VCID-2577-3bpb-pkgr" }, { "vulnerability": "VCID-2vtx-kt21-wuac" }, { "vulnerability": "VCID-3kej-ecyc-2ka6" }, { "vulnerability": "VCID-3z3h-7s7d-zbaz" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-4e3h-nwws-abh1" }, { "vulnerability": "VCID-4kgk-drcy-4beq" }, { "vulnerability": "VCID-7cqg-h2ws-hfh1" }, { "vulnerability": "VCID-7qnq-6za5-6ubz" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-ahe3-n9yg-sqgq" }, { "vulnerability": "VCID-ahte-mbyn-2fh6" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-bgqs-y35v-vuae" }, { "vulnerability": "VCID-cnnd-sgk1-8qcu" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-djuu-6gdw-cuav" }, { "vulnerability": "VCID-eqeg-fdfg-vyag" }, { "vulnerability": "VCID-g7g7-vevx-hkej" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-hwva-pek4-5fb7" }, { "vulnerability": "VCID-jf45-a4cp-v7a7" }, { "vulnerability": "VCID-kqcu-jg4b-ykcd" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-mc8f-xxy6-u7f7" }, { "vulnerability": "VCID-ngg9-hp6h-sqfz" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-nt7b-her7-z3g8" }, { "vulnerability": "VCID-payk-mek8-kka3" }, { "vulnerability": "VCID-pk8z-1yjq-uqh5" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-qtu6-c9d8-1ydh" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-sn7m-5bry-13fp" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-v77z-t5z4-93cq" }, { "vulnerability": "VCID-va8n-ev2d-53a2" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-x37v-jdmd-wbes" }, { "vulnerability": "VCID-x3bk-gdmn-xyhu" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-xy21-uzq3-ebhu" }, { "vulnerability": "VCID-yr3x-bvad-mfcc" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zwze-jyd4-6qhm" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.0.rc1" }, { "url": "http://public2.vulnerablecode.io/api/packages/20781?format=api", "purl": "pkg:gem/nokogiri@1.6.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14kb-seu7-9bcc" }, { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-18br-sw9t-9ue7" }, { "vulnerability": "VCID-2577-3bpb-pkgr" }, { "vulnerability": "VCID-2vtx-kt21-wuac" }, { "vulnerability": "VCID-3kej-ecyc-2ka6" }, { "vulnerability": "VCID-3z3h-7s7d-zbaz" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-4e3h-nwws-abh1" }, { "vulnerability": "VCID-4kgk-drcy-4beq" }, { "vulnerability": "VCID-7cqg-h2ws-hfh1" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-ahe3-n9yg-sqgq" }, { "vulnerability": "VCID-ahte-mbyn-2fh6" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-bgqs-y35v-vuae" }, { "vulnerability": "VCID-cnnd-sgk1-8qcu" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-djuu-6gdw-cuav" }, { "vulnerability": "VCID-eqeg-fdfg-vyag" }, { "vulnerability": "VCID-g7g7-vevx-hkej" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-hwva-pek4-5fb7" }, { "vulnerability": "VCID-jf45-a4cp-v7a7" }, { "vulnerability": "VCID-kqcu-jg4b-ykcd" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-mc8f-xxy6-u7f7" }, { "vulnerability": "VCID-ngg9-hp6h-sqfz" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-nt7b-her7-z3g8" }, { "vulnerability": "VCID-payk-mek8-kka3" }, { "vulnerability": "VCID-pk8z-1yjq-uqh5" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-qtu6-c9d8-1ydh" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-sn7m-5bry-13fp" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-u51x-afpr-a7gt" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-v77z-t5z4-93cq" }, { "vulnerability": "VCID-va8n-ev2d-53a2" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-x37v-jdmd-wbes" }, { "vulnerability": "VCID-x3bk-gdmn-xyhu" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-yr3x-bvad-mfcc" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zwze-jyd4-6qhm" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.1" } ], "aliases": [ "CVE-2013-6460", "GHSA-62qp-3fxm-9wxf", "OSV-101179" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-7qnq-6za5-6ubz" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/211691?format=api", "vulnerability_id": "VCID-8ftz-ajmp-jba8", "summary": "Nokogiri update packaged libxml2 to v2.12.5 to resolve CVE-2024-25062", "references": [ { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/discussions/3146", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/discussions/3146" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/92721970", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/92721970" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.5", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.5" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25062", "reference_id": "CVE-2024-25062", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25062" }, { "reference_url": "https://github.com/advisories/GHSA-xc9x-jj77-9p9j", "reference_id": "GHSA-xc9x-jj77-9p9j", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-xc9x-jj77-9p9j" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xc9x-jj77-9p9j", "reference_id": "GHSA-xc9x-jj77-9p9j", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xc9x-jj77-9p9j" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-xc9x-jj77-9p9j.yml", "reference_id": "GHSA-xc9x-jj77-9p9j.yml", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-xc9x-jj77-9p9j.yml" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/28756?format=api", "purl": "pkg:gem/nokogiri@1.15.6", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-z2bq-warv-47c1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.15.6" }, { "url": "http://public2.vulnerablecode.io/api/packages/691038?format=api", "purl": "pkg:gem/nokogiri@1.16.0.rc1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-z2bq-warv-47c1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.16.0.rc1" }, { "url": "http://public2.vulnerablecode.io/api/packages/28755?format=api", "purl": "pkg:gem/nokogiri@1.16.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-z2bq-warv-47c1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.16.2" } ], "aliases": [ "GHSA-xc9x-jj77-9p9j", "GMS-2024-127" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-8ftz-ajmp-jba8" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/11508?format=api", "vulnerability_id": "VCID-ahe3-n9yg-sqgq", "summary": "", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-23308.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-23308.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-23308", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00074", "scoring_system": "epss", "scoring_elements": "0.22511", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00074", "scoring_system": "epss", "scoring_elements": "0.22706", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00074", "scoring_system": "epss", "scoring_elements": "0.22719", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.00074", "scoring_system": "epss", "scoring_elements": "0.22699", "published_at": "2026-06-14T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-23308" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23308", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23308" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/GNOME/libxml2/commit/652dd12a858989b14eed4e84e453059cd3ba340e", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/GNOME/libxml2/commit/652dd12a858989b14eed4e84e453059cd3ba340e" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.2", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.2" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/-/blob/v2.9.13/NEWS", "reference_id": "", "reference_type": "", "scores": [], "url": "https://gitlab.gnome.org/GNOME/libxml2/-/blob/v2.9.13/NEWS" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1006489", "reference_id": "1006489", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1006489" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2056913", "reference_id": "2056913", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2056913" }, { "reference_url": "https://security.archlinux.org/AVG-2726", "reference_id": "AVG-2726", "reference_type": "", "scores": [ { "value": "High", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-2726" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23308", "reference_id": "CVE-2022-23308", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23308" }, { "reference_url": "https://security.gentoo.org/glsa/202210-03", "reference_id": "GLSA-202210-03", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202210-03" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0899", "reference_id": "RHSA-2022:0899", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0899" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1389", "reference_id": "RHSA-2022:1389", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1389" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1390", "reference_id": "RHSA-2022:1390", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1390" }, { "reference_url": "https://usn.ubuntu.com/5324-1/", "reference_id": "USN-5324-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5324-1/" }, { "reference_url": "https://usn.ubuntu.com/5422-1/", "reference_id": "USN-5422-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5422-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/19515?format=api", "purl": "pkg:gem/nokogiri@1.13.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.13.2" } ], "aliases": [ "CVE-2022-23308" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ahe3-n9yg-sqgq" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/6232?format=api", "vulnerability_id": "VCID-ahte-mbyn-2fh6", "summary": "", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-13118.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-13118.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2019-13118", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.01008", "scoring_system": "epss", "scoring_elements": "0.77565", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.01008", "scoring_system": "epss", "scoring_elements": "0.77559", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.01008", "scoring_system": "epss", "scoring_elements": "0.77574", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.01008", "scoring_system": "epss", "scoring_elements": "0.7749", "published_at": "2026-06-11T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-13118" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13118", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13118" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/blob/f7aa3b0b29d6fe5fafe93dacd9b96b6b3d16b7ec/CHANGELOG.md?plain=1#L796", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/blob/f7aa3b0b29d6fe5fafe93dacd9b96b6b3d16b7ec/CHANGELOG.md?plain=1#L796" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/commit/43a175339b47b8c604508813fc75b83f13cd173e", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/commit/43a175339b47b8c604508813fc75b83f13cd173e" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/issues/1943", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/issues/1943" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.10.5", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.10.5" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2019-13118", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-13118" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20190806-0004", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20190806-0004" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20200122-0003", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20200122-0003" }, { "reference_url": "https://usn.ubuntu.com/4164-1", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://usn.ubuntu.com/4164-1" }, { "reference_url": "http://seclists.org/fulldisclosure/2019/Aug/11", "reference_id": "11", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "http://seclists.org/fulldisclosure/2019/Aug/11" }, { "reference_url": "http://seclists.org/fulldisclosure/2019/Aug/13", "reference_id": "13", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "http://seclists.org/fulldisclosure/2019/Aug/13" }, { "reference_url": "http://seclists.org/fulldisclosure/2019/Aug/14", "reference_id": "14", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "http://seclists.org/fulldisclosure/2019/Aug/14" }, { "reference_url": "http://seclists.org/fulldisclosure/2019/Aug/15", "reference_id": "15", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "http://seclists.org/fulldisclosure/2019/Aug/15" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1728541", "reference_id": "1728541", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1728541" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2019/11/17/2", "reference_id": "2", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2019/11/17/2" }, { "reference_url": "https://seclists.org/bugtraq/2019/Aug/21", "reference_id": "21", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://seclists.org/bugtraq/2019/Aug/21" }, { "reference_url": "http://seclists.org/fulldisclosure/2019/Jul/22", "reference_id": "22", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "http://seclists.org/fulldisclosure/2019/Jul/22" }, { "reference_url": "https://seclists.org/bugtraq/2019/Aug/22", "reference_id": "22", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://seclists.org/bugtraq/2019/Aug/22" }, { "reference_url": "http://seclists.org/fulldisclosure/2019/Jul/23", "reference_id": "23", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "http://seclists.org/fulldisclosure/2019/Jul/23" }, { "reference_url": "https://seclists.org/bugtraq/2019/Aug/23", "reference_id": "23", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://seclists.org/bugtraq/2019/Aug/23" }, { "reference_url": "http://seclists.org/fulldisclosure/2019/Jul/24", "reference_id": "24", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "http://seclists.org/fulldisclosure/2019/Jul/24" }, { "reference_url": "https://seclists.org/bugtraq/2019/Aug/25", "reference_id": "25", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://seclists.org/bugtraq/2019/Aug/25" }, { "reference_url": "http://seclists.org/fulldisclosure/2019/Jul/26", "reference_id": "26", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "http://seclists.org/fulldisclosure/2019/Jul/26" }, { "reference_url": "http://seclists.org/fulldisclosure/2019/Jul/31", "reference_id": "31", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "http://seclists.org/fulldisclosure/2019/Jul/31" }, { "reference_url": "https://seclists.org/bugtraq/2019/Jul/35", "reference_id": "35", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://seclists.org/bugtraq/2019/Jul/35" }, { "reference_url": "https://seclists.org/bugtraq/2019/Jul/36", "reference_id": "36", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://seclists.org/bugtraq/2019/Jul/36" }, { "reference_url": "http://seclists.org/fulldisclosure/2019/Jul/37", "reference_id": "37", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "http://seclists.org/fulldisclosure/2019/Jul/37" }, { "reference_url": "https://seclists.org/bugtraq/2019/Jul/37", "reference_id": "37", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://seclists.org/bugtraq/2019/Jul/37" }, { "reference_url": "http://seclists.org/fulldisclosure/2019/Jul/38", "reference_id": "38", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "http://seclists.org/fulldisclosure/2019/Jul/38" }, { "reference_url": "https://seclists.org/bugtraq/2019/Jul/40", "reference_id": "40", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://seclists.org/bugtraq/2019/Jul/40" }, { "reference_url": "https://seclists.org/bugtraq/2019/Jul/41", "reference_id": "41", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://seclists.org/bugtraq/2019/Jul/41" }, { "reference_url": "https://usn.ubuntu.com/4164-1/", "reference_id": "4164-1", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://usn.ubuntu.com/4164-1/" }, { "reference_url": "https://seclists.org/bugtraq/2019/Jul/42", "reference_id": "42", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://seclists.org/bugtraq/2019/Jul/42" }, { "reference_url": "https://oss-fuzz.com/testcase-detail/5197371471822848", "reference_id": "5197371471822848", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://oss-fuzz.com/testcase-detail/5197371471822848" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxslt/commit/6ce8de69330783977dd14f6569419489875fb71b", "reference_id": "6ce8de69330783977dd14f6569419489875fb71b", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://gitlab.gnome.org/GNOME/libxslt/commit/6ce8de69330783977dd14f6569419489875fb71b" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931320", "reference_id": "931320", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931320" }, { "reference_url": "https://www.oracle.com/security-alerts/cpujan2020.html", "reference_id": "cpujan2020.html", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://www.oracle.com/security-alerts/cpujan2020.html" }, { "reference_url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15069", "reference_id": "detail?id=15069", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15069" }, { "reference_url": "https://github.com/advisories/GHSA-cf46-6xxh-pc75", "reference_id": "GHSA-cf46-6xxh-pc75", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-cf46-6xxh-pc75" }, { "reference_url": "https://support.apple.com/kb/HT210346", "reference_id": "HT210346", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://support.apple.com/kb/HT210346" }, { "reference_url": "https://support.apple.com/kb/HT210348", "reference_id": "HT210348", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://support.apple.com/kb/HT210348" }, { "reference_url": "https://support.apple.com/kb/HT210351", "reference_id": "HT210351", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://support.apple.com/kb/HT210351" }, { "reference_url": "https://support.apple.com/kb/HT210353", "reference_id": "HT210353", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://support.apple.com/kb/HT210353" }, { "reference_url": "https://support.apple.com/kb/HT210356", "reference_id": "HT210356", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://support.apple.com/kb/HT210356" }, { "reference_url": "https://support.apple.com/kb/HT210357", "reference_id": "HT210357", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://support.apple.com/kb/HT210357" }, { "reference_url": "https://support.apple.com/kb/HT210358", "reference_id": "HT210358", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://support.apple.com/kb/HT210358" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ/", "reference_id": "IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ/" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2019/07/msg00020.html", "reference_id": "msg00020.html", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://lists.debian.org/debian-lts-announce/2019/07/msg00020.html" }, { "reference_url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html", "reference_id": "msg00062.html", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20190806-0004/", "reference_id": "ntap-20190806-0004", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://security.netapp.com/advisory/ntap-20190806-0004/" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20200122-0003/", "reference_id": "ntap-20200122-0003", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://security.netapp.com/advisory/ntap-20200122-0003/" }, { "reference_url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E", "reference_id": "r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E", "reference_id": "rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/384510?format=api", "purl": "pkg:gem/nokogiri@1.10.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-18br-sw9t-9ue7" }, { "vulnerability": "VCID-2577-3bpb-pkgr" }, { "vulnerability": "VCID-2vtx-kt21-wuac" }, { "vulnerability": "VCID-3kej-ecyc-2ka6" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-ahe3-n9yg-sqgq" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-g7g7-vevx-hkej" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-hwva-pek4-5fb7" }, { "vulnerability": "VCID-kqcu-jg4b-ykcd" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-sn7m-5bry-13fp" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-x37v-jdmd-wbes" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-yr3x-bvad-mfcc" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.10.5" } ], "aliases": [ "CVE-2019-13118", "GHSA-cf46-6xxh-pc75" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ahte-mbyn-2fh6" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/202615?format=api", "vulnerability_id": "VCID-b6fv-168m-27dn", "summary": "Nokogiri before 1.5.4 is vulnerable to XXE attacks", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-6685.json", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-6685.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2012-6685", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00323", "scoring_system": "epss", "scoring_elements": "0.55861", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00323", "scoring_system": "epss", "scoring_elements": "0.55742", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00323", "scoring_system": "epss", "scoring_elements": "0.55863", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00323", "scoring_system": "epss", "scoring_elements": "0.55876", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2012-6685" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1178970", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1178970" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6685", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6685" }, { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/commit/599856367150709497a3a03bee930bd76504d95d", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/sparklemotion/nokogiri/commit/599856367150709497a3a03bee930bd76504d95d" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/issues/693", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/issues/693" }, { "reference_url": "https://nokogiri.org/CHANGELOG.html#154-2012-06-12", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nokogiri.org/CHANGELOG.html#154-2012-06-12" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6685", "reference_id": "CVE-2012-6685", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6685" }, { "reference_url": "https://github.com/advisories/GHSA-6wj9-77wq-jq7p", "reference_id": "GHSA-6wj9-77wq-jq7p", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-6wj9-77wq-jq7p" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/20287?format=api", "purl": "pkg:gem/nokogiri@1.5.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14kb-seu7-9bcc" }, { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-18br-sw9t-9ue7" }, { "vulnerability": "VCID-2577-3bpb-pkgr" }, { "vulnerability": "VCID-2vtx-kt21-wuac" }, { "vulnerability": "VCID-3kej-ecyc-2ka6" }, { "vulnerability": "VCID-3z3h-7s7d-zbaz" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-4e3h-nwws-abh1" }, { "vulnerability": "VCID-4kgk-drcy-4beq" }, { "vulnerability": "VCID-7cqg-h2ws-hfh1" }, { "vulnerability": "VCID-7qnq-6za5-6ubz" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-ahe3-n9yg-sqgq" }, { "vulnerability": "VCID-ahte-mbyn-2fh6" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-bgqs-y35v-vuae" }, { "vulnerability": "VCID-cnnd-sgk1-8qcu" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-djuu-6gdw-cuav" }, { "vulnerability": "VCID-eqeg-fdfg-vyag" }, { "vulnerability": "VCID-g7g7-vevx-hkej" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-hwva-pek4-5fb7" }, { "vulnerability": "VCID-jf45-a4cp-v7a7" }, { "vulnerability": "VCID-kqcu-jg4b-ykcd" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-mc8f-xxy6-u7f7" }, { "vulnerability": "VCID-ngg9-hp6h-sqfz" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-nt7b-her7-z3g8" }, { "vulnerability": "VCID-payk-mek8-kka3" }, { "vulnerability": "VCID-pk8z-1yjq-uqh5" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-qtu6-c9d8-1ydh" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-sn7m-5bry-13fp" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-v77z-t5z4-93cq" }, { "vulnerability": "VCID-va8n-ev2d-53a2" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-x37v-jdmd-wbes" }, { "vulnerability": "VCID-x3bk-gdmn-xyhu" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-xy21-uzq3-ebhu" }, { "vulnerability": "VCID-yr3x-bvad-mfcc" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zwze-jyd4-6qhm" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.5.4" } ], "aliases": [ "CVE-2012-6685", "GHSA-6wj9-77wq-jq7p", "OSV-90946" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-b6fv-168m-27dn" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/359433?format=api", "vulnerability_id": "VCID-bfux-puuz-p3fb", "summary": "Nokogiri updates packaged libxslt to v1.1.43 to resolve multiple CVEs\n## Summary\n\nNokogiri v1.18.4 upgrades its dependency libxslt to\n[v1.1.43](https://gitlab.gnome.org/GNOME/libxslt/-/releases/v1.1.43).\n\nlibxslt v1.1.43 resolves:\n\n- CVE-2025-24855: Fix use-after-free of XPath context node\n- CVE-2024-55549: Fix UAF related to excluded namespaces\n\n## Impact\n\n### CVE-2025-24855\n\n- \"Use-after-free due to xsltEvalXPathStringNs leaking xpathCtxt->node\"\n- MITRE has rated this 7.8 High CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H\n- Upstream report: https://gitlab.gnome.org/GNOME/libxslt/-/issues/128\n- NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2025-24855\n\n### CVE-2024-55549\n\n- \"Use-after-free related to excluded result prefixes\"\n- MITRE has rated this 7.8 High CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H\n- Upstream report: https://gitlab.gnome.org/GNOME/libxslt/-/issues/127\n- NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2024-55549", "references": [ { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-mrxw-mxhj-p664", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-mrxw-mxhj-p664" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55549", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55549" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24855", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24855" }, { "reference_url": "https://github.com/advisories/GHSA-mrxw-mxhj-p664", "reference_id": "GHSA-mrxw-mxhj-p664", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-mrxw-mxhj-p664" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/377971?format=api", "purl": "pkg:gem/nokogiri@1.18.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.18.4" } ], "aliases": [ "GHSA-mrxw-mxhj-p664" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-bfux-puuz-p3fb" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/6619?format=api", "vulnerability_id": "VCID-bgqs-y35v-vuae", "summary": "", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-18197.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-18197.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2019-18197", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.04534", "scoring_system": "epss", "scoring_elements": "0.89448", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.04534", "scoring_system": "epss", "scoring_elements": "0.89455", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.04534", "scoring_system": "epss", "scoring_elements": "0.89412", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.04534", "scoring_system": "epss", "scoring_elements": "0.89454", "published_at": "2026-06-14T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-18197" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18197", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18197" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2019-18197.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2019-18197.yml" }, { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/blob/01ab95f3e37429ed8d3b380a8d2f73902eb325d9/CHANGELOG.md?plain=1#L934", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/blob/01ab95f3e37429ed8d3b380a8d2f73902eb325d9/CHANGELOG.md?plain=1#L934" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/issues/1943", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/issues/1943" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2019-18197", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-18197" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20191031-0004", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20191031-0004" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20200416-0004", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20200416-0004" }, { "reference_url": "https://usn.ubuntu.com/4164-1", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://usn.ubuntu.com/4164-1" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1770768", "reference_id": "1770768", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1770768" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2019/11/17/2", "reference_id": "2", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2019/11/17/2" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxslt/commit/2232473733b7313d67de8836ea3b29eec6e8e285", "reference_id": "2232473733b7313d67de8836ea3b29eec6e8e285", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/" } ], "url": "https://gitlab.gnome.org/GNOME/libxslt/commit/2232473733b7313d67de8836ea3b29eec6e8e285" }, { "reference_url": "https://usn.ubuntu.com/4164-1/", "reference_id": "4164-1", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/" } ], "url": "https://usn.ubuntu.com/4164-1/" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=942646", "reference_id": "942646", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=942646" }, { "reference_url": "https://security.archlinux.org/ASA-202002-3", "reference_id": "ASA-202002-3", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-202002-3" }, { "reference_url": "https://security.archlinux.org/AVG-1092", "reference_id": "AVG-1092", "reference_type": "", "scores": [ { "value": "Critical", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1092" }, { "reference_url": "https://www.oracle.com/security-alerts/cpuapr2020.html", "reference_id": "cpuapr2020.html", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/" } ], "url": "https://www.oracle.com/security-alerts/cpuapr2020.html" }, { "reference_url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15746", "reference_id": "detail?id=15746", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/" } ], "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15746" }, { "reference_url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15768", "reference_id": "detail?id=15768", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/" } ], "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15768" }, { "reference_url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15914", "reference_id": "detail?id=15914", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/" } ], "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15914" }, { "reference_url": "https://github.com/advisories/GHSA-242x-7cm6-4w8j", "reference_id": "GHSA-242x-7cm6-4w8j", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-242x-7cm6-4w8j" }, { "reference_url": "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00010.html", "reference_id": "msg00010.html", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/" } ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00010.html" }, { "reference_url": "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html", "reference_id": "msg00015.html", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/" } ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html" }, { "reference_url": "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html", "reference_id": "msg00025.html", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/" } ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00037.html", "reference_id": "msg00037.html", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/" } ], "url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00037.html" }, { "reference_url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html", "reference_id": "msg00062.html", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/" } ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20191031-0004/", "reference_id": "ntap-20191031-0004", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/" } ], "url": "https://security.netapp.com/advisory/ntap-20191031-0004/" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20200416-0004/", "reference_id": "ntap-20200416-0004", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/" } ], "url": "https://security.netapp.com/advisory/ntap-20200416-0004/" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:0514", "reference_id": "RHSA-2020:0514", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/" } ], "url": "https://access.redhat.com/errata/RHSA-2020:0514" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:4005", "reference_id": "RHSA-2020:4005", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2020:4005" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:4464", "reference_id": "RHSA-2020:4464", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2020:4464" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/384510?format=api", "purl": "pkg:gem/nokogiri@1.10.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-18br-sw9t-9ue7" }, { "vulnerability": "VCID-2577-3bpb-pkgr" }, { "vulnerability": "VCID-2vtx-kt21-wuac" }, { "vulnerability": "VCID-3kej-ecyc-2ka6" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-ahe3-n9yg-sqgq" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-g7g7-vevx-hkej" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-hwva-pek4-5fb7" }, { "vulnerability": "VCID-kqcu-jg4b-ykcd" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-sn7m-5bry-13fp" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-x37v-jdmd-wbes" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-yr3x-bvad-mfcc" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.10.5" } ], "aliases": [ "CVE-2019-18197", "GHSA-242x-7cm6-4w8j" ], "risk_score": 4.5, "exploitability": "0.5", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-bgqs-y35v-vuae" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/362125?format=api", "vulnerability_id": "VCID-cnnd-sgk1-8qcu", "summary": "Vulnerabilities in libxml2\nThe version of libxml2 packaged with Nokogiri contains several vulnerabilities. Nokogiri has mitigated these issues by upgrading to libxml It was discovered that a type confusion error existed in libxml2. An attacker could use this to specially construct XML data that could cause a denial of service or possibly execute arbitrary code. (CVE-2017-0663) It was discovered that libxml2 did not properly validate parsed entity references. An attacker could use this to specially construct XML data that could expose sensitive information. (CVE-2017-7375) It was discovered that a buffer overflow existed in libxml2 when handling HTTP redirects. An attacker could use this to specially construct XML data that could cause a denial of service or possibly execute arbitrary code. (CVE-2017-7376) Marcel Böhme and Van-Thuan Pham discovered a buffer overflow in libxml2 when handling elements. An attacker could use this to specially construct XML data that could cause a denial of service or possibly execute arbitrary code. (CVE-2017-9047) Marcel Böhme and Van-Thuan Pham discovered a buffer overread in libxml2 when handling elements. An attacker could use this to specially construct XML data that could cause a denial of service. (CVE-2017-9048) Marcel Böhme and Van-Thuan Pham discovered multiple buffer overreads in libxml2 when handling parameter-entity references. An attacker could use these to specially construct XML data that could cause a denial of service. (CVE-2017-9049, CVE-2017-9050)", "references": [ { "reference_url": "https://github.com/sparklemotion/nokogiri/issues/1673", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/sparklemotion/nokogiri/issues/1673" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/13035?format=api", "purl": "pkg:gem/nokogiri@1.8.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-18br-sw9t-9ue7" }, { "vulnerability": "VCID-2577-3bpb-pkgr" }, { "vulnerability": "VCID-2vtx-kt21-wuac" }, { "vulnerability": "VCID-3kej-ecyc-2ka6" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-4kgk-drcy-4beq" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-ahe3-n9yg-sqgq" }, { "vulnerability": "VCID-ahte-mbyn-2fh6" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-bgqs-y35v-vuae" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-eqeg-fdfg-vyag" }, { "vulnerability": "VCID-g7g7-vevx-hkej" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-hwva-pek4-5fb7" }, { "vulnerability": "VCID-kqcu-jg4b-ykcd" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-ngg9-hp6h-sqfz" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-nt7b-her7-z3g8" }, { "vulnerability": "VCID-pk8z-1yjq-uqh5" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-qtu6-c9d8-1ydh" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-sn7m-5bry-13fp" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-v77z-t5z4-93cq" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-x37v-jdmd-wbes" }, { "vulnerability": "VCID-x3bk-gdmn-xyhu" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-yr3x-bvad-mfcc" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.8.1" } ], "aliases": [ "USN-3424-1" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-cnnd-sgk1-8qcu" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/12379?format=api", "vulnerability_id": "VCID-dbue-58uu-ybaz", "summary": "", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-40304.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-40304.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-40304", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00219", "scoring_system": "epss", "scoring_elements": "0.44755", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00219", "scoring_system": "epss", "scoring_elements": "0.446", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00219", "scoring_system": "epss", "scoring_elements": "0.44752", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00219", "scoring_system": "epss", "scoring_elements": "0.44768", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-40304" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40303", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40303" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40304", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40304" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://nokogiri.org/CHANGELOG.html#1139-2022-10-18", "reference_id": "", "reference_type": "", "scores": [], "url": "https://nokogiri.org/CHANGELOG.html#1139-2022-10-18" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1022225", "reference_id": "1022225", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1022225" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/1b41ec4e9433b05bb0376be4725804c54ef1d80b", "reference_id": "1b41ec4e9433b05bb0376be4725804c54ef1d80b", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-28T19:47:33Z/" } ], "url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/1b41ec4e9433b05bb0376be4725804c54ef1d80b" }, { "reference_url": "http://seclists.org/fulldisclosure/2022/Dec/21", "reference_id": "21", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-28T19:47:33Z/" } ], "url": "http://seclists.org/fulldisclosure/2022/Dec/21" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136288", "reference_id": "2136288", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136288" }, { "reference_url": "http://seclists.org/fulldisclosure/2022/Dec/24", "reference_id": "24", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-28T19:47:33Z/" } ], "url": "http://seclists.org/fulldisclosure/2022/Dec/24" }, { "reference_url": "http://seclists.org/fulldisclosure/2022/Dec/25", "reference_id": "25", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-28T19:47:33Z/" } ], "url": "http://seclists.org/fulldisclosure/2022/Dec/25" }, { "reference_url": "http://seclists.org/fulldisclosure/2022/Dec/26", "reference_id": "26", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-28T19:47:33Z/" } ], "url": "http://seclists.org/fulldisclosure/2022/Dec/26" }, { "reference_url": "http://seclists.org/fulldisclosure/2022/Dec/27", "reference_id": "27", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-28T19:47:33Z/" } ], "url": "http://seclists.org/fulldisclosure/2022/Dec/27" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40304", "reference_id": "CVE-2022-40304", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40304" }, { "reference_url": "https://security.gentoo.org/glsa/202210-39", "reference_id": "GLSA-202210-39", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202210-39" }, { "reference_url": "https://support.apple.com/kb/HT213531", "reference_id": "HT213531", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-28T19:47:33Z/" } ], "url": "https://support.apple.com/kb/HT213531" }, { "reference_url": "https://support.apple.com/kb/HT213533", "reference_id": "HT213533", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-28T19:47:33Z/" } ], "url": "https://support.apple.com/kb/HT213533" }, { "reference_url": "https://support.apple.com/kb/HT213534", "reference_id": "HT213534", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-28T19:47:33Z/" } ], "url": "https://support.apple.com/kb/HT213534" }, { "reference_url": "https://support.apple.com/kb/HT213535", "reference_id": "HT213535", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-28T19:47:33Z/" } ], "url": "https://support.apple.com/kb/HT213535" }, { "reference_url": "https://support.apple.com/kb/HT213536", "reference_id": "HT213536", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-28T19:47:33Z/" } ], "url": "https://support.apple.com/kb/HT213536" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20221209-0003/", "reference_id": "ntap-20221209-0003", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-28T19:47:33Z/" } ], "url": "https://security.netapp.com/advisory/ntap-20221209-0003/" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8841", "reference_id": "RHSA-2022:8841", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8841" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0173", "reference_id": "RHSA-2023:0173", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0173" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0338", "reference_id": "RHSA-2023:0338", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0338" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:0413", "reference_id": "RHSA-2024:0413", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:0413" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/-/tags", "reference_id": "tags", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-28T19:47:33Z/" } ], "url": "https://gitlab.gnome.org/GNOME/libxml2/-/tags" }, { "reference_url": "https://usn.ubuntu.com/5760-1/", "reference_id": "USN-5760-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5760-1/" }, { "reference_url": "https://usn.ubuntu.com/5760-2/", "reference_id": "USN-5760-2", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5760-2/" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/-/tags/v2.10.3", "reference_id": "v2.10.3", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-28T19:47:33Z/" } ], "url": "https://gitlab.gnome.org/GNOME/libxml2/-/tags/v2.10.3" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/27390?format=api", "purl": "pkg:gem/nokogiri@1.13.9", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-z2bq-warv-47c1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.13.9" } ], "aliases": [ "CVE-2022-40304" ], "risk_score": 3.5, "exploitability": "0.5", "weighted_severity": "7.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-dbue-58uu-ybaz" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/359439?format=api", "vulnerability_id": "VCID-df5z-dpbb-r7cv", "summary": "Update packaged libxml2 to v2.10.4 to resolve multiple CVEs\n### Summary\n\nNokogiri v1.14.3 upgrades the packaged version of its dependency libxml2 to\n[v2.10.4](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.10.4) from v2.10.3.\n\nlibxml2 v2.10.4 addresses the following known vulnerabilities:\n\n- [CVE-2023-29469](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29469): Hashing of\n empty dict strings isn't deterministic\n- [CVE-2023-28484](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28484): Fix null deref\n in xmlSchemaFixupComplexType\n- Schemas: Fix null-pointer-deref in xmlSchemaCheckCOSSTDerivedOK\n\nPlease note that this advisory only applies to the CRuby implementation of Nokogiri `< 1.14.3`,\nand only if the _packaged_ libraries are being used. If you've overridden defaults at installation\ntime to use _system_ libraries instead of packaged libraries, you should instead pay attention to\nyour distro's `libxml2` release announcements.\n\n\n### Mitigation\n\nUpgrade to Nokogiri `>= 1.14.3`.\n\nUsers who are unable to upgrade Nokogiri may also choose a more complicated mitigation: compile\nand link Nokogiri against external libraries libxml2 `>= 2.10.4` which will also address these\nsame issues.\n\n\n### Impact\n\nNo public information has yet been published about the security-related issues other than the\nupstream commits. Examination of those changesets indicate that the more serious issues relate to\nlibxml2 dereferencing NULL pointers and potentially segfaulting while parsing untrusted inputs.\n\nThe commits can be examined at:\n\n- [\\[CVE-2023-29469\\] Hashing of empty dict strings isn't deterministic (09a2dd45)](https://gitlab.gnome.org/GNOME/libxml2/-/commit/09a2dd453007f9c7205274623acdd73747c22d64)\n- [\\[CVE-2023-28484\\] Fix null deref in xmlSchemaFixupComplexType (647e072e)](https://gitlab.gnome.org/GNOME/libxml2/-/commit/647e072ea0a2f12687fa05c172f4c4713fdb0c4f)\n- [schemas: Fix null-pointer-deref in xmlSchemaCheckCOSSTDerivedOK (4c6922f7)](https://gitlab.gnome.org/GNOME/libxml2/-/commit/4c6922f763ad958c48ff66f82823ae21f2e92ee6)", "references": [ { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28484", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28484" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29469", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29469" }, { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-pxvg-2qj5-37jq", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-pxvg-2qj5-37jq" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/09a2dd453007f9c7205274623acdd73747c22d64", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/09a2dd453007f9c7205274623acdd73747c22d64" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/4c6922f763ad958c48ff66f82823ae21f2e92ee6", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/4c6922f763ad958c48ff66f82823ae21f2e92ee6" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/647e072ea0a2f12687fa05c172f4c4713fdb0c4f", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/647e072ea0a2f12687fa05c172f4c4713fdb0c4f" }, { "reference_url": "https://github.com/advisories/GHSA-pxvg-2qj5-37jq", "reference_id": "GHSA-pxvg-2qj5-37jq", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-pxvg-2qj5-37jq" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/379347?format=api", "purl": "pkg:gem/nokogiri@1.14.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-z2bq-warv-47c1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.14.3" } ], "aliases": [ "GHSA-pxvg-2qj5-37jq", "GMS-2023-1115" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-df5z-dpbb-r7cv" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/361661?format=api", "vulnerability_id": "VCID-djuu-6gdw-cuav", "summary": "Multiple vulnerabilities in libxml2, libxslt\nThe vendored libxml2 and libxslt libraries have multiple vulnerabilities: CVE-2015-1819 CVE-2015-7941_1 CVE-2015-7941_2 CVE-2015-7942 CVE-2015-7942-2 CVE-2015-8035 CVE-2015-7995", "references": [ { "reference_url": "https://github.com/sparklemotion/nokogiri/blob/master/CHANGELOG.rdoc#167rc4--2015-11-22", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/sparklemotion/nokogiri/blob/master/CHANGELOG.rdoc#167rc4--2015-11-22" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/blob/v1.6.6.x/CHANGELOG.rdoc#1663--2015-11-16", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/sparklemotion/nokogiri/blob/v1.6.6.x/CHANGELOG.rdoc#1663--2015-11-16" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/commit/ac6106f1e641d50b27752c52b355e01d03ae8829", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/sparklemotion/nokogiri/commit/ac6106f1e641d50b27752c52b355e01d03ae8829" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/commit/ee52b7be5b47e1029af98f6b7eb6df7fc5ffd359", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/sparklemotion/nokogiri/commit/ee52b7be5b47e1029af98f6b7eb6df7fc5ffd359" }, { "reference_url": "https://groups.google.com/forum/#!topic/nokogiri-talk/gEpHWo2xLCE", "reference_id": "", "reference_type": "", "scores": [], "url": "https://groups.google.com/forum/#!topic/nokogiri-talk/gEpHWo2xLCE" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/13488?format=api", "purl": "pkg:gem/nokogiri@1.6.6.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14kb-seu7-9bcc" }, { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-18br-sw9t-9ue7" }, { "vulnerability": "VCID-2577-3bpb-pkgr" }, { "vulnerability": "VCID-2vtx-kt21-wuac" }, { "vulnerability": "VCID-3kej-ecyc-2ka6" }, { "vulnerability": "VCID-3z3h-7s7d-zbaz" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-4e3h-nwws-abh1" }, { "vulnerability": "VCID-4kgk-drcy-4beq" }, { "vulnerability": "VCID-7cqg-h2ws-hfh1" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-ahe3-n9yg-sqgq" }, { "vulnerability": "VCID-ahte-mbyn-2fh6" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-bgqs-y35v-vuae" }, { "vulnerability": "VCID-cnnd-sgk1-8qcu" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-eqeg-fdfg-vyag" }, { "vulnerability": "VCID-g7g7-vevx-hkej" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-hwva-pek4-5fb7" }, { "vulnerability": "VCID-jf45-a4cp-v7a7" }, { "vulnerability": "VCID-kqcu-jg4b-ykcd" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-mc8f-xxy6-u7f7" }, { "vulnerability": "VCID-ngg9-hp6h-sqfz" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-nt7b-her7-z3g8" }, { "vulnerability": "VCID-pk8z-1yjq-uqh5" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-qtu6-c9d8-1ydh" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-sn7m-5bry-13fp" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-u51x-afpr-a7gt" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-v77z-t5z4-93cq" }, { "vulnerability": "VCID-va8n-ev2d-53a2" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-x37v-jdmd-wbes" }, { "vulnerability": "VCID-x3bk-gdmn-xyhu" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-yr3x-bvad-mfcc" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zwze-jyd4-6qhm" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.6.3" }, { "url": "http://public2.vulnerablecode.io/api/packages/388436?format=api", "purl": "pkg:gem/nokogiri@1.6.7.rc4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14kb-seu7-9bcc" }, { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-18br-sw9t-9ue7" }, { "vulnerability": "VCID-2577-3bpb-pkgr" }, { "vulnerability": "VCID-2vtx-kt21-wuac" }, { "vulnerability": "VCID-3kej-ecyc-2ka6" }, { "vulnerability": "VCID-3z3h-7s7d-zbaz" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-4kgk-drcy-4beq" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-ahe3-n9yg-sqgq" }, { "vulnerability": "VCID-ahte-mbyn-2fh6" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-bgqs-y35v-vuae" }, { "vulnerability": "VCID-cnnd-sgk1-8qcu" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-eqeg-fdfg-vyag" }, { "vulnerability": "VCID-g7g7-vevx-hkej" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-hwva-pek4-5fb7" }, { "vulnerability": "VCID-jf45-a4cp-v7a7" }, { "vulnerability": "VCID-kqcu-jg4b-ykcd" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-mc8f-xxy6-u7f7" }, { "vulnerability": "VCID-ngg9-hp6h-sqfz" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-nt7b-her7-z3g8" }, { "vulnerability": "VCID-pk8z-1yjq-uqh5" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-qtu6-c9d8-1ydh" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-sn7m-5bry-13fp" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-u51x-afpr-a7gt" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-v77z-t5z4-93cq" }, { "vulnerability": "VCID-va8n-ev2d-53a2" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-x37v-jdmd-wbes" }, { "vulnerability": "VCID-x3bk-gdmn-xyhu" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-yr3x-bvad-mfcc" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zwze-jyd4-6qhm" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.7.rc4" } ], "aliases": [ "GMS-2015-42" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-djuu-6gdw-cuav" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/7116?format=api", "vulnerability_id": "VCID-eqeg-fdfg-vyag", "summary": "", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2019-5477", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.09316", "scoring_system": "epss", "scoring_elements": "0.92958", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.09316", "scoring_system": "epss", "scoring_elements": "0.92961", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.09316", "scoring_system": "epss", "scoring_elements": "0.92935", "published_at": "2026-06-11T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-5477" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5477", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5477" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/commit/5d30128343573a9428c86efc758ba2c66e9f12dc", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/commit/5d30128343573a9428c86efc758ba2c66e9f12dc" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/issues/1915", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/issues/1915" }, { "reference_url": "https://github.com/tenderlove/rexical/blob/master/CHANGELOG.rdoc", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/tenderlove/rexical/blob/master/CHANGELOG.rdoc" }, { "reference_url": "https://github.com/tenderlove/rexical/commit/a652474dbc66be350055db3e8f9b3a7b3fd75926", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/tenderlove/rexical/commit/a652474dbc66be350055db3e8f9b3a7b3fd75926" }, { "reference_url": "https://hackerone.com/reports/650835", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://hackerone.com/reports/650835" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2019/09/msg00027.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2019/09/msg00027.html" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00018.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00018.html" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00019.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00019.html" }, { "reference_url": "https://usn.ubuntu.com/4175-1", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://usn.ubuntu.com/4175-1" }, { "reference_url": "https://usn.ubuntu.com/4175-1/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/4175-1/" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=934802", "reference_id": "934802", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=934802" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=940905", "reference_id": "940905", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=940905" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5477", "reference_id": "CVE-2019-5477", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5477" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2019-5477.yml", "reference_id": "CVE-2019-5477.YML", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2019-5477.yml" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rexical/CVE-2019-5477.yml", "reference_id": "CVE-2019-5477.YML", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rexical/CVE-2019-5477.yml" }, { "reference_url": "https://github.com/advisories/GHSA-cr5j-953j-xw5p", "reference_id": "GHSA-cr5j-953j-xw5p", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-cr5j-953j-xw5p" }, { "reference_url": "https://security.gentoo.org/glsa/202006-05", "reference_id": "GLSA-202006-05", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.gentoo.org/glsa/202006-05" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/15535?format=api", "purl": "pkg:gem/nokogiri@1.10.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-18br-sw9t-9ue7" }, { "vulnerability": "VCID-2577-3bpb-pkgr" }, { "vulnerability": "VCID-2vtx-kt21-wuac" }, { "vulnerability": "VCID-3kej-ecyc-2ka6" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-ahe3-n9yg-sqgq" }, { "vulnerability": "VCID-ahte-mbyn-2fh6" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-bgqs-y35v-vuae" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-g7g7-vevx-hkej" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-hwva-pek4-5fb7" }, { "vulnerability": "VCID-kqcu-jg4b-ykcd" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-sn7m-5bry-13fp" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-x37v-jdmd-wbes" }, { "vulnerability": "VCID-x3bk-gdmn-xyhu" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-yr3x-bvad-mfcc" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.10.4" } ], "aliases": [ "CVE-2019-5477", "GHSA-cr5j-953j-xw5p" ], "risk_score": 4.5, "exploitability": "0.5", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-eqeg-fdfg-vyag" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/8745?format=api", "vulnerability_id": "VCID-g7g7-vevx-hkej", "summary": "", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-7595.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-7595.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2020-7595", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00476", "scoring_system": "epss", "scoring_elements": "0.65459", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.00476", "scoring_system": "epss", "scoring_elements": "0.65448", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00476", "scoring_system": "epss", "scoring_elements": "0.65458", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00476", "scoring_system": "epss", "scoring_elements": "0.65347", "published_at": "2026-06-11T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-7595" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7595", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7595" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/issues/1992", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/issues/1992" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/545SPOI3ZPPNPX4TFRIVE4JVRTJRKULL", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/545SPOI3ZPPNPX4TFRIVE4JVRTJRKULL" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/545SPOI3ZPPNPX4TFRIVE4JVRTJRKULL/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/545SPOI3ZPPNPX4TFRIVE4JVRTJRKULL/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH/" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20200702-0005", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20200702-0005" }, { "reference_url": "https://usn.ubuntu.com/4274-1", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://usn.ubuntu.com/4274-1" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/commit/0e1a49c89076", "reference_id": "0e1a49c89076", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/" } ], "url": "https://gitlab.gnome.org/GNOME/libxml2/commit/0e1a49c89076" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1799786", "reference_id": "1799786", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1799786" }, { "reference_url": "https://security.gentoo.org/glsa/202010-04", "reference_id": "202010-04", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/" } ], "url": "https://security.gentoo.org/glsa/202010-04" }, { "reference_url": "https://usn.ubuntu.com/4274-1/", "reference_id": "4274-1", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/" } ], "url": "https://usn.ubuntu.com/4274-1/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/545SPOI3ZPPNPX4TFRIVE4JVRTJRKULL/", "reference_id": "545SPOI3ZPPNPX4TFRIVE4JVRTJRKULL", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/545SPOI3ZPPNPX4TFRIVE4JVRTJRKULL/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI/", "reference_id": "5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI/" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=949582", "reference_id": "949582", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=949582" }, { "reference_url": "https://security.archlinux.org/ASA-202011-15", "reference_id": "ASA-202011-15", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-202011-15" }, { "reference_url": "https://security.archlinux.org/AVG-1263", "reference_id": "AVG-1263", "reference_type": "", "scores": [ { "value": "Medium", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1263" }, { "reference_url": "https://www.oracle.com/security-alerts/cpuapr2022.html", "reference_id": "cpuapr2022.html", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/" } ], "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" }, { "reference_url": "https://www.oracle.com/security-alerts/cpujul2020.html", "reference_id": "cpujul2020.html", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/" } ], "url": "https://www.oracle.com/security-alerts/cpujul2020.html" }, { "reference_url": "https://www.oracle.com/security-alerts/cpujul2022.html", "reference_id": "cpujul2022.html", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/" } ], "url": "https://www.oracle.com/security-alerts/cpujul2022.html" }, { "reference_url": "https://www.oracle.com/security-alerts/cpuoct2021.html", "reference_id": "cpuoct2021.html", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/" } ], "url": "https://www.oracle.com/security-alerts/cpuoct2021.html" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7595", "reference_id": "CVE-2020-7595", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7595" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2020-7595.yml", "reference_id": "CVE-2020-7595.YML", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2020-7595.yml" }, { "reference_url": "https://github.com/advisories/GHSA-7553-jr98-vx47", "reference_id": "GHSA-7553-jr98-vx47", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-7553-jr98-vx47" }, { "reference_url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-103-08", "reference_id": "icsa-21-103-08", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/" } ], "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-103-08" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH/", "reference_id": "JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH/" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html", "reference_id": "msg00009.html", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/" } ], "url": "https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html" }, { "reference_url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00047.html", "reference_id": "msg00047.html", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/" } ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00047.html" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20200702-0005/", "reference_id": "ntap-20200702-0005", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/" } ], "url": "https://security.netapp.com/advisory/ntap-20200702-0005/" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:2644", "reference_id": "RHSA-2020:2644", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2020:2644" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:2646", "reference_id": "RHSA-2020:2646", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2020:2646" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:3996", "reference_id": "RHSA-2020:3996", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2020:3996" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:4479", "reference_id": "RHSA-2020:4479", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2020:4479" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:0949", "reference_id": "RHSA-2021:0949", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:0949" }, { "reference_url": "https://cert-portal.siemens.com/productcert/pdf/ssa-292794.pdf", "reference_id": "ssa-292794.pdf", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/" } ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-292794.pdf" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/16191?format=api", "purl": "pkg:gem/nokogiri@1.10.8", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-18br-sw9t-9ue7" }, { "vulnerability": "VCID-2577-3bpb-pkgr" }, { "vulnerability": "VCID-2vtx-kt21-wuac" }, { "vulnerability": "VCID-3kej-ecyc-2ka6" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-ahe3-n9yg-sqgq" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-hwva-pek4-5fb7" }, { "vulnerability": "VCID-kqcu-jg4b-ykcd" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-sn7m-5bry-13fp" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-x37v-jdmd-wbes" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-yr3x-bvad-mfcc" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.10.8" } ], "aliases": [ "CVE-2020-7595", "GHSA-7553-jr98-vx47" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-g7g7-vevx-hkej" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/11849?format=api", "vulnerability_id": "VCID-g8h5-nbxj-y7fe", "summary": "", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-29181.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-29181.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-29181", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.04183", "scoring_system": "epss", "scoring_elements": "0.88999", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.04183", "scoring_system": "epss", "scoring_elements": "0.89", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.04183", "scoring_system": "epss", "scoring_elements": "0.88956", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.04183", "scoring_system": "epss", "scoring_elements": "0.88993", "published_at": "2026-06-12T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-29181" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29181", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29181" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2022-29181.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2022-29181.yml" }, { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29181", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29181" }, { "reference_url": "https://support.apple.com/kb/HT213532", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://support.apple.com/kb/HT213532" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2088684", "reference_id": "2088684", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2088684" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/commit/83cc451c3f29df397caa890afc3b714eae6ab8f7", "reference_id": "83cc451c3f29df397caa890afc3b714eae6ab8f7", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-22T15:41:19Z/" } ], "url": "https://github.com/sparklemotion/nokogiri/commit/83cc451c3f29df397caa890afc3b714eae6ab8f7" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/commit/db05ba9a1bd4b90aa6c76742cf6102a7c7297267", "reference_id": "db05ba9a1bd4b90aa6c76742cf6102a7c7297267", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-22T15:41:19Z/" } ], "url": "https://github.com/sparklemotion/nokogiri/commit/db05ba9a1bd4b90aa6c76742cf6102a7c7297267" }, { "reference_url": "https://github.com/advisories/GHSA-xh29-r2w5-wx8m", "reference_id": "GHSA-xh29-r2w5-wx8m", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-xh29-r2w5-wx8m" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xh29-r2w5-wx8m", "reference_id": "GHSA-xh29-r2w5-wx8m", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-22T15:41:19Z/" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xh29-r2w5-wx8m" }, { "reference_url": "https://securitylab.github.com/advisories/GHSL-2022-031_GHSL-2022-032_Nokogiri", "reference_id": "GHSL-2022-031_GHSL-2022-032_Nokogiri", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-22T15:41:19Z/" } ], "url": "https://securitylab.github.com/advisories/GHSL-2022-031_GHSL-2022-032_Nokogiri" }, { "reference_url": "https://security.gentoo.org/glsa/202208-29", "reference_id": "GLSA-202208-29", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.gentoo.org/glsa/202208-29" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8506", "reference_id": "RHSA-2022:8506", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8506" }, { "reference_url": "https://usn.ubuntu.com/7659-1/", "reference_id": "USN-7659-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7659-1/" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.6", "reference_id": "v1.13.6", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-22T15:41:19Z/" } ], "url": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.6" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/386593?format=api", "purl": "pkg:gem/nokogiri@1.13.6", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.13.6" } ], "aliases": [ "CVE-2022-29181", "GHSA-xh29-r2w5-wx8m" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-g8h5-nbxj-y7fe" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/211732?format=api", "vulnerability_id": "VCID-gbwe-1wq8-83bf", "summary": "Duplicate Advisory: Use-after-free in libxml2 via Nokogiri::XML::Reader", "references": [ { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/advisories/GHSA-vcc3-rw6f-jv97", "reference_id": "GHSA-vcc3-rw6f-jv97", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-vcc3-rw6f-jv97" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xc9x-jj77-9p9j", "reference_id": "GHSA-xc9x-jj77-9p9j", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xc9x-jj77-9p9j" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-xc9x-jj77-9p9j.yml", "reference_id": "GHSA-xc9x-jj77-9p9j.yml", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-xc9x-jj77-9p9j.yml" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/28756?format=api", "purl": "pkg:gem/nokogiri@1.15.6", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-z2bq-warv-47c1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.15.6" }, { "url": "http://public2.vulnerablecode.io/api/packages/28755?format=api", "purl": "pkg:gem/nokogiri@1.16.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-z2bq-warv-47c1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.16.2" } ], "aliases": [ "GHSA-vcc3-rw6f-jv97" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-gbwe-1wq8-83bf" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/8297?format=api", "vulnerability_id": "VCID-hwva-pek4-5fb7", "summary": "", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-26247.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-26247.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2020-26247", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00259", "scoring_system": "epss", "scoring_elements": "0.49752", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00259", "scoring_system": "epss", "scoring_elements": "0.49615", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00259", "scoring_system": "epss", "scoring_elements": "0.49758", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00259", "scoring_system": "epss", "scoring_elements": "0.49771", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-26247" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26247", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26247" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2020-26247.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2020-26247.yml" }, { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md#v1110--2021-01-03", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md#v1110--2021-01-03" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/commit/9c87439d9afa14a365ff13e73adc809cb2c3d97b", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/commit/9c87439d9afa14a365ff13e73adc809cb2c3d97b" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.11.0.rc4", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.11.0.rc4" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vr8q-g5c7-m54m", "reference_id": "", "reference_type": "", "scores": [ { "value": "2.6", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vr8q-g5c7-m54m" }, { "reference_url": "https://hackerone.com/reports/747489", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://hackerone.com/reports/747489" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2021/06/msg00007.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2021/06/msg00007.html" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00018.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00018.html" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26247", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26247" }, { "reference_url": "https://rubygems.org/gems/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://rubygems.org/gems/nokogiri" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1912487", "reference_id": "1912487", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1912487" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978967", "reference_id": "978967", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978967" }, { "reference_url": "https://github.com/advisories/GHSA-vr8q-g5c7-m54m", "reference_id": "GHSA-vr8q-g5c7-m54m", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-vr8q-g5c7-m54m" }, { "reference_url": "https://security.gentoo.org/glsa/202208-29", "reference_id": "GLSA-202208-29", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.gentoo.org/glsa/202208-29" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:4702", "reference_id": "RHSA-2021:4702", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:4702" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:5191", "reference_id": "RHSA-2021:5191", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:5191" }, { "reference_url": "https://usn.ubuntu.com/7659-1/", "reference_id": "USN-7659-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7659-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/382123?format=api", "purl": "pkg:gem/nokogiri@1.11.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-18br-sw9t-9ue7" }, { "vulnerability": "VCID-2577-3bpb-pkgr" }, { "vulnerability": "VCID-2vtx-kt21-wuac" }, { "vulnerability": "VCID-3kej-ecyc-2ka6" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-ahe3-n9yg-sqgq" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-sn7m-5bry-13fp" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-x37v-jdmd-wbes" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-yr3x-bvad-mfcc" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.11.0" } ], "aliases": [ "CVE-2020-26247", "GHSA-vr8q-g5c7-m54m" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-hwva-pek4-5fb7" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/1441?format=api", "vulnerability_id": "VCID-jf45-a4cp-v7a7", "summary": "", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-4658.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-4658.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2016-4658", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.15391", "scoring_system": "epss", "scoring_elements": "0.94823", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.15391", "scoring_system": "epss", "scoring_elements": "0.94798", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.15391", "scoring_system": "epss", "scoring_elements": "0.94816", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.15391", "scoring_system": "epss", "scoring_elements": "0.94822", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2016-4658" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4658", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4658" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5131", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5131" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv2", "scoring_elements": "AV:N/AC:H/Au:N/C:P/I:P/A:P" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://git.gnome.org/browse/libxml2/commit/?id=c1d1f7121194036608bf555f08d3062a36fd344b", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://git.gnome.org/browse/libxml2/commit/?id=c1d1f7121194036608bf555f08d3062a36fd344b" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/issues/1615", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/issues/1615" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1384424", "reference_id": "1384424", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1384424" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=840553", "reference_id": "840553", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=840553" }, { "reference_url": "https://security.archlinux.org/ASA-201611-2", "reference_id": "ASA-201611-2", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-201611-2" }, { "reference_url": "https://security.archlinux.org/AVG-56", "reference_id": "AVG-56", "reference_type": "", "scores": [ { "value": "Critical", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-56" }, { "reference_url": "http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-4448.html", "reference_id": "CVE-2016-4448.HTML", "reference_type": "", "scores": [], "url": "http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-4448.html" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4658", "reference_id": "CVE-2016-4658", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4658" }, { "reference_url": "http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-4658.html", "reference_id": "CVE-2016-4658.HTML", "reference_type": "", "scores": [], "url": "http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-4658.html" }, { "reference_url": "http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-5131.html", "reference_id": "CVE-2016-5131.HTML", "reference_type": "", "scores": [], "url": "http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-5131.html" }, { "reference_url": "https://github.com/advisories/GHSA-fr52-4hqw-p27f", "reference_id": "GHSA-fr52-4hqw-p27f", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-fr52-4hqw-p27f" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:3810", "reference_id": "RHSA-2021:3810", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:3810" }, { "reference_url": "https://usn.ubuntu.com/3235-1/", "reference_id": "USN-3235-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/3235-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/13533?format=api", "purl": "pkg:gem/nokogiri@1.7.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14kb-seu7-9bcc" }, { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-18br-sw9t-9ue7" }, { "vulnerability": "VCID-2577-3bpb-pkgr" }, { "vulnerability": "VCID-2vtx-kt21-wuac" }, { "vulnerability": "VCID-3kej-ecyc-2ka6" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-4kgk-drcy-4beq" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-ahe3-n9yg-sqgq" }, { "vulnerability": "VCID-ahte-mbyn-2fh6" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-bgqs-y35v-vuae" }, { "vulnerability": "VCID-cnnd-sgk1-8qcu" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-eqeg-fdfg-vyag" }, { "vulnerability": "VCID-g7g7-vevx-hkej" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-hwva-pek4-5fb7" }, { "vulnerability": "VCID-kqcu-jg4b-ykcd" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-ngg9-hp6h-sqfz" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-nt7b-her7-z3g8" }, { "vulnerability": "VCID-pk8z-1yjq-uqh5" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-qtu6-c9d8-1ydh" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-sn7m-5bry-13fp" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-v77z-t5z4-93cq" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-x37v-jdmd-wbes" }, { "vulnerability": "VCID-x3bk-gdmn-xyhu" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-yr3x-bvad-mfcc" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.7.1" } ], "aliases": [ "CVE-2016-4658", "GHSA-fr52-4hqw-p27f" ], "risk_score": 4.5, "exploitability": "0.5", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-jf45-a4cp-v7a7" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/8172?format=api", "vulnerability_id": "VCID-kqcu-jg4b-ykcd", "summary": "", "references": [ { "reference_url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00036.html", "reference_id": "", "reference_type": "", "scores": [], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00036.html" }, { "reference_url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00061.html", "reference_id": "", "reference_type": "", "scores": [], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00061.html" }, { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-24977.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-24977.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2020-24977", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00586", "scoring_system": "epss", "scoring_elements": "0.69655", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00586", "scoring_system": "epss", "scoring_elements": "0.69668", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.00586", "scoring_system": "epss", "scoring_elements": "0.69667", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00697", "scoring_system": "epss", "scoring_elements": "0.72406", "published_at": "2026-06-11T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-24977" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24977", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24977" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/50f06b3efb638efb0abd95dc62dca05ae67882c2", "reference_id": "", "reference_type": "", "scores": [], "url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/50f06b3efb638efb0abd95dc62dca05ae67882c2" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/178", "reference_id": "", "reference_type": "", "scores": [], "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/178" }, { "reference_url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2NQ5GTDYOVH26PBCPYXXMGW5ZZXWMGZC/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2NQ5GTDYOVH26PBCPYXXMGW5ZZXWMGZC/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5KTUAGDLEHTH6HU66HBFAFTSQ3OKRAN3/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5KTUAGDLEHTH6HU66HBFAFTSQ3OKRAN3/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/674LQPJO2P2XTBTREFR5LOZMBTZ4PZAY/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/674LQPJO2P2XTBTREFR5LOZMBTZ4PZAY/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7KQXOHIE3MNY3VQXEN7LDQUJNIHOVHAW/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7KQXOHIE3MNY3VQXEN7LDQUJNIHOVHAW/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ENEHQIBMSI6TZVS35Y6I4FCTYUQDLJVP/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ENEHQIBMSI6TZVS35Y6I4FCTYUQDLJVP/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H3IQ7OQXBKWD3YP7HO6KCNOMLE5ZO2IR/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H3IQ7OQXBKWD3YP7HO6KCNOMLE5ZO2IR/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J3ICASXZI2UQYFJAOQWHSTNWGED3VXOE/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J3ICASXZI2UQYFJAOQWHSTNWGED3VXOE/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JCHXIWR5DHYO3RSO7RAHEC6VJKXD2EH2/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JCHXIWR5DHYO3RSO7RAHEC6VJKXD2EH2/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O7MEWYKIKMV2SKMGH4IDWVU3ZGJXBCPQ/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O7MEWYKIKMV2SKMGH4IDWVU3ZGJXBCPQ/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RIQAMBA2IJUTQG5VOP5LZVIZRNCKXHEQ/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RIQAMBA2IJUTQG5VOP5LZVIZRNCKXHEQ/" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20200924-0001/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://security.netapp.com/advisory/ntap-20200924-0001/" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1877788", "reference_id": "1877788", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1877788" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=969529", "reference_id": "969529", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=969529" }, { "reference_url": "https://security.archlinux.org/ASA-202011-15", "reference_id": "ASA-202011-15", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-202011-15" }, { "reference_url": "https://security.archlinux.org/AVG-1263", "reference_id": "AVG-1263", "reference_type": "", "scores": [ { "value": "Medium", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1263" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2020-24977", "reference_id": "CVE-2020-24977", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-24977" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:1597", "reference_id": "RHSA-2021:1597", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:1597" }, { "reference_url": "https://usn.ubuntu.com/4991-1/", "reference_id": "USN-4991-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/4991-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/23358?format=api", "purl": "pkg:gem/nokogiri@1.11.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-2vtx-kt21-wuac" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-ahe3-n9yg-sqgq" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-yr3x-bvad-mfcc" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.11.4" } ], "aliases": [ "CVE-2020-24977" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-kqcu-jg4b-ykcd" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/212597?format=api", "vulnerability_id": "VCID-m2bp-rxcw-myg9", "summary": "Nokogiri does not check the return value from xmlC14NExecute", "references": [ { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/advisories/GHSA-wx95-c6cv-8532", "reference_id": "GHSA-wx95-c6cv-8532", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-wx95-c6cv-8532" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-wx95-c6cv-8532", "reference_id": "GHSA-wx95-c6cv-8532", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-wx95-c6cv-8532" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/39371?format=api", "purl": "pkg:gem/nokogiri@1.19.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-w48v-grqb-u3gz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.19.1" } ], "aliases": [ "GHSA-wx95-c6cv-8532" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-m2bp-rxcw-myg9" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/208746?format=api", "vulnerability_id": "VCID-m3bc-ah2t-p3b4", "summary": "Out-of-bounds Write in zlib affects Nokogiri", "references": [ { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.4", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.4" }, { "reference_url": "https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ?utm_medium=email&utm_source=footer", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ?utm_medium=email&utm_source=footer" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2018-25032", "reference_id": "CVE-2018-25032", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-25032" }, { "reference_url": "https://github.com/advisories/GHSA-jc36-42cf-vqwj", "reference_id": "GHSA-jc36-42cf-vqwj", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-jc36-42cf-vqwj" }, { "reference_url": "https://github.com/advisories/GHSA-v6gp-9mmm-c6p5", "reference_id": "GHSA-v6gp-9mmm-c6p5", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-v6gp-9mmm-c6p5" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v6gp-9mmm-c6p5", "reference_id": "GHSA-v6gp-9mmm-c6p5", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v6gp-9mmm-c6p5" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/19854?format=api", "purl": "pkg:gem/nokogiri@1.13.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.13.4" } ], "aliases": [ "GHSA-v6gp-9mmm-c6p5", "GMS-2022-787" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-m3bc-ah2t-p3b4" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/3505?format=api", "vulnerability_id": "VCID-mc8f-xxy6-u7f7", "summary": "", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-5029.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-5029.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2017-5029", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.01232", "scoring_system": "epss", "scoring_elements": "0.79591", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.01232", "scoring_system": "epss", "scoring_elements": "0.79665", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.01232", "scoring_system": "epss", "scoring_elements": "0.79673", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.01232", "scoring_system": "epss", "scoring_elements": "0.79656", "published_at": "2026-06-12T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2017-5029" }, { "reference_url": "https://crbug.com/676623", "reference_id": "", "reference_type": "", "scores": [], "url": "https://crbug.com/676623" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5029", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5029" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5030", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5030" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5031", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5031" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5032", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5032" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5033", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5033" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5034", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5034" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5035", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5035" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5036", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5036" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5037", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5037" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5038", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5038" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5039", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5039" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5040", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5040" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5041", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5041" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5042", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5042" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5043", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5043" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5044", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5044" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5045", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5045" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5046", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5046" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.3", "scoring_system": "cvssv2", "scoring_elements": "AV:L/AC:M/Au:N/C:N/I:P/A:P" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://git.gnome.org/browse/libxslt/commit/?id=08ab2774b870de1c7b5a48693df75e8154addae5", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://git.gnome.org/browse/libxslt/commit/?id=08ab2774b870de1c7b5a48693df75e8154addae5" }, { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/issues/1634", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/issues/1634" }, { "reference_url": "https://ubuntu.com/security/notices/USN-3271-1", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://ubuntu.com/security/notices/USN-3271-1" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1431033", "reference_id": "1431033", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1431033" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=858546", "reference_id": "858546", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=858546" }, { "reference_url": "https://security.archlinux.org/ASA-201703-4", "reference_id": "ASA-201703-4", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-201703-4" }, { "reference_url": "https://security.archlinux.org/ASA-201703-5", "reference_id": "ASA-201703-5", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-201703-5" }, { "reference_url": "https://security.archlinux.org/AVG-195", "reference_id": "AVG-195", "reference_type": "", "scores": [ { "value": "Critical", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-195" }, { "reference_url": "https://security.archlinux.org/AVG-196", "reference_id": "AVG-196", "reference_type": "", "scores": [ { "value": "Critical", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-196" }, { "reference_url": "https://security.archlinux.org/AVG-197", "reference_id": "AVG-197", "reference_type": "", "scores": [ { "value": "Critical", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-197" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5029", "reference_id": "CVE-2017-5029", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5029" }, { "reference_url": "https://ubuntu.com/security/CVE-2017-5029", "reference_id": "CVE-2017-5029", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://ubuntu.com/security/CVE-2017-5029" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2017-5029.yml", "reference_id": "CVE-2017-5029.YML", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2017-5029.yml" }, { "reference_url": "https://github.com/advisories/GHSA-pf6m-fxpq-fg8v", "reference_id": "GHSA-pf6m-fxpq-fg8v", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-pf6m-fxpq-fg8v" }, { "reference_url": "https://security.gentoo.org/glsa/201804-01", "reference_id": "GLSA-201804-01", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/201804-01" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2017:0499", "reference_id": "RHSA-2017:0499", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2017:0499" }, { "reference_url": "https://usn.ubuntu.com/3236-1/", "reference_id": "USN-3236-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/3236-1/" }, { "reference_url": "https://usn.ubuntu.com/3271-1/", "reference_id": "USN-3271-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/3271-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/13533?format=api", "purl": "pkg:gem/nokogiri@1.7.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14kb-seu7-9bcc" }, { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-18br-sw9t-9ue7" }, { "vulnerability": "VCID-2577-3bpb-pkgr" }, { "vulnerability": "VCID-2vtx-kt21-wuac" }, { "vulnerability": "VCID-3kej-ecyc-2ka6" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-4kgk-drcy-4beq" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-ahe3-n9yg-sqgq" }, { "vulnerability": "VCID-ahte-mbyn-2fh6" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-bgqs-y35v-vuae" }, { "vulnerability": "VCID-cnnd-sgk1-8qcu" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-eqeg-fdfg-vyag" }, { "vulnerability": "VCID-g7g7-vevx-hkej" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-hwva-pek4-5fb7" }, { "vulnerability": "VCID-kqcu-jg4b-ykcd" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-ngg9-hp6h-sqfz" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-nt7b-her7-z3g8" }, { "vulnerability": "VCID-pk8z-1yjq-uqh5" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-qtu6-c9d8-1ydh" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-sn7m-5bry-13fp" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-v77z-t5z4-93cq" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-x37v-jdmd-wbes" }, { "vulnerability": "VCID-x3bk-gdmn-xyhu" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-yr3x-bvad-mfcc" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.7.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/13452?format=api", "purl": "pkg:gem/nokogiri@1.7.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14kb-seu7-9bcc" }, { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-18br-sw9t-9ue7" }, { "vulnerability": "VCID-2577-3bpb-pkgr" }, { "vulnerability": "VCID-2vtx-kt21-wuac" }, { "vulnerability": "VCID-3kej-ecyc-2ka6" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-4kgk-drcy-4beq" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-ahe3-n9yg-sqgq" }, { "vulnerability": "VCID-ahte-mbyn-2fh6" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-bgqs-y35v-vuae" }, { "vulnerability": "VCID-cnnd-sgk1-8qcu" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-eqeg-fdfg-vyag" }, { "vulnerability": "VCID-g7g7-vevx-hkej" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-hwva-pek4-5fb7" }, { "vulnerability": "VCID-kqcu-jg4b-ykcd" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-ngg9-hp6h-sqfz" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-nt7b-her7-z3g8" }, { "vulnerability": "VCID-pk8z-1yjq-uqh5" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-qtu6-c9d8-1ydh" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-sn7m-5bry-13fp" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-v77z-t5z4-93cq" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-x37v-jdmd-wbes" }, { "vulnerability": "VCID-x3bk-gdmn-xyhu" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-yr3x-bvad-mfcc" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.7.2" } ], "aliases": [ "CVE-2017-5029", "GHSA-pf6m-fxpq-fg8v" ], "risk_score": 4.5, "exploitability": "0.5", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-mc8f-xxy6-u7f7" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/6042?format=api", "vulnerability_id": "VCID-ngg9-hp6h-sqfz", "summary": "", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-11068.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-11068.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2019-11068", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.01127", "scoring_system": "epss", "scoring_elements": "0.78711", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.01127", "scoring_system": "epss", "scoring_elements": "0.7879", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.01127", "scoring_system": "epss", "scoring_elements": "0.78793", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.01127", "scoring_system": "epss", "scoring_elements": "0.78776", "published_at": "2026-06-12T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-11068" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11068", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11068" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.6", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/blob/f7aa3b0b29d6fe5fafe93dacd9b96b6b3d16b7ec/CHANGELOG.md?plain=1#L826", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/blob/f7aa3b0b29d6fe5fafe93dacd9b96b6b3d16b7ec/CHANGELOG.md?plain=1#L826" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/commit/fe034aedcc59b566740567d621843731686676b9", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/commit/fe034aedcc59b566740567d621843731686676b9" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/issues/1892", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/issues/1892" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/pull/1898", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/pull/1898" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36TEYN37XCCKN2XUMRTBBW67BPNMSW4K", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36TEYN37XCCKN2XUMRTBBW67BPNMSW4K" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GCOAX2IHUMKCM3ILHTMGLHCDSBTLP2JU", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GCOAX2IHUMKCM3ILHTMGLHCDSBTLP2JU" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SK4YNISS22MJY22YX5I6V2U63QZAUEHA", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SK4YNISS22MJY22YX5I6V2U63QZAUEHA" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36TEYN37XCCKN2XUMRTBBW67BPNMSW4K", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36TEYN37XCCKN2XUMRTBBW67BPNMSW4K" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCOAX2IHUMKCM3ILHTMGLHCDSBTLP2JU", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCOAX2IHUMKCM3ILHTMGLHCDSBTLP2JU" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SK4YNISS22MJY22YX5I6V2U63QZAUEHA", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SK4YNISS22MJY22YX5I6V2U63QZAUEHA" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20191017-0001", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20191017-0001" }, { "reference_url": "https://usn.ubuntu.com/3947-1", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://usn.ubuntu.com/3947-1" }, { "reference_url": "https://usn.ubuntu.com/3947-2", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://usn.ubuntu.com/3947-2" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2019/04/22/1", "reference_id": "1", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2019/04/22/1" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1709697", "reference_id": "1709697", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1709697" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36TEYN37XCCKN2XUMRTBBW67BPNMSW4K/", "reference_id": "36TEYN37XCCKN2XUMRTBBW67BPNMSW4K", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36TEYN37XCCKN2XUMRTBBW67BPNMSW4K/" }, { "reference_url": "https://usn.ubuntu.com/3947-1/", "reference_id": "3947-1", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/" } ], "url": "https://usn.ubuntu.com/3947-1/" }, { "reference_url": "https://usn.ubuntu.com/3947-2/", "reference_id": "3947-2", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/" } ], "url": "https://usn.ubuntu.com/3947-2/" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2019/04/23/5", "reference_id": "5", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2019/04/23/5" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=926895", "reference_id": "926895", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=926895" }, { "reference_url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html", "reference_id": "cpuoct2019-5072832.html", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/" } ], "url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11068", "reference_id": "CVE-2019-11068", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11068" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2019-11068.yml", "reference_id": "CVE-2019-11068.YML", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2019-11068.yml" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxslt/commit/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6", "reference_id": "e03553605b45c88f0b4b2980adfbbb8f6fca2fd6", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/" } ], "url": "https://gitlab.gnome.org/GNOME/libxslt/commit/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GCOAX2IHUMKCM3ILHTMGLHCDSBTLP2JU/", "reference_id": "GCOAX2IHUMKCM3ILHTMGLHCDSBTLP2JU", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GCOAX2IHUMKCM3ILHTMGLHCDSBTLP2JU/" }, { "reference_url": "https://github.com/advisories/GHSA-qxcg-xjjg-66mj", "reference_id": "GHSA-qxcg-xjjg-66mj", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-qxcg-xjjg-66mj" }, { "reference_url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00001.html", "reference_id": "msg00001.html", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/" } ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00001.html" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2019/04/msg00016.html", "reference_id": "msg00016.html", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/" } ], "url": "https://lists.debian.org/debian-lts-announce/2019/04/msg00016.html" }, { "reference_url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00025.html", "reference_id": "msg00025.html", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/" } ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00025.html" }, { "reference_url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00048.html", "reference_id": "msg00048.html", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/" } ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00048.html" }, { "reference_url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00052.html", "reference_id": "msg00052.html", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/" } ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00052.html" }, { "reference_url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00053.html", "reference_id": "msg00053.html", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/" } ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00053.html" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20191017-0001/", "reference_id": "ntap-20191017-0001", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/" } ], "url": "https://security.netapp.com/advisory/ntap-20191017-0001/" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:4005", "reference_id": "RHSA-2020:4005", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2020:4005" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:4464", "reference_id": "RHSA-2020:4464", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2020:4464" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SK4YNISS22MJY22YX5I6V2U63QZAUEHA/", "reference_id": "SK4YNISS22MJY22YX5I6V2U63QZAUEHA", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SK4YNISS22MJY22YX5I6V2U63QZAUEHA/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/21719?format=api", "purl": "pkg:gem/nokogiri@1.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-18br-sw9t-9ue7" }, { "vulnerability": "VCID-2577-3bpb-pkgr" }, { "vulnerability": "VCID-2vtx-kt21-wuac" }, { "vulnerability": "VCID-3kej-ecyc-2ka6" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-ahe3-n9yg-sqgq" }, { "vulnerability": "VCID-ahte-mbyn-2fh6" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-bgqs-y35v-vuae" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-eqeg-fdfg-vyag" }, { "vulnerability": "VCID-g7g7-vevx-hkej" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-hwva-pek4-5fb7" }, { "vulnerability": "VCID-kqcu-jg4b-ykcd" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-sn7m-5bry-13fp" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-v77z-t5z4-93cq" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-x37v-jdmd-wbes" }, { "vulnerability": "VCID-x3bk-gdmn-xyhu" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-yr3x-bvad-mfcc" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.10.3" } ], "aliases": [ "CVE-2019-11068", "GHSA-qxcg-xjjg-66mj" ], "risk_score": 4.5, "exploitability": "0.5", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ngg9-hp6h-sqfz" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/11616?format=api", "vulnerability_id": "VCID-nscm-fqz2-fbge", "summary": "", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-24836.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-24836.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-24836", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.01827", "scoring_system": "epss", "scoring_elements": "0.83371", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.01827", "scoring_system": "epss", "scoring_elements": "0.83375", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.01827", "scoring_system": "epss", "scoring_elements": "0.83366", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.01827", "scoring_system": "epss", "scoring_elements": "0.83305", "published_at": "2026-06-11T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-24836" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24836", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24836" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/commit/e444525ef1634b675cd1cf52d39f4320ef0aecfd", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/commit/e444525ef1634b675cd1cf52d39f4320ef0aecfd" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.4", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.4" }, { "reference_url": "https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ?utm_medium=email&utm_source=footer", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ?utm_medium=email&utm_source=footer" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00013.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00013.html" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00018.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00018.html" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6DHCOWMA5PQTIQIMDENA7R2Y5BDYAIYM", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6DHCOWMA5PQTIQIMDENA7R2Y5BDYAIYM" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6DHCOWMA5PQTIQIMDENA7R2Y5BDYAIYM/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6DHCOWMA5PQTIQIMDENA7R2Y5BDYAIYM/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OUPLBUZVM4WPFSXBEP2JS3R6LMKRTLFC", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OUPLBUZVM4WPFSXBEP2JS3R6LMKRTLFC" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OUPLBUZVM4WPFSXBEP2JS3R6LMKRTLFC/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OUPLBUZVM4WPFSXBEP2JS3R6LMKRTLFC/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XMDCWRQXJQ3TFSETPCEFMQ6RR6ME5UA3", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XMDCWRQXJQ3TFSETPCEFMQ6RR6ME5UA3" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XMDCWRQXJQ3TFSETPCEFMQ6RR6ME5UA3/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XMDCWRQXJQ3TFSETPCEFMQ6RR6ME5UA3/" }, { "reference_url": "https://support.apple.com/kb/HT213532", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://support.apple.com/kb/HT213532" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1009787", "reference_id": "1009787", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1009787" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2074346", "reference_id": "2074346", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2074346" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24836", "reference_id": "CVE-2022-24836", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24836" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2022-24836.yml", "reference_id": "CVE-2022-24836.YML", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2022-24836.yml" }, { "reference_url": "https://github.com/advisories/GHSA-crjr-9rc5-ghw8", "reference_id": "GHSA-crjr-9rc5-ghw8", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-crjr-9rc5-ghw8" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-crjr-9rc5-ghw8", "reference_id": "GHSA-crjr-9rc5-ghw8", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-crjr-9rc5-ghw8" }, { "reference_url": "https://security.gentoo.org/glsa/202208-29", "reference_id": "GLSA-202208-29", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.gentoo.org/glsa/202208-29" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8506", "reference_id": "RHSA-2022:8506", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8506" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/19854?format=api", "purl": "pkg:gem/nokogiri@1.13.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.13.4" } ], "aliases": [ "CVE-2022-24836", "GHSA-crjr-9rc5-ghw8" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-nscm-fqz2-fbge" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/3309?format=api", "vulnerability_id": "VCID-nt7b-her7-z3g8", "summary": "", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-18258.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-18258.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2017-18258", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00898", "scoring_system": "epss", "scoring_elements": "0.76173", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00898", "scoring_system": "epss", "scoring_elements": "0.76179", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.00898", "scoring_system": "epss", "scoring_elements": "0.76095", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00898", "scoring_system": "epss", "scoring_elements": "0.76166", "published_at": "2026-06-12T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2017-18258" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18258", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18258" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://git.gnome.org/browse/libxml2/commit/?id=e2a9122b8dde53d320750451e9907a7dcb2ca8bb", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://git.gnome.org/browse/libxml2/commit/?id=e2a9122b8dde53d320750451e9907a7dcb2ca8bb" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20190719-0001", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20190719-0001" }, { "reference_url": "https://usn.ubuntu.com/3739-1", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://usn.ubuntu.com/3739-1" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1566749", "reference_id": "1566749", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1566749" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=895245", "reference_id": "895245", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=895245" }, { "reference_url": "https://security.archlinux.org/AVG-671", "reference_id": "AVG-671", "reference_type": "", "scores": [ { "value": "Medium", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-671" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18258", "reference_id": "CVE-2017-18258", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18258" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2017-18258.yml", "reference_id": "CVE-2017-18258.YML", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2017-18258.yml" }, { "reference_url": "https://github.com/advisories/GHSA-882p-jqgm-f45g", "reference_id": "GHSA-882p-jqgm-f45g", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-882p-jqgm-f45g" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2018:2486", "reference_id": "RHSA-2018:2486", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2018:2486" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:1190", "reference_id": "RHSA-2020:1190", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2020:1190" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/13121?format=api", "purl": "pkg:gem/nokogiri@1.8.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-18br-sw9t-9ue7" }, { "vulnerability": "VCID-2577-3bpb-pkgr" }, { "vulnerability": "VCID-2vtx-kt21-wuac" }, { "vulnerability": "VCID-3kej-ecyc-2ka6" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-4kgk-drcy-4beq" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-ahe3-n9yg-sqgq" }, { "vulnerability": "VCID-ahte-mbyn-2fh6" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-bgqs-y35v-vuae" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-eqeg-fdfg-vyag" }, { "vulnerability": "VCID-g7g7-vevx-hkej" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-hwva-pek4-5fb7" }, { "vulnerability": "VCID-kqcu-jg4b-ykcd" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-ngg9-hp6h-sqfz" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-qtu6-c9d8-1ydh" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-sn7m-5bry-13fp" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-v77z-t5z4-93cq" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-x37v-jdmd-wbes" }, { "vulnerability": "VCID-x3bk-gdmn-xyhu" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-yr3x-bvad-mfcc" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.8.2" } ], "aliases": [ "CVE-2017-18258", "GHSA-882p-jqgm-f45g" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-nt7b-her7-z3g8" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/361503?format=api", "vulnerability_id": "VCID-payk-mek8-kka3", "summary": "XML Document Root Element Handling Memory Consumption Remote DoS\nThis package contains a flaw that is triggered when handling a root element in an XML document. This may allow a remote attacker to cause a consumption of memory resources.", "references": [ { "reference_url": "https://github.com/sparklemotion/nokogiri/pull/1087", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/sparklemotion/nokogiri/pull/1087" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/388151?format=api", "purl": "pkg:gem/nokogiri@1.6.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14kb-seu7-9bcc" }, { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-18br-sw9t-9ue7" }, { "vulnerability": "VCID-2577-3bpb-pkgr" }, { "vulnerability": "VCID-2vtx-kt21-wuac" }, { "vulnerability": "VCID-3kej-ecyc-2ka6" }, { "vulnerability": "VCID-3z3h-7s7d-zbaz" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-4e3h-nwws-abh1" }, { "vulnerability": "VCID-4kgk-drcy-4beq" }, { "vulnerability": "VCID-7cqg-h2ws-hfh1" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-ahe3-n9yg-sqgq" }, { "vulnerability": "VCID-ahte-mbyn-2fh6" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-bgqs-y35v-vuae" }, { "vulnerability": "VCID-cnnd-sgk1-8qcu" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-djuu-6gdw-cuav" }, { "vulnerability": "VCID-eqeg-fdfg-vyag" }, { "vulnerability": "VCID-g7g7-vevx-hkej" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-hwva-pek4-5fb7" }, { "vulnerability": "VCID-jf45-a4cp-v7a7" }, { "vulnerability": "VCID-kqcu-jg4b-ykcd" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-mc8f-xxy6-u7f7" }, { "vulnerability": "VCID-ngg9-hp6h-sqfz" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-nt7b-her7-z3g8" }, { "vulnerability": "VCID-pk8z-1yjq-uqh5" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-qtu6-c9d8-1ydh" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-sn7m-5bry-13fp" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-u51x-afpr-a7gt" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-v77z-t5z4-93cq" }, { "vulnerability": "VCID-va8n-ev2d-53a2" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-x37v-jdmd-wbes" }, { "vulnerability": "VCID-x3bk-gdmn-xyhu" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-yr3x-bvad-mfcc" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zwze-jyd4-6qhm" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.3" } ], "aliases": [ "OSVDB-118481" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-payk-mek8-kka3" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/3052?format=api", "vulnerability_id": "VCID-pk8z-1yjq-uqh5", "summary": "", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-15412.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-15412.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2017-15412", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.02535", "scoring_system": "epss", "scoring_elements": "0.85823", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.02535", "scoring_system": "epss", "scoring_elements": "0.85825", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.02535", "scoring_system": "epss", "scoring_elements": "0.85833", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.02535", "scoring_system": "epss", "scoring_elements": "0.85773", "published_at": "2026-06-11T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2017-15412" }, { "reference_url": "https://bugzilla.gnome.org/show_bug.cgi?id=783160", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://bugzilla.gnome.org/show_bug.cgi?id=783160" }, { "reference_url": "https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html" }, { "reference_url": "https://crbug.com/727039", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://crbug.com/727039" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15412", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15412" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2017-15412.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2017-15412.yml" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/issues/1714", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/issues/1714" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2017/12/msg00014.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2017/12/msg00014.html" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15412", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15412" }, { "reference_url": "https://web.archive.org/web/20201208155618/http://www.securitytracker.com/id/1040348", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20201208155618/http://www.securitytracker.com/id/1040348" }, { "reference_url": "https://www.debian.org/security/2018/dsa-4086", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.debian.org/security/2018/dsa-4086" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1523128", "reference_id": "1523128", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1523128" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=883790", "reference_id": "883790", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=883790" }, { "reference_url": "https://security.archlinux.org/ASA-201712-5", "reference_id": "ASA-201712-5", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-201712-5" }, { "reference_url": "https://security.archlinux.org/AVG-544", "reference_id": "AVG-544", "reference_type": "", "scores": [ { "value": "Critical", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-544" }, { "reference_url": "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-15412.html", "reference_id": "CVE-2017-15412.HTML", "reference_type": "", "scores": [], "url": "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-15412.html" }, { "reference_url": "https://github.com/advisories/GHSA-r58r-74gx-6wx3", "reference_id": "GHSA-r58r-74gx-6wx3", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-r58r-74gx-6wx3" }, { "reference_url": "https://security.gentoo.org/glsa/201801-03", "reference_id": "GLSA-201801-03", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.gentoo.org/glsa/201801-03" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2017:3401", "reference_id": "RHSA-2017:3401", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://access.redhat.com/errata/RHSA-2017:3401" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2018:0287", "reference_id": "RHSA-2018:0287", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://access.redhat.com/errata/RHSA-2018:0287" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:1190", "reference_id": "RHSA-2020:1190", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2020:1190" }, { "reference_url": "https://usn.ubuntu.com/3513-1/", "reference_id": "USN-3513-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/3513-1/" }, { "reference_url": "https://usn.ubuntu.com/3513-2/", "reference_id": "USN-3513-2", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/3513-2/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/13121?format=api", "purl": "pkg:gem/nokogiri@1.8.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-18br-sw9t-9ue7" }, { "vulnerability": "VCID-2577-3bpb-pkgr" }, { "vulnerability": "VCID-2vtx-kt21-wuac" }, { "vulnerability": "VCID-3kej-ecyc-2ka6" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-4kgk-drcy-4beq" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-ahe3-n9yg-sqgq" }, { "vulnerability": "VCID-ahte-mbyn-2fh6" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-bgqs-y35v-vuae" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-eqeg-fdfg-vyag" }, { "vulnerability": "VCID-g7g7-vevx-hkej" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-hwva-pek4-5fb7" }, { "vulnerability": "VCID-kqcu-jg4b-ykcd" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-ngg9-hp6h-sqfz" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-qtu6-c9d8-1ydh" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-sn7m-5bry-13fp" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-v77z-t5z4-93cq" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-x37v-jdmd-wbes" }, { "vulnerability": "VCID-x3bk-gdmn-xyhu" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-yr3x-bvad-mfcc" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.8.2" } ], "aliases": [ "CVE-2017-15412", "GHSA-r58r-74gx-6wx3" ], "risk_score": 4.5, "exploitability": "0.5", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-pk8z-1yjq-uqh5" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/208748?format=api", "vulnerability_id": "VCID-pqm3-2t49-rqat", "summary": "Denial of Service (DoS) in Nokogiri on JRuby", "references": [ { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.4", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.4" }, { "reference_url": "https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ", "reference_id": "", "reference_type": "", "scores": [], "url": "https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ" }, { "reference_url": "https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ?utm_medium=email&utm_source=footer", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ?utm_medium=email&utm_source=footer" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24839", "reference_id": "CVE-2022-24839", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24839" }, { "reference_url": "https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv", "reference_id": "GHSA-9849-p7jc-9rmv", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv" }, { "reference_url": "https://github.com/advisories/GHSA-gx8x-g87m-h5q6", "reference_id": "GHSA-gx8x-g87m-h5q6", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-gx8x-g87m-h5q6" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-gx8x-g87m-h5q6", "reference_id": "GHSA-gx8x-g87m-h5q6", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-gx8x-g87m-h5q6" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/19854?format=api", "purl": "pkg:gem/nokogiri@1.13.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.13.4" } ], "aliases": [ "GHSA-gx8x-g87m-h5q6", "GMS-2022-786" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-pqm3-2t49-rqat" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/4780?format=api", "vulnerability_id": "VCID-qtu6-c9d8-1ydh", "summary": "", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-14404.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-14404.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2018-14404", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.20012", "scoring_system": "epss", "scoring_elements": "0.95628", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.20012", "scoring_system": "epss", "scoring_elements": "0.95629", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.20012", "scoring_system": "epss", "scoring_elements": "0.95614", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.20012", "scoring_system": "epss", "scoring_elements": "0.95632", "published_at": "2026-06-14T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2018-14404" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14404", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14404" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/issues/1785", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/issues/1785" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20190719-0002", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20190719-0002" }, { "reference_url": "https://usn.ubuntu.com/3739-1", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://usn.ubuntu.com/3739-1" }, { "reference_url": "https://usn.ubuntu.com/3739-2", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://usn.ubuntu.com/3739-2" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/issues/10", "reference_id": "10", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-03T21:07:49Z/" } ], "url": "https://gitlab.gnome.org/GNOME/libxml2/issues/10" }, { "reference_url": "https://usn.ubuntu.com/3739-1/", "reference_id": "3739-1", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-03T21:07:49Z/" } ], "url": "https://usn.ubuntu.com/3739-1/" }, { "reference_url": "https://usn.ubuntu.com/3739-2/", "reference_id": "3739-2", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-03T21:07:49Z/" } ], "url": "https://usn.ubuntu.com/3739-2/" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901817", "reference_id": "bugreport.cgi?bug=901817", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-03T21:07:49Z/" } ], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901817" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14404", "reference_id": "CVE-2018-14404", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14404" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2018-14404.yml", "reference_id": "CVE-2018-14404.YML", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2018-14404.yml" }, { "reference_url": "https://github.com/advisories/GHSA-6qvp-r6r3-9p7h", "reference_id": "GHSA-6qvp-r6r3-9p7h", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-6qvp-r6r3-9p7h" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html", "reference_id": "msg00009.html", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-03T21:07:49Z/" } ], "url": "https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html", "reference_id": "msg00035.html", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-03T21:07:49Z/" } ], "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20190719-0002/", "reference_id": "ntap-20190719-0002", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-03T21:07:49Z/" } ], "url": "https://security.netapp.com/advisory/ntap-20190719-0002/" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2019:1543", "reference_id": "RHSA-2019:1543", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-03T21:07:49Z/" } ], "url": "https://access.redhat.com/errata/RHSA-2019:1543" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:1190", "reference_id": "RHSA-2020:1190", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2020:1190" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:1827", "reference_id": "RHSA-2020:1827", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2020:1827" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1595985", "reference_id": "show_bug.cgi?id=1595985", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-03T21:07:49Z/" } ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1595985" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/14749?format=api", "purl": "pkg:gem/nokogiri@1.8.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-18br-sw9t-9ue7" }, { "vulnerability": "VCID-2577-3bpb-pkgr" }, { "vulnerability": "VCID-2vtx-kt21-wuac" }, { "vulnerability": "VCID-3kej-ecyc-2ka6" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-ahe3-n9yg-sqgq" }, { "vulnerability": "VCID-ahte-mbyn-2fh6" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-bgqs-y35v-vuae" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-eqeg-fdfg-vyag" }, { "vulnerability": "VCID-g7g7-vevx-hkej" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-hwva-pek4-5fb7" }, { "vulnerability": "VCID-kqcu-jg4b-ykcd" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-ngg9-hp6h-sqfz" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-sn7m-5bry-13fp" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-v77z-t5z4-93cq" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-x37v-jdmd-wbes" }, { "vulnerability": "VCID-x3bk-gdmn-xyhu" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-yr3x-bvad-mfcc" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.8.5" } ], "aliases": [ "CVE-2018-14404", "GHSA-6qvp-r6r3-9p7h" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-qtu6-c9d8-1ydh" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/5388?format=api", "vulnerability_id": "VCID-s2mc-whzr-sbb8", "summary": "", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-25032.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-25032.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2018-25032", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00089", "scoring_system": "epss", "scoring_elements": "0.25585", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00089", "scoring_system": "epss", "scoring_elements": "0.256", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.00089", "scoring_system": "epss", "scoring_elements": "0.25582", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00089", "scoring_system": "epss", "scoring_elements": "0.25385", "published_at": "2026-06-11T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2018-25032" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-25032", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-25032" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DCZFIJBJTZ7CL5QXBFKTQ22Q26VINRUF", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DCZFIJBJTZ7CL5QXBFKTQ22Q26VINRUF" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DCZFIJBJTZ7CL5QXBFKTQ22Q26VINRUF/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DCZFIJBJTZ7CL5QXBFKTQ22Q26VINRUF/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DF62MVMH3QUGMBDCB3DY2ERQ6EBHTADB", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DF62MVMH3QUGMBDCB3DY2ERQ6EBHTADB" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DF62MVMH3QUGMBDCB3DY2ERQ6EBHTADB/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DF62MVMH3QUGMBDCB3DY2ERQ6EBHTADB/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JZZPTWRYQULAOL3AW7RZJNVZ2UONXCV4", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JZZPTWRYQULAOL3AW7RZJNVZ2UONXCV4" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JZZPTWRYQULAOL3AW7RZJNVZ2UONXCV4/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JZZPTWRYQULAOL3AW7RZJNVZ2UONXCV4/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NS2D2GFPFGOJUL4WQ3DUAY7HF4VWQ77F", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NS2D2GFPFGOJUL4WQ3DUAY7HF4VWQ77F" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NS2D2GFPFGOJUL4WQ3DUAY7HF4VWQ77F/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NS2D2GFPFGOJUL4WQ3DUAY7HF4VWQ77F/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VOKNP2L734AEL47NRYGVZIKEFOUBQY5Y", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VOKNP2L734AEL47NRYGVZIKEFOUBQY5Y" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VOKNP2L734AEL47NRYGVZIKEFOUBQY5Y/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VOKNP2L734AEL47NRYGVZIKEFOUBQY5Y/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XOKFMSNQ5D5WGMALBNBXU3GE442V74WU", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XOKFMSNQ5D5WGMALBNBXU3GE442V74WU" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XOKFMSNQ5D5WGMALBNBXU3GE442V74WU/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XOKFMSNQ5D5WGMALBNBXU3GE442V74WU/" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20220526-0009", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20220526-0009" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20220729-0004", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20220729-0004" }, { "reference_url": "https://www.openwall.com/lists/oss-security/2022/03/24/1", "reference_id": "1", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://www.openwall.com/lists/oss-security/2022/03/24/1" }, { "reference_url": "https://www.openwall.com/lists/oss-security/2022/03/28/1", "reference_id": "1", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://www.openwall.com/lists/oss-security/2022/03/28/1" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2022/03/26/1", "reference_id": "1", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2022/03/26/1" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1008265", "reference_id": "1008265", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1008265" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2022/03/25/2", "reference_id": "2", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2022/03/25/2" }, { "reference_url": "https://security.gentoo.org/glsa/202210-42", "reference_id": "202210-42", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://security.gentoo.org/glsa/202210-42" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2067945", "reference_id": "2067945", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2067945" }, { "reference_url": "https://www.openwall.com/lists/oss-security/2022/03/28/3", "reference_id": "3", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://www.openwall.com/lists/oss-security/2022/03/28/3" }, { "reference_url": "http://seclists.org/fulldisclosure/2022/May/33", "reference_id": "33", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "http://seclists.org/fulldisclosure/2022/May/33" }, { "reference_url": "http://seclists.org/fulldisclosure/2022/May/35", "reference_id": "35", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "http://seclists.org/fulldisclosure/2022/May/35" }, { "reference_url": "http://seclists.org/fulldisclosure/2022/May/38", "reference_id": "38", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "http://seclists.org/fulldisclosure/2022/May/38" }, { "reference_url": "https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531", "reference_id": "5c44459c3b28a9bd3283aaceab7c615f8020c531", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531" }, { "reference_url": "https://github.com/madler/zlib/issues/605", "reference_id": "605", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://github.com/madler/zlib/issues/605" }, { "reference_url": "https://security.archlinux.org/ASA-202204-3", "reference_id": "ASA-202204-3", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-202204-3" }, { "reference_url": "https://security.archlinux.org/AVG-2657", "reference_id": "AVG-2657", "reference_type": "", "scores": [ { "value": "High", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-2657" }, { "reference_url": "https://www.oracle.com/security-alerts/cpujul2022.html", "reference_id": "cpujul2022.html", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://www.oracle.com/security-alerts/cpujul2022.html" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2018-25032", "reference_id": "CVE-2018-25032", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-25032" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2018-25032.yml", "reference_id": "CVE-2018-25032.YML", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2018-25032.yml" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DCZFIJBJTZ7CL5QXBFKTQ22Q26VINRUF/", "reference_id": "DCZFIJBJTZ7CL5QXBFKTQ22Q26VINRUF", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DCZFIJBJTZ7CL5QXBFKTQ22Q26VINRUF/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DF62MVMH3QUGMBDCB3DY2ERQ6EBHTADB/", "reference_id": "DF62MVMH3QUGMBDCB3DY2ERQ6EBHTADB", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DF62MVMH3QUGMBDCB3DY2ERQ6EBHTADB/" }, { "reference_url": "https://www.debian.org/security/2022/dsa-5111", "reference_id": "dsa-5111", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://www.debian.org/security/2022/dsa-5111" }, { "reference_url": "https://github.com/advisories/GHSA-jc36-42cf-vqwj", "reference_id": "GHSA-jc36-42cf-vqwj", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-jc36-42cf-vqwj" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v6gp-9mmm-c6p5", "reference_id": "GHSA-v6gp-9mmm-c6p5", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v6gp-9mmm-c6p5" }, { "reference_url": "https://security.gentoo.org/glsa/202405-22", "reference_id": "GLSA-202405-22", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202405-22" }, { "reference_url": "https://support.apple.com/kb/HT213255", "reference_id": "HT213255", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://support.apple.com/kb/HT213255" }, { "reference_url": "https://support.apple.com/kb/HT213256", "reference_id": "HT213256", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://support.apple.com/kb/HT213256" }, { "reference_url": "https://support.apple.com/kb/HT213257", "reference_id": "HT213257", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://support.apple.com/kb/HT213257" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZZPTWRYQULAOL3AW7RZJNVZ2UONXCV4/", "reference_id": "JZZPTWRYQULAOL3AW7RZJNVZ2UONXCV4", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZZPTWRYQULAOL3AW7RZJNVZ2UONXCV4/" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2022/04/msg00000.html", "reference_id": "msg00000.html", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://lists.debian.org/debian-lts-announce/2022/04/msg00000.html" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00008.html", "reference_id": "msg00008.html", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00008.html" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html", "reference_id": "msg00023.html", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NS2D2GFPFGOJUL4WQ3DUAY7HF4VWQ77F/", "reference_id": "NS2D2GFPFGOJUL4WQ3DUAY7HF4VWQ77F", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NS2D2GFPFGOJUL4WQ3DUAY7HF4VWQ77F/" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20220526-0009/", "reference_id": "ntap-20220526-0009", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://security.netapp.com/advisory/ntap-20220526-0009/" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20220729-0004/", "reference_id": "ntap-20220729-0004", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://security.netapp.com/advisory/ntap-20220729-0004/" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1591", "reference_id": "RHSA-2022:1591", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1591" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1642", "reference_id": "RHSA-2022:1642", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1642" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1661", "reference_id": "RHSA-2022:1661", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1661" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:2192", "reference_id": "RHSA-2022:2192", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:2192" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:2197", "reference_id": "RHSA-2022:2197", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:2197" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:2198", "reference_id": "RHSA-2022:2198", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:2198" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:2201", "reference_id": "RHSA-2022:2201", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:2201" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:2213", "reference_id": "RHSA-2022:2213", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:2213" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:2214", "reference_id": "RHSA-2022:2214", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:2214" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:4584", "reference_id": "RHSA-2022:4584", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:4584" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:4592", "reference_id": "RHSA-2022:4592", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:4592" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:4845", "reference_id": "RHSA-2022:4845", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:4845" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:4896", "reference_id": "RHSA-2022:4896", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:4896" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:5439", "reference_id": "RHSA-2022:5439", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:5439" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:7144", "reference_id": "RHSA-2022:7144", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:7144" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:7813", "reference_id": "RHSA-2022:7813", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:7813" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8420", "reference_id": "RHSA-2022:8420", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8420" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0943", "reference_id": "RHSA-2023:0943", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0943" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0975", "reference_id": "RHSA-2023:0975", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0975" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0976", "reference_id": "RHSA-2023:0976", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0976" }, { "reference_url": "https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf", "reference_id": "ssa-333517.pdf", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf" }, { "reference_url": "https://usn.ubuntu.com/5355-1/", "reference_id": "USN-5355-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5355-1/" }, { "reference_url": "https://usn.ubuntu.com/5355-2/", "reference_id": "USN-5355-2", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5355-2/" }, { "reference_url": "https://usn.ubuntu.com/5359-1/", "reference_id": "USN-5359-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5359-1/" }, { "reference_url": "https://usn.ubuntu.com/5359-2/", "reference_id": "USN-5359-2", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5359-2/" }, { "reference_url": "https://usn.ubuntu.com/5739-1/", "reference_id": "USN-5739-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5739-1/" }, { "reference_url": "https://usn.ubuntu.com/6736-1/", "reference_id": "USN-6736-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/6736-1/" }, { "reference_url": "https://usn.ubuntu.com/6736-2/", "reference_id": "USN-6736-2", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/6736-2/" }, { "reference_url": "https://github.com/madler/zlib/compare/v1.2.11...v1.2.12", "reference_id": "v1.2.11...v1.2.12", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://github.com/madler/zlib/compare/v1.2.11...v1.2.12" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOKNP2L734AEL47NRYGVZIKEFOUBQY5Y/", "reference_id": "VOKNP2L734AEL47NRYGVZIKEFOUBQY5Y", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOKNP2L734AEL47NRYGVZIKEFOUBQY5Y/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOKFMSNQ5D5WGMALBNBXU3GE442V74WU/", "reference_id": "XOKFMSNQ5D5WGMALBNBXU3GE442V74WU", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOKFMSNQ5D5WGMALBNBXU3GE442V74WU/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/19854?format=api", "purl": "pkg:gem/nokogiri@1.13.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.13.4" } ], "aliases": [ "CVE-2018-25032", "GHSA-jc36-42cf-vqwj" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-s2mc-whzr-sbb8" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/359438?format=api", "vulnerability_id": "VCID-sn7m-5bry-13fp", "summary": "Update packaged dependency libxml2 from 2.9.10 to 2.9.12\n### Summary\n\nNokogiri v1.11.4 updates the vendored libxml2 from v2.9.10 to v2.9.12 which addresses:\n\n- [CVE-2019-20388](https://security.archlinux.org/CVE-2019-20388) (Medium severity)\n- [CVE-2020-24977](https://security.archlinux.org/CVE-2020-24977) (Medium severity)\n- [CVE-2021-3517](https://security.archlinux.org/CVE-2021-3517) (Medium severity)\n- [CVE-2021-3518](https://security.archlinux.org/CVE-2021-3518) (Medium severity)\n- [CVE-2021-3537](https://security.archlinux.org/CVE-2021-3537) (Low severity)\n- [CVE-2021-3541](https://security.archlinux.org/CVE-2021-3541) (Low severity)\n\nNote that two additional CVEs were addressed upstream but are not relevant to this release. [CVE-2021-3516](https://security.archlinux.org/CVE-2021-3516) via `xmllint` is not present in Nokogiri, and [CVE-2020-7595](https://security.archlinux.org/CVE-2020-7595) has been patched in Nokogiri since v1.10.8 (see #1992).\n\nPlease note that this advisory only applies to the CRuby implementation of Nokogiri `< 1.11.4`, and only if the packaged version of libxml2 is being used. If you've overridden defaults at installation time to use system libraries instead of packaged libraries, you should instead pay attention to your distro's `libxml2` release announcements.\n\n\n### Mitigation\n\nUpgrade to Nokogiri `>= 1.11.4`.\n\n\n### Impact\n\nI've done a brief analysis of the published CVEs that are addressed in this upstream release. The libxml2 maintainers have not released a canonical set of CVEs, and so this list is pieced together from secondary sources and may be incomplete.\n\nAll information below is sourced from [security.archlinux.org](https://security.archlinux.org), which appears to have the most up-to-date information as of this analysis.\n\n#### [CVE-2019-20388](https://security.archlinux.org/CVE-2019-20388)\n\n- **Severity**: Medium\n- **Type**: Denial of service\n- **Description**: A memory leak was found in the xmlSchemaValidateStream function of libxml2. Applications that use this library may be vulnerable to memory not being freed leading to a denial of service.\n- **Fixed**: https://gitlab.gnome.org/GNOME/libxml2/commit/7ffcd44d7e6c46704f8af0321d9314cd26e0e18a\n\nVerified that the fix commit first appears in v2.9.11. It seems possible that this issue would be present in programs using Nokogiri < v1.11.4.\n\n\n#### [CVE-2020-7595](https://security.archlinux.org/CVE-2020-7595)\n\n- **Severity**: Medium\n- **Type**: Denial of service\n- **Description**: xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.\n- **Fixed**: https://gitlab.gnome.org/GNOME/libxml2/commit/0e1a49c8907645d2e155f0d89d4d9895ac5112b5\n\nThis has been patched in Nokogiri since v1.10.8 (see #1992).\n\n\n#### [CVE-2020-24977](https://security.archlinux.org/CVE-2020-24977)\n\n- **Severity**: Medium\n- **Type**: Information disclosure\n- **Description**: GNOME project libxml2 <= 2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c.\n- **Fixed**: https://gitlab.gnome.org/GNOME/libxml2/commit/50f06b3efb638efb0abd95dc62dca05ae67882c2\n\nVerified that the fix commit first appears in v2.9.11. It seems possible that this issue would be present in programs using Nokogiri < v1.11.4.\n\n\n#### [CVE-2021-3516](https://security.archlinux.org/CVE-2021-3516)\n\n- **Severity**: Medium\n- **Type**: Arbitrary code execution (no remote vector)\n- **Description**: A use-after-free security issue was found libxml2 before version 2.9.11 when \"xmllint --html --push\" is used to process crafted files.\n- **Issue**: https://gitlab.gnome.org/GNOME/libxml2/-/issues/230\n- **Fixed**: https://gitlab.gnome.org/GNOME/libxml2/-/commit/1358d157d0bd83be1dfe356a69213df9fac0b539\n\nVerified that the fix commit first appears in v2.9.11. This vector does not exist within Nokogiri, which does not ship `xmllint`.\n\n\n#### [CVE-2021-3517](https://security.archlinux.org/CVE-2021-3517)\n\n- **Severity**: Medium\n- **Type**: Arbitrary code execution\n- **Description**: A heap-based buffer overflow was found in libxml2 before version 2.9.11 when processing truncated UTF-8 input.\n- **Issue**: https://gitlab.gnome.org/GNOME/libxml2/-/issues/235\n- **Fixed**: https://gitlab.gnome.org/GNOME/libxml2/-/commit/bf22713507fe1fc3a2c4b525cf0a88c2dc87a3a2\n\nVerified that the fix commit first appears in v2.9.11. It seems possible that this issue would be present in programs using Nokogiri < v1.11.4.\n\n\n#### [CVE-2021-3518](https://security.archlinux.org/CVE-2021-3518)\n\n- **Severity**: Medium\n- **Type**: Arbitrary code execution\n- **Description**: A use-after-free security issue was found in libxml2 before version 2.9.11 in xmlXIncludeDoProcess() in xinclude.c when processing crafted files.\n- **Issue**: https://gitlab.gnome.org/GNOME/libxml2/-/issues/237\n- **Fixed**: https://gitlab.gnome.org/GNOME/libxml2/-/commit/1098c30a040e72a4654968547f415be4e4c40fe7\n\nVerified that the fix commit first appears in v2.9.11. It seems possible that this issue would be present in programs using Nokogiri < v1.11.4.\n\n\n#### [CVE-2021-3537](https://security.archlinux.org/CVE-2021-3537)\n\n- **Severity**: Low\n- **Type**: Denial of service\n- **Description**: It was found that libxml2 before version 2.9.11 did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application.\n- **Issue**: https://gitlab.gnome.org/GNOME/libxml2/-/issues/243\n- **Fixed**: https://gitlab.gnome.org/GNOME/libxml2/-/commit/babe75030c7f64a37826bb3342317134568bef61\n\nVerified that the fix commit first appears in v2.9.11. It seems possible that this issue would be present in programs using Nokogiri < v1.11.4.\n\n\n#### [CVE-2021-3541](https://security.archlinux.org/CVE-2021-3541)\n\n- **Severity**: Low\n- **Type**: Denial of service\n- **Description**: A security issue was found in libxml2 before version 2.9.11. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.\n- **Fixed**: https://gitlab.gnome.org/GNOME/libxml2/-/commit/8598060bacada41a0eb09d95c97744ff4e428f8e\n\nVerified that the fix commit first appears in v2.9.11. It seems possible that this issue would be present in programs using Nokogiri < v1.11.4, however Nokogiri's default parse options prevent the attack from succeeding (it is necessary to opt into `DTDLOAD` which is off by default).\n\nFor more details supporting this analysis of this CVE, please visit #2233.", "references": [ { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/commit/9b90a8854f74b5f672a437ba0043a503bc259d1b", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/commit/9b90a8854f74b5f672a437ba0043a503bc259d1b" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-7rrm-v45f-jp64", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-7rrm-v45f-jp64" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3541", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3541" }, { "reference_url": "https://github.com/advisories/GHSA-7rrm-v45f-jp64", "reference_id": "GHSA-7rrm-v45f-jp64", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-7rrm-v45f-jp64" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/23358?format=api", "purl": "pkg:gem/nokogiri@1.11.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-2vtx-kt21-wuac" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-ahe3-n9yg-sqgq" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-yr3x-bvad-mfcc" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.11.4" } ], "aliases": [ "GHSA-7rrm-v45f-jp64", "GMS-2021-171" ], "risk_score": 3.4, "exploitability": "0.5", "weighted_severity": "6.8", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-sn7m-5bry-13fp" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/359434?format=api", "vulnerability_id": "VCID-tntw-mt23-k7gh", "summary": "Nokogiri XSLT transform has a memory leak\n## Summary\n\nNokogiri's `Nokogiri::XSLT::Stylesheet#transform` leaks a small heap allocation when passed a Ruby string parameter containing a null byte.\n\nFor applications that pass attacker-controlled input through `XSLT.transform` parameters, this may be a vector for a denial of service attack against long-running processes.\n\n\n## Mitigation\n\nUpgrade to Nokogiri `>= 1.19.3`.\n\nUsers may also be able to mitigate this issue without upgrading by validating untrusted transform parameters before passing them to `Nokogiri::XSLT::Stylesheet#transform`.\n\n\n## Severity\n\nThe Nokogiri maintainers have evaluated this as **Moderate Severity**, CVSS 5.3.\n\nEach leaked allocation is approximately 24–32 bytes, so meaningful memory growth requires sustained attacker-controlled traffic at high call rates. The bug does not cause memory corruption, information disclosure, or any change in the behavior of the transform itself, and the string-handling exception is raised as expected.\n\nApplications that do not pass raw attacker-controlled bytes to XSLT parameters are unlikely to be affected in practice.\n\n\n## Resources\n\n- [CWE-401: Missing Release of Memory after Effective Lifetime](https://cwe.mitre.org/data/definitions/401.html)\n\n\n## Credit\n\nThis vulnerability was responsibly reported by @Captainjack-kor.", "references": [ { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v2fc-qm4h-8hqv", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v2fc-qm4h-8hqv" }, { "reference_url": "https://github.com/advisories/GHSA-v2fc-qm4h-8hqv", "reference_id": "GHSA-v2fc-qm4h-8hqv", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-v2fc-qm4h-8hqv" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/375402?format=api", "purl": "pkg:gem/nokogiri@1.19.3", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.19.3" } ], "aliases": [ "GHSA-v2fc-qm4h-8hqv" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-tntw-mt23-k7gh" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/359431?format=api", "vulnerability_id": "VCID-umph-eaje-7khu", "summary": "Nokogiri updates packaged libxml2 to v2.13.8 to resolve CVE-2025-32414 and CVE-2025-32415\n## Summary\n\nNokogiri v1.18.8 upgrades its dependency libxml2 to\n[v2.13.8](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.8).\n\nlibxml2 v2.13.8 addresses:\n\n- CVE-2025-32414\n - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/889\n- CVE-2025-32415\n - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/890\n\n## Impact\n\n### CVE-2025-32414: No impact\n\nIn libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds\nmemory access can occur in the Python API (Python bindings) because\nof an incorrect return value. This occurs in xmlPythonFileRead and\nxmlPythonFileReadRaw because of a difference between bytes and characters.\n\n**There is no impact** from this CVE for Nokogiri users.\n\n### CVE-2025-32415: Low impact\n\nIn libxml2 before 2.13.8 and 2.14.x before 2.14.2,\nxmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer\nunder-read. To exploit this, a crafted XML document must be validated\nagainst an XML schema with certain identity constraints, or a\ncrafted XML schema must be used.\n\nIn the upstream issue, further context is provided by the maintainer:\n\n> The bug affects validation against untrusted XML Schemas (.xsd)\n> and validation of untrusted documents against trusted Schemas if\n> they make use of xsd:keyref in combination with recursively\n> defined types that have additional identity constraints.\n\nMITRE has published a severity score of 2.9 LOW\n(CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) for this CVE.", "references": [ { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-5w6v-399v-w3cc", "reference_id": "", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-5w6v-399v-w3cc" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.8", "reference_id": "", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.8" }, { "reference_url": "https://github.com/advisories/GHSA-5w6v-399v-w3cc", "reference_id": "GHSA-5w6v-399v-w3cc", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-5w6v-399v-w3cc" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/376551?format=api", "purl": "pkg:gem/nokogiri@1.18.8", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.18.8" } ], "aliases": [ "GHSA-5w6v-399v-w3cc" ], "risk_score": 1.4, "exploitability": "0.5", "weighted_severity": "2.7", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-umph-eaje-7khu" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/208747?format=api", "vulnerability_id": "VCID-v47q-qyuj-gba7", "summary": "XML Injection in Xerces Java affects Nokogiri", "references": [ { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.4", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.4" }, { "reference_url": "https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ?utm_medium=email&utm_source=footer", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ?utm_medium=email&utm_source=footer" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23437", "reference_id": "CVE-2022-23437", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23437" }, { "reference_url": "https://github.com/advisories/GHSA-h65f-jvqw-m9fj", "reference_id": "GHSA-h65f-jvqw-m9fj", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-h65f-jvqw-m9fj" }, { "reference_url": "https://github.com/advisories/GHSA-xxx9-3xcr-gjj3", "reference_id": "GHSA-xxx9-3xcr-gjj3", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-xxx9-3xcr-gjj3" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xxx9-3xcr-gjj3", "reference_id": "GHSA-xxx9-3xcr-gjj3", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xxx9-3xcr-gjj3" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/19854?format=api", "purl": "pkg:gem/nokogiri@1.13.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.13.4" } ], "aliases": [ "GHSA-xxx9-3xcr-gjj3", "GMS-2022-788" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-v47q-qyuj-gba7" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/178976?format=api", "vulnerability_id": "VCID-v77z-t5z4-93cq", "summary": "Multiple vulnerabilities have been found in Chromium and Google\n Chrome, the worst of which could allow remote attackers to execute\n arbitrary code.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-5815.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-5815.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2019-5815", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00111", "scoring_system": "epss", "scoring_elements": "0.2938", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00111", "scoring_system": "epss", "scoring_elements": "0.2918", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00111", "scoring_system": "epss", "scoring_elements": "0.29389", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00111", "scoring_system": "epss", "scoring_elements": "0.29402", "published_at": "2026-06-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-5815" }, { "reference_url": "https://bugs.chromium.org/p/chromium/issues/detail?id=930663", "reference_id": "", "reference_type": "", "scores": [], "url": "https://bugs.chromium.org/p/chromium/issues/detail?id=930663" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13698", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13698" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5805", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5805" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5806", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5806" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5807", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5807" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5808", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5808" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5809", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5809" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5810", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5810" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5811", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5811" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5813", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5813" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5814", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5814" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5815", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5815" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5818", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5818" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5819", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5819" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5820", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5820" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5821", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5821" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5822", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5822" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5823", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5823" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5824", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5824" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5825", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5825" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5826", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5826" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5827", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5827" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5828", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5828" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5829", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5829" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5830", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5830" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5831", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5831" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5832", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5832" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5833", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5833" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5834", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5834" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5836", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5836" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5837", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5837" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5838", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5838" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5839", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5839" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5840", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5840" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5841", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5841" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5842", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5842" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5843", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5843" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5847", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5847" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5848", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5848" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5849", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5849" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5850", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5850" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5851", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5851" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5852", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5852" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5853", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5853" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5854", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5854" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5855", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5855" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5856", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5856" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5857", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5857" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5858", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5858" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5859", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5859" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5860", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5860" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5861", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5861" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5862", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5862" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5864", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5864" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5865", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5865" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5867", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5867" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5868", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5868" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6503", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6503" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6504", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6504" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2019-5815.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2019-5815.yml" }, { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/issues/2630", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/issues/2630" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxslt/commit/08b62c25871b38d5d573515ca8a065b4b8f64f6b", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://gitlab.gnome.org/GNOME/libxslt/commit/08b62c25871b38d5d573515ca8a065b4b8f64f6b" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00010.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00010.html" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5815", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5815" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1702905", "reference_id": "1702905", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1702905" }, { "reference_url": "https://security.archlinux.org/ASA-201904-12", "reference_id": "ASA-201904-12", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-201904-12" }, { "reference_url": "https://security.archlinux.org/AVG-952", "reference_id": "AVG-952", "reference_type": "", "scores": [ { "value": "Critical", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-952" }, { "reference_url": "https://github.com/advisories/GHSA-vmfx-gcfq-wvm2", "reference_id": "GHSA-vmfx-gcfq-wvm2", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-vmfx-gcfq-wvm2" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2019:1021", "reference_id": "RHSA-2019:1021", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2019:1021" }, { "reference_url": "https://usn.ubuntu.com/5575-1/", "reference_id": "USN-5575-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5575-1/" }, { "reference_url": "https://usn.ubuntu.com/5575-2/", "reference_id": "USN-5575-2", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5575-2/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/15535?format=api", "purl": "pkg:gem/nokogiri@1.10.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-18br-sw9t-9ue7" }, { "vulnerability": "VCID-2577-3bpb-pkgr" }, { "vulnerability": "VCID-2vtx-kt21-wuac" }, { "vulnerability": "VCID-3kej-ecyc-2ka6" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-ahe3-n9yg-sqgq" }, { "vulnerability": "VCID-ahte-mbyn-2fh6" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-bgqs-y35v-vuae" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-g7g7-vevx-hkej" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-hwva-pek4-5fb7" }, { "vulnerability": "VCID-kqcu-jg4b-ykcd" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-sn7m-5bry-13fp" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-x37v-jdmd-wbes" }, { "vulnerability": "VCID-x3bk-gdmn-xyhu" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-yr3x-bvad-mfcc" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.10.4" }, { "url": "http://public2.vulnerablecode.io/api/packages/384510?format=api", "purl": "pkg:gem/nokogiri@1.10.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-18br-sw9t-9ue7" }, { "vulnerability": "VCID-2577-3bpb-pkgr" }, { "vulnerability": "VCID-2vtx-kt21-wuac" }, { "vulnerability": "VCID-3kej-ecyc-2ka6" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-ahe3-n9yg-sqgq" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-g7g7-vevx-hkej" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-hwva-pek4-5fb7" }, { "vulnerability": "VCID-kqcu-jg4b-ykcd" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-sn7m-5bry-13fp" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-x37v-jdmd-wbes" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-yr3x-bvad-mfcc" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.10.5" } ], "aliases": [ "CVE-2019-5815", "GHSA-vmfx-gcfq-wvm2" ], "risk_score": 4.5, "exploitability": "0.5", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-v77z-t5z4-93cq" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/115102?format=api", "vulnerability_id": "VCID-va8n-ev2d-53a2", "summary": "security update", "references": [ { "reference_url": "http://lists.opensuse.org/opensuse-updates/2015-12/msg00120.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://lists.opensuse.org/opensuse-updates/2015-12/msg00120.html" }, { "reference_url": "http://lists.opensuse.org/opensuse-updates/2016-01/msg00031.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://lists.opensuse.org/opensuse-updates/2016-01/msg00031.html" }, { "reference_url": "http://rhn.redhat.com/errata/RHSA-2015-2549.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://rhn.redhat.com/errata/RHSA-2015-2549.html" }, { "reference_url": "http://rhn.redhat.com/errata/RHSA-2015-2550.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://rhn.redhat.com/errata/RHSA-2015-2550.html" }, { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-7499.json", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-7499.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2015-7499", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00714", "scoring_system": "epss", "scoring_elements": "0.72809", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00714", "scoring_system": "epss", "scoring_elements": "0.72902", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.00714", "scoring_system": "epss", "scoring_elements": "0.72887", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.00714", "scoring_system": "epss", "scoring_elements": "0.729", "published_at": "2026-06-14T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2015-7499" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1281925", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1281925" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1819", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1819" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5312", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5312" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7497", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7497" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7498", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7498" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7499", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7499" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7500", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7500" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7941", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7941" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7942", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7942" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8035", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8035" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8241", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8241" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8317", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8317" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8710", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8710" }, { "reference_url": "https://git.gnome.org/browse/libxml2/commit/?id=28cd9cb747a94483f4aea7f0968d202c20bb4cfc", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://git.gnome.org/browse/libxml2/commit/?id=28cd9cb747a94483f4aea7f0968d202c20bb4cfc" }, { "reference_url": "https://git.gnome.org/browse/libxml2/commit/?id=35bcb1d758ed70aa7b257c9c3b3ff55e54e3d0da", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://git.gnome.org/browse/libxml2/commit/?id=35bcb1d758ed70aa7b257c9c3b3ff55e54e3d0da" }, { "reference_url": "https://groups.google.com/forum/#!topic/ruby-security-ann/Dy7YiKb_pMM", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://groups.google.com/forum/#!topic/ruby-security-ann/Dy7YiKb_pMM" }, { "reference_url": "https://web.archive.org/web/20210724022841/http://www.securityfocus.com/bid/79509", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20210724022841/http://www.securityfocus.com/bid/79509" }, { "reference_url": "https://web.archive.org/web/20211205133229/https://securitytracker.com/id/1034243", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20211205133229/https://securitytracker.com/id/1034243" }, { "reference_url": "http://www.debian.org/security/2015/dsa-3430", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.debian.org/security/2015/dsa-3430" }, { "reference_url": "http://www.ubuntu.com/usn/USN-2834-1", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.ubuntu.com/usn/USN-2834-1" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7499", "reference_id": "CVE-2015-7499", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7499" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2015-7499.yml", "reference_id": "CVE-2015-7499.YML", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2015-7499.yml" }, { "reference_url": "https://github.com/advisories/GHSA-jxjr-5h69-qw3w", "reference_id": "GHSA-jxjr-5h69-qw3w", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-jxjr-5h69-qw3w" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2015:2549", "reference_id": "RHSA-2015:2549", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2015:2549" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2015:2550", "reference_id": "RHSA-2015:2550", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2015:2550" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:1089", "reference_id": "RHSA-2016:1089", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:1089" }, { "reference_url": "https://usn.ubuntu.com/2834-1/", "reference_id": "USN-2834-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/2834-1/" }, { "reference_url": "https://usn.ubuntu.com/2875-1/", "reference_id": "USN-2875-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/2875-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/13655?format=api", "purl": "pkg:gem/nokogiri@1.6.7.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14kb-seu7-9bcc" }, { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-18br-sw9t-9ue7" }, { "vulnerability": "VCID-2577-3bpb-pkgr" }, { "vulnerability": "VCID-2vtx-kt21-wuac" }, { "vulnerability": "VCID-3kej-ecyc-2ka6" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-4kgk-drcy-4beq" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-ahe3-n9yg-sqgq" }, { "vulnerability": "VCID-ahte-mbyn-2fh6" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-bgqs-y35v-vuae" }, { "vulnerability": "VCID-cnnd-sgk1-8qcu" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-eqeg-fdfg-vyag" }, { "vulnerability": "VCID-g7g7-vevx-hkej" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-hwva-pek4-5fb7" }, { "vulnerability": "VCID-jf45-a4cp-v7a7" }, { "vulnerability": "VCID-kqcu-jg4b-ykcd" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-mc8f-xxy6-u7f7" }, { "vulnerability": "VCID-ngg9-hp6h-sqfz" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-nt7b-her7-z3g8" }, { "vulnerability": "VCID-pk8z-1yjq-uqh5" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-qtu6-c9d8-1ydh" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-sn7m-5bry-13fp" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-v77z-t5z4-93cq" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-x37v-jdmd-wbes" }, { "vulnerability": "VCID-x3bk-gdmn-xyhu" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-yr3x-bvad-mfcc" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zwze-jyd4-6qhm" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.7.2" }, { "url": "http://public2.vulnerablecode.io/api/packages/407368?format=api", "purl": "pkg:gem/nokogiri@1.6.8.rc1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14kb-seu7-9bcc" }, { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-18br-sw9t-9ue7" }, { "vulnerability": "VCID-2577-3bpb-pkgr" }, { "vulnerability": "VCID-2vtx-kt21-wuac" }, { "vulnerability": "VCID-3kej-ecyc-2ka6" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-4kgk-drcy-4beq" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-ahe3-n9yg-sqgq" }, { "vulnerability": "VCID-ahte-mbyn-2fh6" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-bgqs-y35v-vuae" }, { "vulnerability": "VCID-cnnd-sgk1-8qcu" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-eqeg-fdfg-vyag" }, { "vulnerability": "VCID-g7g7-vevx-hkej" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-hwva-pek4-5fb7" }, { "vulnerability": "VCID-jf45-a4cp-v7a7" }, { "vulnerability": "VCID-kqcu-jg4b-ykcd" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-mc8f-xxy6-u7f7" }, { "vulnerability": "VCID-ngg9-hp6h-sqfz" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-nt7b-her7-z3g8" }, { "vulnerability": "VCID-pk8z-1yjq-uqh5" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-qtu6-c9d8-1ydh" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-sn7m-5bry-13fp" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-v77z-t5z4-93cq" }, { "vulnerability": "VCID-va8n-ev2d-53a2" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-x37v-jdmd-wbes" }, { "vulnerability": "VCID-x3bk-gdmn-xyhu" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-yr3x-bvad-mfcc" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zwze-jyd4-6qhm" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.8.rc1" } ], "aliases": [ "CVE-2015-7499", "GHSA-jxjr-5h69-qw3w" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-va8n-ev2d-53a2" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/359437?format=api", "vulnerability_id": "VCID-vfgg-89r3-aueu", "summary": "Nokogiri patches vendored libxml2 to resolve multiple CVEs\n## Summary\n\nNokogiri v1.18.9 patches the vendored libxml2 to address\nCVE-2025-6021, CVE-2025-6170, CVE-2025-49794, CVE-2025-49795,\nand CVE-2025-49796.\n\n## Impact and severity\n\n### CVE-2025-6021\n\nA flaw was found in libxml2's xmlBuildQName function, where integer\noverflows in buffer size calculations can lead to a stack-based\nbuffer overflow. This issue can result in memory corruption or a\ndenial of service when processing crafted input.\n\nNVD claims a severity of 7.5 High\n(CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)\n\nFixed by applying https://gitlab.gnome.org/GNOME/libxml2/-/commit/17d950ae\n\n### CVE-2025-6170\n\nA flaw was found in the interactive shell of the xmllint command-line\ntool, used for parsing XML files. When a user inputs an overly long\ncommand, the program does not check the input size properly, which\ncan cause it to crash. This issue might allow attackers to run\nharmful code in rare configurations without modern protections.\n\nNVD claims a severity of 2.5 Low\n(CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L)\n\nFixed by applying https://gitlab.gnome.org/GNOME/libxml2/-/commit/5e9ec5c1\n\n### CVE-2025-49794\n\nA use-after-free vulnerability was found in libxml2. This issue\noccurs when parsing XPath elements under certain circumstances when\nthe XML schematron has the <sch:name path=\"...\"/> schema elements.\nThis flaw allows a malicious actor to craft a malicious XML document\nused as input for libxml, resulting in the program's crash using\nlibxml or other possible undefined behaviors.\n\nNVD claims a severity of 9.1 Critical\n(CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)\n\nFixed by applying https://gitlab.gnome.org/GNOME/libxml2/-/commit/81cef8c5\n\n### CVE-2025-49795\n\nA NULL pointer dereference vulnerability was found in libxml2 when\nprocessing XPath XML expressions. This flaw allows an attacker to\ncraft a malicious XML input to libxml2, leading to a denial of service.\n\nNVD claims a severity of 7.5 High\n(CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)\n\nFixed by applying https://gitlab.gnome.org/GNOME/libxml2/-/commit/62048278\n\n### CVE-2025-49796\n\nA vulnerability was found in libxml2. Processing certain sch:name\nelements from the input XML file can trigger a memory corruption\nissue. This flaw allows an attacker to craft a malicious XML input\nfile that can lead libxml to crash, resulting in a denial of service\nor other possible undefined behavior due to sensitive data being\ncorrupted in memory.\n\nNVD claims a severity of 9.1 Critical\n(CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)\n\nFixed by applying https://gitlab.gnome.org/GNOME/libxml2/-/commit/81cef8c5\n\n## Affected Versions\n\n- Nokogiri < 1.18.9 when using CRuby (MRI) with vendored libxml2\n\n## Patched Versions\n\n- Nokogiri >= 1.18.9\n\n## Mitigation\n\nUpgrade to Nokogiri v1.18.9 or later.\n\nUsers who are unable to upgrade Nokogiri may also choose a more\ncomplicated mitigation: compile and link Nokogiri against patched\nexternal libxml2 libraries which will also address these same issues.", "references": [ { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/pull/3526", "reference_id": "", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/pull/3526" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-353f-x4gh-cqq8", "reference_id": "", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-353f-x4gh-cqq8" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49794", "reference_id": "", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49794" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49795", "reference_id": "", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49795" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49796", "reference_id": "", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49796" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6021", "reference_id": "", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6021" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6170", "reference_id": "", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6170" }, { "reference_url": "https://github.com/advisories/GHSA-353f-x4gh-cqq8", "reference_id": "GHSA-353f-x4gh-cqq8", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-353f-x4gh-cqq8" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/378377?format=api", "purl": "pkg:gem/nokogiri@1.18.9", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-w48v-grqb-u3gz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.18.9" } ], "aliases": [ "GHSA-353f-x4gh-cqq8" ], "risk_score": 4.5, "exploitability": "0.5", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-vfgg-89r3-aueu" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/359432?format=api", "vulnerability_id": "VCID-w48v-grqb-u3gz", "summary": "Nokogiri CSS selector tokenizer has regular expression backtracking\n## Summary\n\nNokogiri's CSS selector tokenizer contains regular expressions whose construction may result in exponential regex backtracking on adversarial selectors. Three ReDoS vectors are addressed in this release:\n\n1. String-literal tokenization on certain unterminated quoted-string input.\n2. String-literal tokenization on a separate class of hex-escape-rich input.\n3. Identifier tokenization on hex-escape-rich input.\n\nThe public CSS selector methods that funnel through the affected tokenizer are `Nokogiri::CSS.xpath_for`, `Node#css`, `Node#at_css`, `Searchable#search`, and `CSS::Parser#parse`.\n\n\n## Mitigation\n\nUpgrade to Nokogiri `>= 1.19.3`.\n\nIf users are unable to upgrade, two options are available:\n\n- Avoid the use of attacker-controlled text in CSS selectors. Applications that only pass developer-authored selectors to Nokogiri are not directly exposed.\n- Set global `Regexp.timeout` (Ruby 3.2+, JRuby 9.4+) to bound parse time.\n\n## Severity\n\nThe Nokogiri maintainers have evaluated this as **High Severity** (CVSS 7.5, `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`).\n\nAn attacker able to inject user-supplied text into a CSS selector parse method can cause exponential backtracking, resulting in a potential denial of service.\n\n\n## Resources\n\n- [CWE-1333: Inefficient Regular Expression Complexity](https://cwe.mitre.org/data/definitions/1333.html)\n\n\n## Credit\n\nVector 1 was responsibly reported by @colby-swandale. Vectors 2 and 3 were discovered by @flavorjones during the response to the original report.", "references": [ { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-c4rq-3m3g-8wgx", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-c4rq-3m3g-8wgx" }, { "reference_url": "https://github.com/advisories/GHSA-c4rq-3m3g-8wgx", "reference_id": "GHSA-c4rq-3m3g-8wgx", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-c4rq-3m3g-8wgx" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/375402?format=api", "purl": "pkg:gem/nokogiri@1.19.3", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.19.3" } ], "aliases": [ "GHSA-c4rq-3m3g-8wgx" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-w48v-grqb-u3gz" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/211765?format=api", "vulnerability_id": "VCID-w7rs-2k33-huft", "summary": "Nokogiri updates packaged libxml2 to v2.12.7 to resolve CVE-2024-34459", "references": [ { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.16.5", "reference_id": "", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.16.5" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/2876ac53", "reference_id": "", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/2876ac53" }, { "reference_url": "https://github.com/advisories/GHSA-r95h-9x8f-r3f7", "reference_id": "GHSA-r95h-9x8f-r3f7", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-r95h-9x8f-r3f7" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-r95h-9x8f-r3f7", "reference_id": "GHSA-r95h-9x8f-r3f7", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-r95h-9x8f-r3f7" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-r95h-9x8f-r3f7.yml", "reference_id": "GHSA-r95h-9x8f-r3f7.yml", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-r95h-9x8f-r3f7.yml" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/31006?format=api", "purl": "pkg:gem/nokogiri@1.16.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.16.5" } ], "aliases": [ "GHSA-r95h-9x8f-r3f7" ], "risk_score": 1.4, "exploitability": "0.5", "weighted_severity": "2.7", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-w7rs-2k33-huft" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/9705?format=api", "vulnerability_id": "VCID-x37v-jdmd-wbes", "summary": "", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-3517.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-3517.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-3517", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00107", "scoring_system": "epss", "scoring_elements": "0.28413", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.00107", "scoring_system": "epss", "scoring_elements": "0.28624", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.00107", "scoring_system": "epss", "scoring_elements": "0.28633", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.00107", "scoring_system": "epss", "scoring_elements": "0.28609", "published_at": "2026-06-12T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-3517" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3517", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3517" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/blob/7c19ef5cc6b7c5c36827dd5495f857c6877ec8cf/CHANGELOG.md?plain=1#L579", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/blob/7c19ef5cc6b7c5c36827dd5495f857c6877ec8cf/CHANGELOG.md?plain=1#L579" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/issues/2233", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/issues/2233" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/issues/2274", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/issues/2274" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/8598060bacada41a0eb09d95c97744ff4e428f8e", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/8598060bacada41a0eb09d95c97744ff4e428f8e" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20210625-0002", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20210625-0002" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20211022-0004", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20211022-0004" }, { "reference_url": "https://security.gentoo.org/glsa/202107-05", "reference_id": "202107-05", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-02T21:32:30Z/" } ], "url": "https://security.gentoo.org/glsa/202107-05" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=987738", "reference_id": "987738", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=987738" }, { "reference_url": "https://security.archlinux.org/AVG-1883", "reference_id": "AVG-1883", "reference_type": "", "scores": [ { "value": "High", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1883" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/", "reference_id": "BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-02T21:32:30Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/" }, { "reference_url": "https://www.oracle.com/security-alerts/cpuapr2022.html", "reference_id": "cpuapr2022.html", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-02T21:32:30Z/" } ], "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" }, { "reference_url": "https://www.oracle.com/security-alerts/cpujan2022.html", "reference_id": "cpujan2022.html", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-02T21:32:30Z/" } ], "url": "https://www.oracle.com/security-alerts/cpujan2022.html" }, { "reference_url": "https://www.oracle.com/security-alerts/cpujul2022.html", "reference_id": "cpujul2022.html", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-02T21:32:30Z/" } ], "url": "https://www.oracle.com/security-alerts/cpujul2022.html" }, { "reference_url": "https://www.oracle.com/security-alerts/cpuoct2021.html", "reference_id": "cpuoct2021.html", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-02T21:32:30Z/" } ], "url": "https://www.oracle.com/security-alerts/cpuoct2021.html" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3517", "reference_id": "CVE-2021-3517", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3517" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2021-3517.yml", "reference_id": "CVE-2021-3517.YML", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2021-3517.yml" }, { "reference_url": "https://github.com/advisories/GHSA-jw9f-hh49-cvp9", "reference_id": "GHSA-jw9f-hh49-cvp9", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-jw9f-hh49-cvp9" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html", "reference_id": "msg00008.html", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-02T21:32:30Z/" } ], "url": "https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20210625-0002/", "reference_id": "ntap-20210625-0002", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-02T21:32:30Z/" } ], "url": "https://security.netapp.com/advisory/ntap-20210625-0002/" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20211022-0004/", "reference_id": "ntap-20211022-0004", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-02T21:32:30Z/" } ], "url": "https://security.netapp.com/advisory/ntap-20211022-0004/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/", "reference_id": "QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-02T21:32:30Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/" }, { "reference_url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E", "reference_id": "r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-02T21:32:30Z/" } ], "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E", "reference_id": "rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-02T21:32:30Z/" } ], "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:2569", "reference_id": "RHSA-2021:2569", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:2569" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1389", "reference_id": "RHSA-2022:1389", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1389" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1390", "reference_id": "RHSA-2022:1390", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1390" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1954232", "reference_id": "show_bug.cgi?id=1954232", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-02T21:32:30Z/" } ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1954232" }, { "reference_url": "https://usn.ubuntu.com/4991-1/", "reference_id": "USN-4991-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/4991-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/23358?format=api", "purl": "pkg:gem/nokogiri@1.11.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-2vtx-kt21-wuac" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-ahe3-n9yg-sqgq" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-yr3x-bvad-mfcc" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.11.4" } ], "aliases": [ "CVE-2021-3517", "GHSA-jw9f-hh49-cvp9" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-x37v-jdmd-wbes" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/6231?format=api", "vulnerability_id": "VCID-x3bk-gdmn-xyhu", "summary": "", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-13117.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-13117.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2019-13117", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.04376", "scoring_system": "epss", "scoring_elements": "0.89259", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.04376", "scoring_system": "epss", "scoring_elements": "0.89251", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.04376", "scoring_system": "epss", "scoring_elements": "0.89258", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.04376", "scoring_system": "epss", "scoring_elements": "0.89213", "published_at": "2026-06-11T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-13117" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13117", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13117" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2019-13117.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2019-13117.yml" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/issues/1943", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/issues/1943" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2019-13117", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-13117" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20190806-0004", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20190806-0004" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20200122-0003", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20200122-0003" }, { "reference_url": "https://usn.ubuntu.com/4164-1", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://usn.ubuntu.com/4164-1" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1728546", "reference_id": "1728546", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1728546" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2019/11/17/2", "reference_id": "2", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:31:22Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2019/11/17/2" }, { "reference_url": "https://usn.ubuntu.com/4164-1/", "reference_id": "4164-1", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:31:22Z/" } ], "url": "https://usn.ubuntu.com/4164-1/" }, { "reference_url": "https://oss-fuzz.com/testcase-detail/5631739747106816", "reference_id": "5631739747106816", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:31:22Z/" } ], "url": "https://oss-fuzz.com/testcase-detail/5631739747106816" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931321", "reference_id": "931321", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931321" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxslt/commit/c5eb6cf3aba0af048596106ed839b4ae17ecbcb1", "reference_id": "c5eb6cf3aba0af048596106ed839b4ae17ecbcb1", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:31:22Z/" } ], "url": "https://gitlab.gnome.org/GNOME/libxslt/commit/c5eb6cf3aba0af048596106ed839b4ae17ecbcb1" }, { "reference_url": "https://www.oracle.com/security-alerts/cpujan2020.html", "reference_id": "cpujan2020.html", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:31:22Z/" } ], "url": "https://www.oracle.com/security-alerts/cpujan2020.html" }, { "reference_url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14471", "reference_id": "detail?id=14471", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:31:22Z/" } ], "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14471" }, { "reference_url": "https://github.com/advisories/GHSA-4hm9-844j-jmxp", "reference_id": "GHSA-4hm9-844j-jmxp", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-4hm9-844j-jmxp" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ/", "reference_id": "IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:31:22Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ/" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2019/07/msg00020.html", "reference_id": "msg00020.html", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:31:22Z/" } ], "url": "https://lists.debian.org/debian-lts-announce/2019/07/msg00020.html" }, { "reference_url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html", "reference_id": "msg00062.html", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:31:22Z/" } ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20190806-0004/", "reference_id": "ntap-20190806-0004", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:31:22Z/" } ], "url": "https://security.netapp.com/advisory/ntap-20190806-0004/" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20200122-0003/", "reference_id": "ntap-20200122-0003", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:31:22Z/" } ], "url": "https://security.netapp.com/advisory/ntap-20200122-0003/" }, { "reference_url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E", "reference_id": "r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:31:22Z/" } ], "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E", "reference_id": "rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:31:22Z/" } ], "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/384510?format=api", "purl": "pkg:gem/nokogiri@1.10.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-18br-sw9t-9ue7" }, { "vulnerability": "VCID-2577-3bpb-pkgr" }, { "vulnerability": "VCID-2vtx-kt21-wuac" }, { "vulnerability": "VCID-3kej-ecyc-2ka6" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-ahe3-n9yg-sqgq" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-g7g7-vevx-hkej" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-hwva-pek4-5fb7" }, { "vulnerability": "VCID-kqcu-jg4b-ykcd" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-sn7m-5bry-13fp" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-x37v-jdmd-wbes" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-yr3x-bvad-mfcc" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.10.5" } ], "aliases": [ "CVE-2019-13117", "GHSA-4hm9-844j-jmxp" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-x3bk-gdmn-xyhu" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/360585?format=api", "vulnerability_id": "VCID-xsrn-bd5u-2ufz", "summary": "Duplicate Advisory: Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171\n# Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-vvfq-8hwr-qm4m. This link is maintained to preserve external references.\n\n# Original Description\n\n## Summary\n\nNokogiri v1.18.3 upgrades its dependency libxml2 to\n[v2.13.6](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.6).\n\nlibxml2 v2.13.6 addresses:\n\n- CVE-2025-24928\n - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/847\n- CVE-2024-56171\n - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/828\n\n## Impact\n\n### CVE-2025-24928\n\nStack-buffer overflow is possible when reporting DTD validation\nerrors if the input contains a long (~3kb) QName prefix.\n\n### CVE-2024-56171\n\nUse-after-free is possible during validation against untrusted\nXML Schemas (.xsd) and, potentially, validation of untrusted documents\nagainst trusted Schemas if they make use of `xsd:keyref` in combination\nwith recursively defined types that have additional identity constraints.", "references": [ { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-vvfq-8hwr-qm4m.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-vvfq-8hwr-qm4m.yml" }, { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vvfq-8hwr-qm4m", "reference_id": "", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vvfq-8hwr-qm4m" }, { "reference_url": "https://github.com/advisories/GHSA-5mwf-688x-mr7x", "reference_id": "GHSA-5mwf-688x-mr7x", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-5mwf-688x-mr7x" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/377245?format=api", "purl": "pkg:gem/nokogiri@1.18.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.18.3" } ], "aliases": [ "GHSA-5mwf-688x-mr7x" ], "risk_score": 1.4, "exploitability": "0.5", "weighted_severity": "2.7", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-xsrn-bd5u-2ufz" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/209275?format=api", "vulnerability_id": "VCID-xy21-uzq3-ebhu", "summary": "Nokogiri vulnerable to DoS while parsing XML entities", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-6461.json", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-6461.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2013-6461", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.02046", "scoring_system": "epss", "scoring_elements": "0.84283", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.02046", "scoring_system": "epss", "scoring_elements": "0.84288", "published_at": "2026-06-13T12:55:00Z" }, { "value": "0.02046", "scoring_system": "epss", "scoring_elements": "0.8428", "published_at": "2026-06-12T12:55:00Z" }, { "value": "0.02046", "scoring_system": "epss", "scoring_elements": "0.84225", "published_at": "2026-06-11T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2013-6461" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6461", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6461" }, { "reference_url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90059", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90059" }, { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://groups.google.com/forum/#!topic/ruby-security-ann/DeJpjTAg1FA", "reference_id": "", "reference_type": "", "scores": [], "url": "https://groups.google.com/forum/#!topic/ruby-security-ann/DeJpjTAg1FA" }, { "reference_url": "https://web.archive.org/web/20200804224345/https://www.securityfocus.com/bid/64513", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20200804224345/https://www.securityfocus.com/bid/64513" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2013/12/27/2", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2013/12/27/2" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1046664", "reference_id": "1046664", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1046664" }, { "reference_url": "https://access.redhat.com/security/cve/cve-2013-6461", "reference_id": "CVE-2013-6461", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://access.redhat.com/security/cve/cve-2013-6461" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6461", "reference_id": "CVE-2013-6461", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6461" }, { "reference_url": "https://security-tracker.debian.org/tracker/CVE-2013-6461", "reference_id": "CVE-2013-6461", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security-tracker.debian.org/tracker/CVE-2013-6461" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2013-6461.yml", "reference_id": "CVE-2013-6461.YML", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2013-6461.yml" }, { "reference_url": "https://github.com/advisories/GHSA-jmhh-w7xp-wg39", "reference_id": "GHSA-jmhh-w7xp-wg39", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-jmhh-w7xp-wg39" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/20783?format=api", "purl": "pkg:gem/nokogiri@1.5.11", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14kb-seu7-9bcc" }, { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-18br-sw9t-9ue7" }, { "vulnerability": "VCID-2577-3bpb-pkgr" }, { "vulnerability": "VCID-2vtx-kt21-wuac" }, { "vulnerability": "VCID-3kej-ecyc-2ka6" }, { "vulnerability": "VCID-3z3h-7s7d-zbaz" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-4e3h-nwws-abh1" }, { "vulnerability": "VCID-4kgk-drcy-4beq" }, { "vulnerability": "VCID-7cqg-h2ws-hfh1" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-ahe3-n9yg-sqgq" }, { "vulnerability": "VCID-ahte-mbyn-2fh6" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-bgqs-y35v-vuae" }, { "vulnerability": "VCID-cnnd-sgk1-8qcu" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-djuu-6gdw-cuav" }, { "vulnerability": "VCID-eqeg-fdfg-vyag" }, { "vulnerability": "VCID-g7g7-vevx-hkej" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-hwva-pek4-5fb7" }, { "vulnerability": "VCID-jf45-a4cp-v7a7" }, { "vulnerability": "VCID-kqcu-jg4b-ykcd" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-mc8f-xxy6-u7f7" }, { "vulnerability": "VCID-ngg9-hp6h-sqfz" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-nt7b-her7-z3g8" }, { "vulnerability": "VCID-payk-mek8-kka3" }, { "vulnerability": "VCID-pk8z-1yjq-uqh5" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-qtu6-c9d8-1ydh" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-sn7m-5bry-13fp" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-v77z-t5z4-93cq" }, { "vulnerability": "VCID-va8n-ev2d-53a2" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-x37v-jdmd-wbes" }, { "vulnerability": "VCID-x3bk-gdmn-xyhu" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-yr3x-bvad-mfcc" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zwze-jyd4-6qhm" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.5.11" }, { "url": "http://public2.vulnerablecode.io/api/packages/388476?format=api", "purl": "pkg:gem/nokogiri@1.6.0.rc1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14kb-seu7-9bcc" }, { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-18br-sw9t-9ue7" }, { "vulnerability": "VCID-2577-3bpb-pkgr" }, { "vulnerability": "VCID-2vtx-kt21-wuac" }, { "vulnerability": "VCID-3kej-ecyc-2ka6" }, { "vulnerability": "VCID-3z3h-7s7d-zbaz" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-4e3h-nwws-abh1" }, { "vulnerability": "VCID-4kgk-drcy-4beq" }, { "vulnerability": "VCID-7cqg-h2ws-hfh1" }, { "vulnerability": "VCID-7qnq-6za5-6ubz" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-ahe3-n9yg-sqgq" }, { "vulnerability": "VCID-ahte-mbyn-2fh6" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-bgqs-y35v-vuae" }, { "vulnerability": "VCID-cnnd-sgk1-8qcu" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-djuu-6gdw-cuav" }, { "vulnerability": "VCID-eqeg-fdfg-vyag" }, { "vulnerability": "VCID-g7g7-vevx-hkej" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-hwva-pek4-5fb7" }, { "vulnerability": "VCID-jf45-a4cp-v7a7" }, { "vulnerability": "VCID-kqcu-jg4b-ykcd" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-mc8f-xxy6-u7f7" }, { "vulnerability": "VCID-ngg9-hp6h-sqfz" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-nt7b-her7-z3g8" }, { "vulnerability": "VCID-payk-mek8-kka3" }, { "vulnerability": "VCID-pk8z-1yjq-uqh5" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-qtu6-c9d8-1ydh" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-sn7m-5bry-13fp" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-v77z-t5z4-93cq" }, { "vulnerability": "VCID-va8n-ev2d-53a2" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-x37v-jdmd-wbes" }, { "vulnerability": "VCID-x3bk-gdmn-xyhu" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-xy21-uzq3-ebhu" }, { "vulnerability": "VCID-yr3x-bvad-mfcc" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zwze-jyd4-6qhm" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.0.rc1" }, { "url": "http://public2.vulnerablecode.io/api/packages/20781?format=api", "purl": "pkg:gem/nokogiri@1.6.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14kb-seu7-9bcc" }, { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-18br-sw9t-9ue7" }, { "vulnerability": "VCID-2577-3bpb-pkgr" }, { "vulnerability": "VCID-2vtx-kt21-wuac" }, { "vulnerability": "VCID-3kej-ecyc-2ka6" }, { "vulnerability": "VCID-3z3h-7s7d-zbaz" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-4e3h-nwws-abh1" }, { "vulnerability": "VCID-4kgk-drcy-4beq" }, { "vulnerability": "VCID-7cqg-h2ws-hfh1" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-ahe3-n9yg-sqgq" }, { "vulnerability": "VCID-ahte-mbyn-2fh6" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-bgqs-y35v-vuae" }, { "vulnerability": "VCID-cnnd-sgk1-8qcu" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-djuu-6gdw-cuav" }, { "vulnerability": "VCID-eqeg-fdfg-vyag" }, { "vulnerability": "VCID-g7g7-vevx-hkej" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-hwva-pek4-5fb7" }, { "vulnerability": "VCID-jf45-a4cp-v7a7" }, { "vulnerability": "VCID-kqcu-jg4b-ykcd" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-mc8f-xxy6-u7f7" }, { "vulnerability": "VCID-ngg9-hp6h-sqfz" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-nt7b-her7-z3g8" }, { "vulnerability": "VCID-payk-mek8-kka3" }, { "vulnerability": "VCID-pk8z-1yjq-uqh5" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-qtu6-c9d8-1ydh" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-sn7m-5bry-13fp" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-u51x-afpr-a7gt" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-v77z-t5z4-93cq" }, { "vulnerability": "VCID-va8n-ev2d-53a2" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-x37v-jdmd-wbes" }, { "vulnerability": "VCID-x3bk-gdmn-xyhu" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-yr3x-bvad-mfcc" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zwze-jyd4-6qhm" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.1" } ], "aliases": [ "CVE-2013-6461", "GHSA-jmhh-w7xp-wg39", "OSV-101458" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-xy21-uzq3-ebhu" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/208286?format=api", "vulnerability_id": "VCID-yr3x-bvad-mfcc", "summary": "Vulnerable dependencies in Nokogiri", "references": [ { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/advisories/GHSA-fq42-c5rg-92c2", "reference_id": "GHSA-fq42-c5rg-92c2", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-fq42-c5rg-92c2" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-fq42-c5rg-92c2", "reference_id": "GHSA-fq42-c5rg-92c2", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-fq42-c5rg-92c2" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/19515?format=api", "purl": "pkg:gem/nokogiri@1.13.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.13.2" } ], "aliases": [ "GHSA-fq42-c5rg-92c2", "GMS-2022-163" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-yr3x-bvad-mfcc" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/211769?format=api", "vulnerability_id": "VCID-z2bq-warv-47c1", "summary": "Duplicate Advisory: Nokogiri updates packaged libxml2 to v2.12.7 to resolve CVE-2024-34459", "references": [ { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/advisories/GHSA-r3w4-36x6-7r99", "reference_id": "GHSA-r3w4-36x6-7r99", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-r3w4-36x6-7r99" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-r95h-9x8f-r3f7", "reference_id": "GHSA-r95h-9x8f-r3f7", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-r95h-9x8f-r3f7" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-r95h-9x8f-r3f7.yml", "reference_id": "GHSA-r95h-9x8f-r3f7.yml", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-r95h-9x8f-r3f7.yml" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/31006?format=api", "purl": "pkg:gem/nokogiri@1.16.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.16.5" } ], "aliases": [ "GHSA-r3w4-36x6-7r99" ], "risk_score": 1.4, "exploitability": "0.5", "weighted_severity": "2.7", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-z2bq-warv-47c1" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/359436?format=api", "vulnerability_id": "VCID-zntu-4vu6-rkbt", "summary": "Integer Overflow or Wraparound in libxml2 affects Nokogiri\n### Summary\n\nNokogiri v1.13.5 upgrades the packaged version of its dependency libxml2 from\nv2.9.13 to [v2.9.14](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.9.14).\n\nlibxml2 v2.9.14 addresses [CVE-2022-29824](https://nvd.nist.gov/vuln/detail/CVE-2022-29824).\nThis version also includes several security-related bug fixes for which CVEs were not created,\nincluding a potential double-free, potential memory leaks, and integer-overflow.\n\nPlease note that this advisory only applies to the CRuby implementation of Nokogiri\n`< 1.13.5`, and only if the _packaged_ libraries are being used. If you've overridden\ndefaults at installation time to use _system_ libraries instead of packaged libraries,\nyou should instead pay attention to your distro's `libxml2` and `libxslt` release announcements.\n\n### Mitigation\n\nUpgrade to Nokogiri `>= 1.13.5`.\n\nUsers who are unable to upgrade Nokogiri may also choose a more complicated mitigation:\ncompile and link Nokogiri against external libraries libxml2 `>= 2.9.14` which will also\naddress these same issues.\n\n### Impact\n\n#### libxml2 [CVE-2022-29824](https://nvd.nist.gov/vuln/detail/CVE-2022-29824)\n\n- **CVSS3 score**:\n - Unspecified upstream\n - Nokogiri maintainers evaluate at 8.6 (High) ([CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H)) Note that this is different from the CVSS assessed by NVD.\n- **Type**: Denial of service, information disclosure\n- **Description**: In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.\n- **Fixed**: https://gitlab.gnome.org/GNOME/libxml2/-/commit/2554a24\n\nAll versions of libml2 prior to v2.9.14 are affected.\n\nApplications parsing or serializing multi-gigabyte documents (in excess of INT_MAX bytes) may be vulnerable to an integer overflow bug in buffer handling that could lead to exposure of confidential data, modification of unrelated data, or a segmentation fault resulting in a denial-of-service.\n\n\n### References\n\n- [libxml2 v2.9.14 release notes](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.9.14)\n- [CVE-2022-29824](https://nvd.nist.gov/vuln/detail/CVE-2022-29824)\n- [CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer](https://cwe.mitre.org/data/definitions/119.html)", "references": [ { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-cgx6-hpwq-fhv5", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-cgx6-hpwq-fhv5" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.9.14", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.9.14" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29824", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29824" }, { "reference_url": "https://github.com/advisories/GHSA-cgx6-hpwq-fhv5", "reference_id": "GHSA-cgx6-hpwq-fhv5", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-cgx6-hpwq-fhv5" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/385433?format=api", "purl": "pkg:gem/nokogiri@1.13.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.13.5" } ], "aliases": [ "GHSA-cgx6-hpwq-fhv5", "GMS-2022-1438" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-zntu-4vu6-rkbt" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/570?format=api", "vulnerability_id": "VCID-zwze-jyd4-6qhm", "summary": "", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-8806.json", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-8806.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2015-8806", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.08565", "scoring_system": "epss", "scoring_elements": "0.92588", "published_at": "2026-06-11T12:55:00Z" }, { "value": "0.08565", "scoring_system": "epss", "scoring_elements": "0.92617", "published_at": "2026-06-14T12:55:00Z" }, { "value": "0.08565", "scoring_system": "epss", "scoring_elements": "0.92614", "published_at": "2026-06-12T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2015-8806" }, { "reference_url": "https://bugzilla.gnome.org/show_bug.cgi?id=749115", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://bugzilla.gnome.org/show_bug.cgi?id=749115" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8806", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8806" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1762", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1762" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1833", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1833" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1834", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1834" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1835", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1835" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1836", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1836" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1837", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1837" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1838", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1838" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1839", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1839" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1840", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1840" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2073", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2073" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3627", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3627" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3705", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3705" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4447", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4447" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4449", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4449" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4483", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4483" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv2", "scoring_elements": "AV:N/AC:M/Au:N/C:P/I:N/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/commit/03d402212707bd5dfa0a21b7de5e91a7f9d90028", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/sparklemotion/nokogiri/commit/03d402212707bd5dfa0a21b7de5e91a7f9d90028" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/issues/1473", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/issues/1473" }, { "reference_url": "https://mail.gnome.org/archives/xml/2016-May/msg00023.html", "reference_id": "", "reference_type": "", "scores": [], "url": "https://mail.gnome.org/archives/xml/2016-May/msg00023.html" }, { "reference_url": "https://web.archive.org/web/20160928171015/http://www.securityfocus.com/bid/82071", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20160928171015/http://www.securityfocus.com/bid/82071" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2016/02/03/5", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2016/02/03/5" }, { "reference_url": "http://www.ubuntu.com/usn/usn-2994-1/", "reference_id": "", "reference_type": "", "scores": [], "url": "http://www.ubuntu.com/usn/usn-2994-1/" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1304636", "reference_id": "1304636", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1304636" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=813613", "reference_id": "813613", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=813613" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8806", "reference_id": "CVE-2015-8806", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8806" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2015-8806.yml", "reference_id": "CVE-2015-8806.YML", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2015-8806.yml" }, { "reference_url": "https://github.com/advisories/GHSA-7hp2-xwpj-95jq", "reference_id": "GHSA-7hp2-xwpj-95jq", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-7hp2-xwpj-95jq" }, { "reference_url": "https://usn.ubuntu.com/2994-1/", "reference_id": "USN-2994-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/2994-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/13650?format=api", "purl": "pkg:gem/nokogiri@1.6.8", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14kb-seu7-9bcc" }, { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-18br-sw9t-9ue7" }, { "vulnerability": "VCID-2577-3bpb-pkgr" }, { "vulnerability": "VCID-2vtx-kt21-wuac" }, { "vulnerability": "VCID-3kej-ecyc-2ka6" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-49ww-fg7b-zugq" }, { "vulnerability": "VCID-4kgk-drcy-4beq" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-ahe3-n9yg-sqgq" }, { "vulnerability": "VCID-ahte-mbyn-2fh6" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-bgqs-y35v-vuae" }, { "vulnerability": "VCID-cnnd-sgk1-8qcu" }, { "vulnerability": "VCID-dbue-58uu-ybaz" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-eqeg-fdfg-vyag" }, { "vulnerability": "VCID-g7g7-vevx-hkej" }, { "vulnerability": "VCID-g8h5-nbxj-y7fe" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-hwva-pek4-5fb7" }, { "vulnerability": "VCID-jf45-a4cp-v7a7" }, { "vulnerability": "VCID-kqcu-jg4b-ykcd" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-m3bc-ah2t-p3b4" }, { "vulnerability": "VCID-mc8f-xxy6-u7f7" }, { "vulnerability": "VCID-ngg9-hp6h-sqfz" }, { "vulnerability": "VCID-nscm-fqz2-fbge" }, { "vulnerability": "VCID-nt7b-her7-z3g8" }, { "vulnerability": "VCID-pk8z-1yjq-uqh5" }, { "vulnerability": "VCID-pqm3-2t49-rqat" }, { "vulnerability": "VCID-qtu6-c9d8-1ydh" }, { "vulnerability": "VCID-s2mc-whzr-sbb8" }, { "vulnerability": "VCID-sn7m-5bry-13fp" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-v47q-qyuj-gba7" }, { "vulnerability": "VCID-v77z-t5z4-93cq" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-x37v-jdmd-wbes" }, { "vulnerability": "VCID-x3bk-gdmn-xyhu" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-yr3x-bvad-mfcc" }, { "vulnerability": "VCID-z2bq-warv-47c1" }, { "vulnerability": "VCID-zntu-4vu6-rkbt" }, { "vulnerability": "VCID-zyww-4npa-gkeq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.8" } ], "aliases": [ "CVE-2015-8806", "GHSA-7hp2-xwpj-95jq" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-zwze-jyd4-6qhm" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/211455?format=api", "vulnerability_id": "VCID-zyww-4npa-gkeq", "summary": "Update bundled libxml2 to v2.10.3 to resolve multiple CVEs", "references": [ { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/advisories/GHSA-2qc6-mcvw-92cw", "reference_id": "GHSA-2qc6-mcvw-92cw", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-2qc6-mcvw-92cw" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-2qc6-mcvw-92cw", "reference_id": "GHSA-2qc6-mcvw-92cw", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-2qc6-mcvw-92cw" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/27390?format=api", "purl": "pkg:gem/nokogiri@1.13.9", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-14st-5sfb-jfhk" }, { "vulnerability": "VCID-47qk-3n97-wfb7" }, { "vulnerability": "VCID-8ftz-ajmp-jba8" }, { "vulnerability": "VCID-bfux-puuz-p3fb" }, { "vulnerability": "VCID-df5z-dpbb-r7cv" }, { "vulnerability": "VCID-gbwe-1wq8-83bf" }, { "vulnerability": "VCID-m2bp-rxcw-myg9" }, { "vulnerability": "VCID-tntw-mt23-k7gh" }, { "vulnerability": "VCID-umph-eaje-7khu" }, { "vulnerability": "VCID-vfgg-89r3-aueu" }, { "vulnerability": "VCID-w48v-grqb-u3gz" }, { "vulnerability": "VCID-w7rs-2k33-huft" }, { "vulnerability": "VCID-xsrn-bd5u-2ufz" }, { "vulnerability": "VCID-z2bq-warv-47c1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.13.9" } ], "aliases": [ "GHSA-2qc6-mcvw-92cw", "GMS-2022-5550" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-zyww-4npa-gkeq" } ], "fixing_vulnerabilities": [], "risk_score": "4.5", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.5.1" }