Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/76765?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/76765?format=api", "purl": "pkg:gem/nokogiri@1.5.0", "type": "gem", "namespace": "", "name": "nokogiri", "version": "1.5.0", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "1.19.3", "latest_non_vulnerable_version": "1.19.3", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/347511?format=api", "vulnerability_id": "VCID-12a5-5jss-nfd1", "summary": "Duplicate Advisory: Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171\n# Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-vvfq-8hwr-qm4m. This link is maintained to preserve external references.\n\n# Original Description\n\n## Summary\n\nNokogiri v1.18.3 upgrades its dependency libxml2 to\n[v2.13.6](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.6).\n\nlibxml2 v2.13.6 addresses:\n\n- CVE-2025-24928\n - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/847\n- CVE-2024-56171\n - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/828\n\n## Impact\n\n### CVE-2025-24928\n\nStack-buffer overflow is possible when reporting DTD validation\nerrors if the input contains a long (~3kb) QName prefix.\n\n### CVE-2024-56171\n\nUse-after-free is possible during validation against untrusted\nXML Schemas (.xsd) and, potentially, validation of untrusted documents\nagainst trusted Schemas if they make use of `xsd:keyref` in combination\nwith recursively defined types that have additional identity constraints.", "references": [ { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-vvfq-8hwr-qm4m.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-vvfq-8hwr-qm4m.yml" }, { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vvfq-8hwr-qm4m", "reference_id": "", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vvfq-8hwr-qm4m" }, { "reference_url": "https://github.com/advisories/GHSA-5mwf-688x-mr7x", "reference_id": "GHSA-5mwf-688x-mr7x", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-5mwf-688x-mr7x" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/165996?format=api", "purl": "pkg:gem/nokogiri@1.18.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.18.3" } ], "aliases": [ "GHSA-5mwf-688x-mr7x" ], "risk_score": 1.4, "exploitability": "0.5", "weighted_severity": "2.7", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-12a5-5jss-nfd1" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/5985?format=api", "vulnerability_id": "VCID-12ee-na2t-6kg5", "summary": "multiple issues", "references": [ { "reference_url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00047.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/" } ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00047.html" }, { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-7595.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-7595.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2020-7595", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00476", "scoring_system": "epss", "scoring_elements": "0.65205", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-7595" }, { "reference_url": "https://cert-portal.siemens.com/productcert/pdf/ssa-292794.pdf", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/" } ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-292794.pdf" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7595", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7595" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/issues/1992", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/issues/1992" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/commit/0e1a49c89076", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/" } ], "url": "https://gitlab.gnome.org/GNOME/libxml2/commit/0e1a49c89076" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/" } ], "url": "https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/545SPOI3ZPPNPX4TFRIVE4JVRTJRKULL", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/545SPOI3ZPPNPX4TFRIVE4JVRTJRKULL" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/545SPOI3ZPPNPX4TFRIVE4JVRTJRKULL/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/545SPOI3ZPPNPX4TFRIVE4JVRTJRKULL/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH/" }, { "reference_url": "https://security.gentoo.org/glsa/202010-04", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/" } ], "url": "https://security.gentoo.org/glsa/202010-04" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20200702-0005", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20200702-0005" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20200702-0005/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/" } ], "url": "https://security.netapp.com/advisory/ntap-20200702-0005/" }, { "reference_url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-103-08", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/" } ], "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-103-08" }, { "reference_url": "https://usn.ubuntu.com/4274-1", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://usn.ubuntu.com/4274-1" }, { "reference_url": "https://usn.ubuntu.com/4274-1/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/" } ], "url": "https://usn.ubuntu.com/4274-1/" }, { "reference_url": "https://www.oracle.com/security-alerts/cpuapr2022.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/" } ], "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" }, { "reference_url": "https://www.oracle.com/security-alerts/cpujul2020.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/" } ], "url": "https://www.oracle.com/security-alerts/cpujul2020.html" }, { "reference_url": "https://www.oracle.com/security-alerts/cpujul2022.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/" } ], "url": "https://www.oracle.com/security-alerts/cpujul2022.html" }, { "reference_url": "https://www.oracle.com/security-alerts/cpuoct2021.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/" } ], "url": "https://www.oracle.com/security-alerts/cpuoct2021.html" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1799786", "reference_id": "1799786", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1799786" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/545SPOI3ZPPNPX4TFRIVE4JVRTJRKULL/", "reference_id": "545SPOI3ZPPNPX4TFRIVE4JVRTJRKULL", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/545SPOI3ZPPNPX4TFRIVE4JVRTJRKULL/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI/", "reference_id": "5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI/" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=949582", "reference_id": "949582", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=949582" }, { "reference_url": "https://security.archlinux.org/ASA-202011-15", "reference_id": "ASA-202011-15", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-202011-15" }, { "reference_url": "https://security.archlinux.org/AVG-1263", "reference_id": "AVG-1263", "reference_type": "", "scores": [ { "value": "Medium", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1263" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7595", "reference_id": "CVE-2020-7595", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7595" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2020-7595.yml", "reference_id": "CVE-2020-7595.YML", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2020-7595.yml" }, { "reference_url": "https://github.com/advisories/GHSA-7553-jr98-vx47", "reference_id": "GHSA-7553-jr98-vx47", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-7553-jr98-vx47" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH/", "reference_id": "JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-12-03T15:33:37Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH/" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:2644", "reference_id": "RHSA-2020:2644", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2020:2644" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:2646", "reference_id": "RHSA-2020:2646", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2020:2646" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:3996", "reference_id": "RHSA-2020:3996", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2020:3996" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:4479", "reference_id": "RHSA-2020:4479", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2020:4479" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:0949", "reference_id": "RHSA-2021:0949", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:0949" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74677?format=api", "purl": "pkg:gem/nokogiri@1.10.8", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-24ud-18pe-dudw" }, { "vulnerability": "VCID-38c3-z9yc-4ybx" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-5wxq-ekcv-vqhq" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-9qtg-gxza-6ba9" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-cft6-gvm9-8qf4" }, { "vulnerability": "VCID-cq5z-6cmf-5kfs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-g5sw-gyv7-vya1" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" }, { "vulnerability": "VCID-zuw7-d1r3-77h1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.10.8" } ], "aliases": [ "CVE-2020-7595", "GHSA-7553-jr98-vx47" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-12ee-na2t-6kg5" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/10492?format=api", "vulnerability_id": "VCID-1h5h-pvc7-9yhh", "summary": "XML Document Root Element Handling Memory Consumption Remote DoS\nThis package contains a flaw that is triggered when handling a root element in an XML document. This may allow a remote attacker to cause a consumption of memory resources.", "references": [ { "reference_url": "https://github.com/sparklemotion/nokogiri/pull/1087", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/sparklemotion/nokogiri/pull/1087" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/50742?format=api", "purl": "pkg:gem/nokogiri@1.6.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-12ee-na2t-6kg5" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-24ud-18pe-dudw" }, { "vulnerability": "VCID-2ub7-t6nu-syfs" }, { "vulnerability": "VCID-38c3-z9yc-4ybx" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-5wxq-ekcv-vqhq" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-8274-u9e9-uufm" }, { "vulnerability": "VCID-94b6-kg9t-fbee" }, { "vulnerability": "VCID-94mh-kks8-4yf4" }, { "vulnerability": "VCID-9mh9-rax2-1bbb" }, { "vulnerability": "VCID-9psz-qfqt-e3fs" }, { "vulnerability": "VCID-9qtg-gxza-6ba9" }, { "vulnerability": "VCID-9xty-6acy-mub7" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-b2g7-1rh9-jkgb" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-cft6-gvm9-8qf4" }, { "vulnerability": "VCID-cq5z-6cmf-5kfs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-f91q-9psx-qkaa" }, { "vulnerability": "VCID-g5sw-gyv7-vya1" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-hmj1-53pj-2ugn" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jn4q-gdy9-eqa4" }, { "vulnerability": "VCID-jvbh-pnxm-9bg7" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-kzy6-b4n3-m7d4" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-mhpn-9y7w-ykcd" }, { "vulnerability": "VCID-p1yd-qud5-ckbu" }, { "vulnerability": "VCID-pffr-3a27-4qgx" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-qysn-w1za-83ea" }, { "vulnerability": "VCID-sgvg-768f-gybf" }, { "vulnerability": "VCID-snqn-nz53-f3b7" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-tswn-2k3y-wkhk" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-w6ws-2kbb-bfgs" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" }, { "vulnerability": "VCID-zuw7-d1r3-77h1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.3" } ], "aliases": [ "OSVDB-118481" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-1h5h-pvc7-9yhh" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/192032?format=api", "vulnerability_id": "VCID-1ks1-3a4g-eqe7", "summary": "", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-23476.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-23476.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-23476", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00257", "scoring_system": "epss", "scoring_elements": "0.49221", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-23476" }, { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/commit/85410e38410f670cbbc8c5b00d07b843caee88ce", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:48:08Z/" } ], "url": "https://github.com/sparklemotion/nokogiri/commit/85410e38410f670cbbc8c5b00d07b843caee88ce" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/commit/9fe0761c47c0d4270d1a5220cfd25de080350d50", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:48:08Z/" } ], "url": "https://github.com/sparklemotion/nokogiri/commit/9fe0761c47c0d4270d1a5220cfd25de080350d50" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2153279", "reference_id": "2153279", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2153279" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23476", "reference_id": "CVE-2022-23476", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23476" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2022-23476.yml", "reference_id": "CVE-2022-23476.YML", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2022-23476.yml" }, { "reference_url": "https://github.com/advisories/GHSA-qv4q-mr5r-qprj", "reference_id": "GHSA-qv4q-mr5r-qprj", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-qv4q-mr5r-qprj" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-qv4q-mr5r-qprj", "reference_id": "GHSA-qv4q-mr5r-qprj", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:48:08Z/" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-qv4q-mr5r-qprj" }, { "reference_url": "https://security.gentoo.org/glsa/202408-13", "reference_id": "GLSA-202408-13", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202408-13" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/80202?format=api", "purl": "pkg:gem/nokogiri@1.13.10", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.13.10" } ], "aliases": [ "CVE-2022-23476", "GHSA-qv4q-mr5r-qprj" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-1ks1-3a4g-eqe7" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/83727?format=api", "vulnerability_id": "VCID-1ksa-wbqf-j7fu", "summary": "", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-6460.json", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-6460.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2013-6460", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.02521", "scoring_system": "epss", "scoring_elements": "0.8567", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2013-6460" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6460", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6460" }, { "reference_url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-6460", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-6460" }, { "reference_url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90058", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90058" }, { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://groups.google.com/forum/#!topic/ruby-security-ann/DeJpjTAg1FA", "reference_id": "", "reference_type": "", "scores": [], "url": "https://groups.google.com/forum/#!topic/ruby-security-ann/DeJpjTAg1FA" }, { "reference_url": "https://web.archive.org/web/20200229074427/https://www.securityfocus.com/bid/64513", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20200229074427/https://www.securityfocus.com/bid/64513" }, { "reference_url": "https://web.archive.org/web/20200229074427/https://www.securityfocus.com/bid/64513/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://web.archive.org/web/20200229074427/https://www.securityfocus.com/bid/64513/" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2013/12/27/2", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2013/12/27/2" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1046663", "reference_id": "1046663", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1046663" }, { "reference_url": "https://access.redhat.com/security/cve/cve-2013-6460", "reference_id": "CVE-2013-6460", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://access.redhat.com/security/cve/cve-2013-6460" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6460", "reference_id": "CVE-2013-6460", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6460" }, { "reference_url": "https://security-tracker.debian.org/tracker/CVE-2013-6460", "reference_id": "CVE-2013-6460", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security-tracker.debian.org/tracker/CVE-2013-6460" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2013-6460.yml", "reference_id": "CVE-2013-6460.YML", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2013-6460.yml" }, { "reference_url": "https://github.com/advisories/GHSA-62qp-3fxm-9wxf", "reference_id": "GHSA-62qp-3fxm-9wxf", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-62qp-3fxm-9wxf" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/76766?format=api", "purl": "pkg:gem/nokogiri@1.5.11", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-12ee-na2t-6kg5" }, { "vulnerability": "VCID-1h5h-pvc7-9yhh" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-24ud-18pe-dudw" }, { "vulnerability": "VCID-2ub7-t6nu-syfs" }, { "vulnerability": "VCID-38c3-z9yc-4ybx" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-5wxq-ekcv-vqhq" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-8274-u9e9-uufm" }, { "vulnerability": "VCID-94b6-kg9t-fbee" }, { "vulnerability": "VCID-94mh-kks8-4yf4" }, { "vulnerability": "VCID-9mh9-rax2-1bbb" }, { "vulnerability": "VCID-9psz-qfqt-e3fs" }, { "vulnerability": "VCID-9qtg-gxza-6ba9" }, { "vulnerability": "VCID-9xty-6acy-mub7" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-cft6-gvm9-8qf4" }, { "vulnerability": "VCID-cq5z-6cmf-5kfs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-f91q-9psx-qkaa" }, { "vulnerability": "VCID-g5sw-gyv7-vya1" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-hmj1-53pj-2ugn" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jn4q-gdy9-eqa4" }, { "vulnerability": "VCID-jvbh-pnxm-9bg7" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-kzy6-b4n3-m7d4" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-mhpn-9y7w-ykcd" }, { "vulnerability": "VCID-p1yd-qud5-ckbu" }, { "vulnerability": "VCID-pffr-3a27-4qgx" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-qysn-w1za-83ea" }, { "vulnerability": "VCID-sgvg-768f-gybf" }, { "vulnerability": "VCID-snqn-nz53-f3b7" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-tswn-2k3y-wkhk" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-w6ws-2kbb-bfgs" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" }, { "vulnerability": "VCID-zuw7-d1r3-77h1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.5.11" }, { "url": "http://public2.vulnerablecode.io/api/packages/51390?format=api", "purl": "pkg:gem/nokogiri@1.6.0.rc1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-12ee-na2t-6kg5" }, { "vulnerability": "VCID-1h5h-pvc7-9yhh" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1ksa-wbqf-j7fu" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-24ud-18pe-dudw" }, { "vulnerability": "VCID-2ub7-t6nu-syfs" }, { "vulnerability": "VCID-38c3-z9yc-4ybx" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-5wxq-ekcv-vqhq" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-8274-u9e9-uufm" }, { "vulnerability": "VCID-94b6-kg9t-fbee" }, { "vulnerability": "VCID-94mh-kks8-4yf4" }, { "vulnerability": "VCID-9mh9-rax2-1bbb" }, { "vulnerability": "VCID-9psz-qfqt-e3fs" }, { "vulnerability": "VCID-9qtg-gxza-6ba9" }, { "vulnerability": "VCID-9xty-6acy-mub7" }, { "vulnerability": "VCID-ajrr-ueqy-2bam" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-cft6-gvm9-8qf4" }, { "vulnerability": "VCID-cq5z-6cmf-5kfs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-f91q-9psx-qkaa" }, { "vulnerability": "VCID-g5sw-gyv7-vya1" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-hmj1-53pj-2ugn" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jn4q-gdy9-eqa4" }, { "vulnerability": "VCID-jvbh-pnxm-9bg7" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-kzy6-b4n3-m7d4" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-mhpn-9y7w-ykcd" }, { "vulnerability": "VCID-p1yd-qud5-ckbu" }, { "vulnerability": "VCID-pffr-3a27-4qgx" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-qysn-w1za-83ea" }, { "vulnerability": "VCID-sgvg-768f-gybf" }, { "vulnerability": "VCID-snqn-nz53-f3b7" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-tswn-2k3y-wkhk" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-w6ws-2kbb-bfgs" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" }, { "vulnerability": "VCID-zuw7-d1r3-77h1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.0.rc1" }, { "url": "http://public2.vulnerablecode.io/api/packages/76764?format=api", "purl": "pkg:gem/nokogiri@1.6.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-12ee-na2t-6kg5" }, { "vulnerability": "VCID-1h5h-pvc7-9yhh" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-24ud-18pe-dudw" }, { "vulnerability": "VCID-2ub7-t6nu-syfs" }, { "vulnerability": "VCID-38c3-z9yc-4ybx" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-5wxq-ekcv-vqhq" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-8274-u9e9-uufm" }, { "vulnerability": "VCID-94b6-kg9t-fbee" }, { "vulnerability": "VCID-94mh-kks8-4yf4" }, { "vulnerability": "VCID-9mh9-rax2-1bbb" }, { "vulnerability": "VCID-9psz-qfqt-e3fs" }, { "vulnerability": "VCID-9qtg-gxza-6ba9" }, { "vulnerability": "VCID-9xty-6acy-mub7" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-b2g7-1rh9-jkgb" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-cft6-gvm9-8qf4" }, { "vulnerability": "VCID-cq5z-6cmf-5kfs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-f91q-9psx-qkaa" }, { "vulnerability": "VCID-g5sw-gyv7-vya1" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-hmj1-53pj-2ugn" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jn4q-gdy9-eqa4" }, { "vulnerability": "VCID-jvbh-pnxm-9bg7" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-kzy6-b4n3-m7d4" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-mhpn-9y7w-ykcd" }, { "vulnerability": "VCID-p1yd-qud5-ckbu" }, { "vulnerability": "VCID-pffr-3a27-4qgx" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-qysn-w1za-83ea" }, { "vulnerability": "VCID-sgvg-768f-gybf" }, { "vulnerability": "VCID-snqn-nz53-f3b7" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-tswn-2k3y-wkhk" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-w6ws-2kbb-bfgs" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" }, { "vulnerability": "VCID-zuw7-d1r3-77h1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.1" } ], "aliases": [ "CVE-2013-6460", "GHSA-62qp-3fxm-9wxf", "OSV-101179" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-1ksa-wbqf-j7fu" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/340684?format=api", "vulnerability_id": "VCID-1pqt-8ppw-eqa6", "summary": "Duplicate Advisory: Nokogiri updates packaged libxml2 to v2.12.7 to resolve CVE-2024-34459", "references": [ { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/720", "reference_id": "", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/720" }, { "reference_url": "https://github.com/advisories/GHSA-r3w4-36x6-7r99", "reference_id": "GHSA-r3w4-36x6-7r99", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-r3w4-36x6-7r99" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-r95h-9x8f-r3f7", "reference_id": "GHSA-r95h-9x8f-r3f7", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-r95h-9x8f-r3f7" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-r95h-9x8f-r3f7.yml", "reference_id": "GHSA-r95h-9x8f-r3f7.yml", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-r95h-9x8f-r3f7.yml" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/81010?format=api", "purl": "pkg:gem/nokogiri@1.16.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.16.5" } ], "aliases": [ "GHSA-r3w4-36x6-7r99" ], "risk_score": 1.4, "exploitability": "0.5", "weighted_severity": "2.7", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-1pqt-8ppw-eqa6" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/3404?format=api", "vulnerability_id": "VCID-24ud-18pe-dudw", "summary": "multiple issues", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-3541.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-3541.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-3541", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0006", "scoring_system": "epss", "scoring_elements": "0.19063", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-3541" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1950515", "reference_id": "", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1950515" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3541", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3541" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20210805-0007/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://security.netapp.com/advisory/ntap-20210805-0007/" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=988603", "reference_id": "988603", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=988603" }, { "reference_url": "https://security.archlinux.org/AVG-1883", "reference_id": "AVG-1883", "reference_type": "", "scores": [ { "value": "High", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1883" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3541", "reference_id": "CVE-2021-3541", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3541" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:2569", "reference_id": "RHSA-2021:2569", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:2569" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1389", "reference_id": "RHSA-2022:1389", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1389" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1390", "reference_id": "RHSA-2022:1390", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1390" }, { "reference_url": "https://usn.ubuntu.com/4991-1/", "reference_id": "USN-4991-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/4991-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/57350?format=api", "purl": "pkg:gem/nokogiri@1.11.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-cft6-gvm9-8qf4" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.11.4" } ], "aliases": [ "CVE-2021-3541" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-24ud-18pe-dudw" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/10787?format=api", "vulnerability_id": "VCID-2ub7-t6nu-syfs", "summary": "Improper Restriction of Operations within the Bounds of a Memory Buffer\nHeap-based buffer overflow in the xmlGROW function in parser.c in libxml2 allows context-dependent attackers to obtain sensitive process memory information via unspecified vectors.", "references": [ { "reference_url": "http://lists.opensuse.org/opensuse-updates/2015-12/msg00120.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://lists.opensuse.org/opensuse-updates/2015-12/msg00120.html" }, { "reference_url": "http://lists.opensuse.org/opensuse-updates/2016-01/msg00031.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://lists.opensuse.org/opensuse-updates/2016-01/msg00031.html" }, { "reference_url": "http://rhn.redhat.com/errata/RHSA-2015-2549.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://rhn.redhat.com/errata/RHSA-2015-2549.html" }, { "reference_url": "http://rhn.redhat.com/errata/RHSA-2015-2550.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://rhn.redhat.com/errata/RHSA-2015-2550.html" }, { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-7499.json", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-7499.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2015-7499", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00714", "scoring_system": "epss", "scoring_elements": "0.72664", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2015-7499" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1281925", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1281925" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1819", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1819" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5312", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5312" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7497", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7497" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7498", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7498" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7499", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7499" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7500", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7500" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7941", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7941" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7942", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7942" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8035", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8035" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8241", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8241" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8317", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8317" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8710", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8710" }, { "reference_url": "https://git.gnome.org/browse/libxml2/commit/?id=28cd9cb747a94483f4aea7f0968d202c20bb4cfc", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://git.gnome.org/browse/libxml2/commit/?id=28cd9cb747a94483f4aea7f0968d202c20bb4cfc" }, { "reference_url": "https://git.gnome.org/browse/libxml2/commit/?id=35bcb1d758ed70aa7b257c9c3b3ff55e54e3d0da", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://git.gnome.org/browse/libxml2/commit/?id=35bcb1d758ed70aa7b257c9c3b3ff55e54e3d0da" }, { "reference_url": "https://groups.google.com/forum/#!topic/ruby-security-ann/Dy7YiKb_pMM", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://groups.google.com/forum/#!topic/ruby-security-ann/Dy7YiKb_pMM" }, { "reference_url": "https://security.gentoo.org/glsa/201701-37", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.gentoo.org/glsa/201701-37" }, { "reference_url": "https://web.archive.org/web/20210724022841/http://www.securityfocus.com/bid/79509", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20210724022841/http://www.securityfocus.com/bid/79509" }, { "reference_url": "https://web.archive.org/web/20211205133229/https://securitytracker.com/id/1034243", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20211205133229/https://securitytracker.com/id/1034243" }, { "reference_url": "http://www.debian.org/security/2015/dsa-3430", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.debian.org/security/2015/dsa-3430" }, { "reference_url": "http://www.ubuntu.com/usn/USN-2834-1", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.ubuntu.com/usn/USN-2834-1" }, { "reference_url": "http://xmlsoft.org/news.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://xmlsoft.org/news.html" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7499", "reference_id": "CVE-2015-7499", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7499" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2015-7499.yml", "reference_id": "CVE-2015-7499.YML", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2015-7499.yml" }, { "reference_url": "https://github.com/advisories/GHSA-jxjr-5h69-qw3w", "reference_id": "GHSA-jxjr-5h69-qw3w", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-jxjr-5h69-qw3w" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2015:2549", "reference_id": "RHSA-2015:2549", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2015:2549" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2015:2550", "reference_id": "RHSA-2015:2550", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2015:2550" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:1089", "reference_id": "RHSA-2016:1089", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:1089" }, { "reference_url": "https://usn.ubuntu.com/2834-1/", "reference_id": "USN-2834-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/2834-1/" }, { "reference_url": "https://usn.ubuntu.com/2875-1/", "reference_id": "USN-2875-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/2875-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/51392?format=api", "purl": "pkg:gem/nokogiri@1.6.7.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-12ee-na2t-6kg5" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-24ud-18pe-dudw" }, { "vulnerability": "VCID-38c3-z9yc-4ybx" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-5wxq-ekcv-vqhq" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-8274-u9e9-uufm" }, { "vulnerability": "VCID-9mh9-rax2-1bbb" }, { "vulnerability": "VCID-9psz-qfqt-e3fs" }, { "vulnerability": "VCID-9qtg-gxza-6ba9" }, { "vulnerability": "VCID-9xty-6acy-mub7" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-cft6-gvm9-8qf4" }, { "vulnerability": "VCID-cq5z-6cmf-5kfs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-f91q-9psx-qkaa" }, { "vulnerability": "VCID-g5sw-gyv7-vya1" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jn4q-gdy9-eqa4" }, { "vulnerability": "VCID-jvbh-pnxm-9bg7" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-kzy6-b4n3-m7d4" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-mhpn-9y7w-ykcd" }, { "vulnerability": "VCID-p1yd-qud5-ckbu" }, { "vulnerability": "VCID-pffr-3a27-4qgx" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-qysn-w1za-83ea" }, { "vulnerability": "VCID-sgvg-768f-gybf" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-tswn-2k3y-wkhk" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-w6ws-2kbb-bfgs" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" }, { "vulnerability": "VCID-zuw7-d1r3-77h1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.7.2" }, { "url": "http://public2.vulnerablecode.io/api/packages/95470?format=api", "purl": "pkg:gem/nokogiri@1.6.8.rc1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-12ee-na2t-6kg5" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-24ud-18pe-dudw" }, { "vulnerability": "VCID-2ub7-t6nu-syfs" }, { "vulnerability": "VCID-38c3-z9yc-4ybx" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-5wxq-ekcv-vqhq" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-8274-u9e9-uufm" }, { "vulnerability": "VCID-9mh9-rax2-1bbb" }, { "vulnerability": "VCID-9psz-qfqt-e3fs" }, { "vulnerability": "VCID-9qtg-gxza-6ba9" }, { "vulnerability": "VCID-9xty-6acy-mub7" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-cft6-gvm9-8qf4" }, { "vulnerability": "VCID-cq5z-6cmf-5kfs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-f91q-9psx-qkaa" }, { "vulnerability": "VCID-g5sw-gyv7-vya1" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jn4q-gdy9-eqa4" }, { "vulnerability": "VCID-jvbh-pnxm-9bg7" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-kzy6-b4n3-m7d4" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-mhpn-9y7w-ykcd" }, { "vulnerability": "VCID-p1yd-qud5-ckbu" }, { "vulnerability": "VCID-pffr-3a27-4qgx" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-qysn-w1za-83ea" }, { "vulnerability": "VCID-sgvg-768f-gybf" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-tswn-2k3y-wkhk" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-w6ws-2kbb-bfgs" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" }, { "vulnerability": "VCID-zuw7-d1r3-77h1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.8.rc1" } ], "aliases": [ "CVE-2015-7499", "GHSA-jxjr-5h69-qw3w" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-2ub7-t6nu-syfs" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/3405?format=api", "vulnerability_id": "VCID-38c3-z9yc-4ybx", "summary": "multiple issues", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-3537.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-3537.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-3537", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00111", "scoring_system": "epss", "scoring_elements": "0.29267", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-3537" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1956522", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1956522" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3537", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3537" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/blob/2edbbef95f1dc12c1ddc5ebda71b9159026245fe/CHANGELOG.md?plain=1#L722", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/blob/2edbbef95f1dc12c1ddc5ebda71b9159026245fe/CHANGELOG.md?plain=1#L722" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/" }, { "reference_url": "https://nokogiri.org/CHANGELOG.html#1114-2021-05-14", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nokogiri.org/CHANGELOG.html#1114-2021-05-14" }, { "reference_url": "https://security.gentoo.org/glsa/202107-05", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.gentoo.org/glsa/202107-05" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20210625-0002", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20210625-0002" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20210625-0002/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://security.netapp.com/advisory/ntap-20210625-0002/" }, { "reference_url": "https://www.oracle.com/security-alerts/cpuapr2022.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" }, { "reference_url": "https://www.oracle.com/security-alerts/cpujul2022.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.oracle.com/security-alerts/cpujul2022.html" }, { "reference_url": "https://www.oracle.com/security-alerts/cpuoct2021.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.oracle.com/security-alerts/cpuoct2021.html" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=988123", "reference_id": "988123", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=988123" }, { "reference_url": "https://security.archlinux.org/AVG-1883", "reference_id": "AVG-1883", "reference_type": "", "scores": [ { "value": "High", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1883" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3537", "reference_id": "CVE-2021-3537", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3537" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2021-3537.yml", "reference_id": "CVE-2021-3537.YML", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2021-3537.yml" }, { "reference_url": "https://github.com/advisories/GHSA-286v-pcf5-25rc", "reference_id": "GHSA-286v-pcf5-25rc", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-286v-pcf5-25rc" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:2569", "reference_id": "RHSA-2021:2569", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:2569" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1389", "reference_id": "RHSA-2022:1389", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1389" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1390", "reference_id": "RHSA-2022:1390", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1390" }, { "reference_url": "https://usn.ubuntu.com/4991-1/", "reference_id": "USN-4991-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/4991-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/57350?format=api", "purl": "pkg:gem/nokogiri@1.11.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-cft6-gvm9-8qf4" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.11.4" } ], "aliases": [ "CVE-2021-3537", "GHSA-286v-pcf5-25rc" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-38c3-z9yc-4ybx" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/19676?format=api", "vulnerability_id": "VCID-48nc-c7xx-j7ap", "summary": "Duplicate Advisory: Use-after-free in libxml2 via Nokogiri::XML::Reader\nNokogiri upgrades its dependency libxml2 as follows:\n- v1.15.6 upgrades libxml2 to 2.11.7 from 2.11.6\n- v1.16.2 upgrades libxml2 to 2.12.5 from 2.12.4\n\nlibxml2 v2.11.7 and v2.12.5 address the following vulnerability:\n\nCVE-2024-25062 / https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25062\n- described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/604\n- patched by https://gitlab.gnome.org/GNOME/libxml2/-/commit/92721970\n\nPlease note that this advisory only applies to the CRuby implementation of Nokogiri, and only if\nthe packaged libraries are being used. If you've overridden defaults at installation time to use\nsystem libraries instead of packaged libraries, you should instead pay attention to your distro's\nlibxml2 release announcements.\n\nJRuby users are not affected.", "references": [ { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/advisories/GHSA-vcc3-rw6f-jv97", "reference_id": "GHSA-vcc3-rw6f-jv97", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-vcc3-rw6f-jv97" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xc9x-jj77-9p9j", "reference_id": "GHSA-xc9x-jj77-9p9j", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xc9x-jj77-9p9j" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-xc9x-jj77-9p9j.yml", "reference_id": "GHSA-xc9x-jj77-9p9j.yml", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-xc9x-jj77-9p9j.yml" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/67577?format=api", "purl": "pkg:gem/nokogiri@1.15.6", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.15.6" }, { "url": "http://public2.vulnerablecode.io/api/packages/67576?format=api", "purl": "pkg:gem/nokogiri@1.16.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.16.2" } ], "aliases": [ "GHSA-vcc3-rw6f-jv97" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-48nc-c7xx-j7ap" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/340680?format=api", "vulnerability_id": "VCID-4yvf-h1z3-nfd7", "summary": "Nokogiri updates packaged libxml2 to v2.12.7 to resolve CVE-2024-34459", "references": [ { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.16.5", "reference_id": "", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.16.5" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/2876ac53", "reference_id": "", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/2876ac53" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/720", "reference_id": "", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/720" }, { "reference_url": "https://github.com/advisories/GHSA-r95h-9x8f-r3f7", "reference_id": "GHSA-r95h-9x8f-r3f7", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-r95h-9x8f-r3f7" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-r95h-9x8f-r3f7", "reference_id": "GHSA-r95h-9x8f-r3f7", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-r95h-9x8f-r3f7" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-r95h-9x8f-r3f7.yml", "reference_id": "GHSA-r95h-9x8f-r3f7.yml", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-r95h-9x8f-r3f7.yml" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/81010?format=api", "purl": "pkg:gem/nokogiri@1.16.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.16.5" } ], "aliases": [ "GHSA-r95h-9x8f-r3f7" ], "risk_score": 1.4, "exploitability": "0.5", "weighted_severity": "2.7", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-4yvf-h1z3-nfd7" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/3407?format=api", "vulnerability_id": "VCID-5wxq-ekcv-vqhq", "summary": "multiple issues", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-3517.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-3517.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-3517", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00107", "scoring_system": "epss", "scoring_elements": "0.28541", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-3517" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1954232", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-02T21:32:30Z/" } ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1954232" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3517", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3517" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/blob/7c19ef5cc6b7c5c36827dd5495f857c6877ec8cf/CHANGELOG.md?plain=1#L579", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/blob/7c19ef5cc6b7c5c36827dd5495f857c6877ec8cf/CHANGELOG.md?plain=1#L579" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/issues/2233", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/issues/2233" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/issues/2274", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/issues/2274" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/8598060bacada41a0eb09d95c97744ff4e428f8e", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/8598060bacada41a0eb09d95c97744ff4e428f8e" }, { "reference_url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-02T21:32:30Z/" } ], "url": "https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/" }, { "reference_url": "https://security.gentoo.org/glsa/202107-05", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-02T21:32:30Z/" } ], "url": "https://security.gentoo.org/glsa/202107-05" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20210625-0002", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20210625-0002" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20210625-0002/", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-02T21:32:30Z/" } ], "url": "https://security.netapp.com/advisory/ntap-20210625-0002/" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20211022-0004", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20211022-0004" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20211022-0004/", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-02T21:32:30Z/" } ], "url": "https://security.netapp.com/advisory/ntap-20211022-0004/" }, { "reference_url": "https://www.oracle.com/security-alerts/cpuapr2022.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-02T21:32:30Z/" } ], "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" }, { "reference_url": "https://www.oracle.com/security-alerts/cpujan2022.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-02T21:32:30Z/" } ], "url": "https://www.oracle.com/security-alerts/cpujan2022.html" }, { "reference_url": "https://www.oracle.com/security-alerts/cpujul2022.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-02T21:32:30Z/" } ], "url": "https://www.oracle.com/security-alerts/cpujul2022.html" }, { "reference_url": "https://www.oracle.com/security-alerts/cpuoct2021.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-02T21:32:30Z/" } ], "url": "https://www.oracle.com/security-alerts/cpuoct2021.html" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=987738", "reference_id": "987738", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=987738" }, { "reference_url": "https://security.archlinux.org/AVG-1883", "reference_id": "AVG-1883", "reference_type": "", "scores": [ { "value": "High", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1883" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/", "reference_id": "BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-02T21:32:30Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3517", "reference_id": "CVE-2021-3517", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3517" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2021-3517.yml", "reference_id": "CVE-2021-3517.YML", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2021-3517.yml" }, { "reference_url": "https://github.com/advisories/GHSA-jw9f-hh49-cvp9", "reference_id": "GHSA-jw9f-hh49-cvp9", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-jw9f-hh49-cvp9" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/", "reference_id": "QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-02T21:32:30Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/" }, { "reference_url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E", "reference_id": "r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-02T21:32:30Z/" } ], "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E", "reference_id": "rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-02T21:32:30Z/" } ], "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:2569", "reference_id": "RHSA-2021:2569", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:2569" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1389", "reference_id": "RHSA-2022:1389", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1389" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1390", "reference_id": "RHSA-2022:1390", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1390" }, { "reference_url": "https://usn.ubuntu.com/4991-1/", "reference_id": "USN-4991-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/4991-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/57350?format=api", "purl": "pkg:gem/nokogiri@1.11.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-cft6-gvm9-8qf4" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.11.4" } ], "aliases": [ "CVE-2021-3517", "GHSA-jw9f-hh49-cvp9" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-5wxq-ekcv-vqhq" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/345931?format=api", "vulnerability_id": "VCID-6b72-3exf-qfhs", "summary": "Nokogiri updates packaged libxml2 to v2.13.8 to resolve CVE-2025-32414 and CVE-2025-32415\n## Summary\n\nNokogiri v1.18.8 upgrades its dependency libxml2 to\n[v2.13.8](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.8).\n\nlibxml2 v2.13.8 addresses:\n\n- CVE-2025-32414\n - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/889\n- CVE-2025-32415\n - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/890\n\n## Impact\n\n### CVE-2025-32414: No impact\n\nIn libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds\nmemory access can occur in the Python API (Python bindings) because\nof an incorrect return value. This occurs in xmlPythonFileRead and\nxmlPythonFileReadRaw because of a difference between bytes and characters.\n\n**There is no impact** from this CVE for Nokogiri users.\n\n### CVE-2025-32415: Low impact\n\nIn libxml2 before 2.13.8 and 2.14.x before 2.14.2,\nxmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer\nunder-read. To exploit this, a crafted XML document must be validated\nagainst an XML schema with certain identity constraints, or a\ncrafted XML schema must be used.\n\nIn the upstream issue, further context is provided by the maintainer:\n\n> The bug affects validation against untrusted XML Schemas (.xsd)\n> and validation of untrusted documents against trusted Schemas if\n> they make use of xsd:keyref in combination with recursively\n> defined types that have additional identity constraints.\n\nMITRE has published a severity score of 2.9 LOW\n(CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) for this CVE.", "references": [ { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-5w6v-399v-w3cc", "reference_id": "", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-5w6v-399v-w3cc" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/889", "reference_id": "", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/889" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/890", "reference_id": "", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/890" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.8", "reference_id": "", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.8" }, { "reference_url": "https://github.com/advisories/GHSA-5w6v-399v-w3cc", "reference_id": "GHSA-5w6v-399v-w3cc", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-5w6v-399v-w3cc" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/166218?format=api", "purl": "pkg:gem/nokogiri@1.18.8", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.18.8" } ], "aliases": [ "GHSA-5w6v-399v-w3cc" ], "risk_score": 1.4, "exploitability": "0.5", "weighted_severity": "2.7", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-6b72-3exf-qfhs" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/2819?format=api", "vulnerability_id": "VCID-8274-u9e9-uufm", "summary": "arbitrary code execution", "references": [ { "reference_url": "http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html" }, { "reference_url": "http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html" }, { "reference_url": "http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.html" }, { "reference_url": "http://lists.apple.com/archives/security-announce/2016/Sep/msg00011.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://lists.apple.com/archives/security-announce/2016/Sep/msg00011.html" }, { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-4658.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-4658.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2016-4658", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.15391", "scoring_system": "epss", "scoring_elements": "0.94756", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2016-4658" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4658", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4658" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5131", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5131" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.1", "scoring_system": "cvssv2", "scoring_elements": "AV:N/AC:H/Au:N/C:P/I:P/A:P" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://git.gnome.org/browse/libxml2/commit/?id=c1d1f7121194036608bf555f08d3062a36fd344b", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://git.gnome.org/browse/libxml2/commit/?id=c1d1f7121194036608bf555f08d3062a36fd344b" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/issues/1615", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/issues/1615" }, { "reference_url": "https://security.gentoo.org/glsa/201701-37", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.gentoo.org/glsa/201701-37" }, { "reference_url": "https://support.apple.com/HT207141", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://support.apple.com/HT207141" }, { "reference_url": "https://support.apple.com/HT207142", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://support.apple.com/HT207142" }, { "reference_url": "https://support.apple.com/HT207143", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://support.apple.com/HT207143" }, { "reference_url": "https://support.apple.com/HT207170", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://support.apple.com/HT207170" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1384424", "reference_id": "1384424", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1384424" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=840553", "reference_id": "840553", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=840553" }, { "reference_url": "https://security.archlinux.org/ASA-201611-2", "reference_id": "ASA-201611-2", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-201611-2" }, { "reference_url": "https://security.archlinux.org/AVG-56", "reference_id": "AVG-56", "reference_type": "", "scores": [ { "value": "Critical", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-56" }, { "reference_url": "http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-4448.html", "reference_id": "CVE-2016-4448.HTML", "reference_type": "", "scores": [], "url": "http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-4448.html" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4658", "reference_id": "CVE-2016-4658", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4658" }, { "reference_url": "http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-4658.html", "reference_id": "CVE-2016-4658.HTML", "reference_type": "", "scores": [], "url": "http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-4658.html" }, { "reference_url": "http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-5131.html", "reference_id": "CVE-2016-5131.HTML", "reference_type": "", "scores": [], "url": "http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-5131.html" }, { "reference_url": "https://github.com/advisories/GHSA-fr52-4hqw-p27f", "reference_id": "GHSA-fr52-4hqw-p27f", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-fr52-4hqw-p27f" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:3810", "reference_id": "RHSA-2021:3810", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:3810" }, { "reference_url": "https://usn.ubuntu.com/3235-1/", "reference_id": "USN-3235-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/3235-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/51850?format=api", "purl": "pkg:gem/nokogiri@1.7.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-12ee-na2t-6kg5" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-24ud-18pe-dudw" }, { "vulnerability": "VCID-38c3-z9yc-4ybx" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-5wxq-ekcv-vqhq" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-9mh9-rax2-1bbb" }, { "vulnerability": "VCID-9psz-qfqt-e3fs" }, { "vulnerability": "VCID-9qtg-gxza-6ba9" }, { "vulnerability": "VCID-9xty-6acy-mub7" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-cft6-gvm9-8qf4" }, { "vulnerability": "VCID-cq5z-6cmf-5kfs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-f91q-9psx-qkaa" }, { "vulnerability": "VCID-g5sw-gyv7-vya1" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jvbh-pnxm-9bg7" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-kzy6-b4n3-m7d4" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-p1yd-qud5-ckbu" }, { "vulnerability": "VCID-pffr-3a27-4qgx" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-qysn-w1za-83ea" }, { "vulnerability": "VCID-sgvg-768f-gybf" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-tswn-2k3y-wkhk" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-w6ws-2kbb-bfgs" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" }, { "vulnerability": "VCID-zuw7-d1r3-77h1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.7.1" } ], "aliases": [ "CVE-2016-4658", "GHSA-fr52-4hqw-p27f" ], "risk_score": 4.5, "exploitability": "0.5", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-8274-u9e9-uufm" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/10762?format=api", "vulnerability_id": "VCID-94b6-kg9t-fbee", "summary": "Unsafe parsing of unclosed comments\nParsing an unclosed comment can result in `Conditional jump or move depends on uninitialised value(s)` and unsafe memory access.", "references": [ { "reference_url": "https://github.com/sparklemotion/nokogiri/blob/master/CHANGELOG.rdoc#167rc4--2015-11-22", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/sparklemotion/nokogiri/blob/master/CHANGELOG.rdoc#167rc4--2015-11-22" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/blob/v1.6.6.x/CHANGELOG.rdoc#1664--2015-11-19", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/sparklemotion/nokogiri/blob/v1.6.6.x/CHANGELOG.rdoc#1664--2015-11-19" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/commit/0948e9fa38c949661983a33752fdcb94a453e272", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/sparklemotion/nokogiri/commit/0948e9fa38c949661983a33752fdcb94a453e272" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/commit/3ab1b2339f7bb3a00590c8d288a24a9dbfe5aec4", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/sparklemotion/nokogiri/commit/3ab1b2339f7bb3a00590c8d288a24a9dbfe5aec4" }, { "reference_url": "https://groups.google.com/forum/#!topic/nokogiri-talk/nFl0mfcJpbk", "reference_id": "", "reference_type": "", "scores": [], "url": "https://groups.google.com/forum/#!topic/nokogiri-talk/nFl0mfcJpbk" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/51279?format=api", "purl": "pkg:gem/nokogiri@1.6.6.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-12ee-na2t-6kg5" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-24ud-18pe-dudw" }, { "vulnerability": "VCID-2ub7-t6nu-syfs" }, { "vulnerability": "VCID-38c3-z9yc-4ybx" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-5wxq-ekcv-vqhq" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-8274-u9e9-uufm" }, { "vulnerability": "VCID-94mh-kks8-4yf4" }, { "vulnerability": "VCID-9mh9-rax2-1bbb" }, { "vulnerability": "VCID-9psz-qfqt-e3fs" }, { "vulnerability": "VCID-9qtg-gxza-6ba9" }, { "vulnerability": "VCID-9xty-6acy-mub7" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-b2g7-1rh9-jkgb" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-cft6-gvm9-8qf4" }, { "vulnerability": "VCID-cq5z-6cmf-5kfs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-f91q-9psx-qkaa" }, { "vulnerability": "VCID-g5sw-gyv7-vya1" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jn4q-gdy9-eqa4" }, { "vulnerability": "VCID-jvbh-pnxm-9bg7" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-kzy6-b4n3-m7d4" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-mhpn-9y7w-ykcd" }, { "vulnerability": "VCID-p1yd-qud5-ckbu" }, { "vulnerability": "VCID-pffr-3a27-4qgx" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-qysn-w1za-83ea" }, { "vulnerability": "VCID-sgvg-768f-gybf" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-tswn-2k3y-wkhk" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-w6ws-2kbb-bfgs" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" }, { "vulnerability": "VCID-zuw7-d1r3-77h1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.6.4" }, { "url": "http://public2.vulnerablecode.io/api/packages/51280?format=api", "purl": "pkg:gem/nokogiri@1.6.7.rc4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-12ee-na2t-6kg5" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-24ud-18pe-dudw" }, { "vulnerability": "VCID-2ub7-t6nu-syfs" }, { "vulnerability": "VCID-38c3-z9yc-4ybx" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-5wxq-ekcv-vqhq" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-8274-u9e9-uufm" }, { "vulnerability": "VCID-94mh-kks8-4yf4" }, { "vulnerability": "VCID-9mh9-rax2-1bbb" }, { "vulnerability": "VCID-9psz-qfqt-e3fs" }, { "vulnerability": "VCID-9qtg-gxza-6ba9" }, { "vulnerability": "VCID-9xty-6acy-mub7" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-b2g7-1rh9-jkgb" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-cft6-gvm9-8qf4" }, { "vulnerability": "VCID-cq5z-6cmf-5kfs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-f91q-9psx-qkaa" }, { "vulnerability": "VCID-g5sw-gyv7-vya1" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jn4q-gdy9-eqa4" }, { "vulnerability": "VCID-jvbh-pnxm-9bg7" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-kzy6-b4n3-m7d4" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-mhpn-9y7w-ykcd" }, { "vulnerability": "VCID-p1yd-qud5-ckbu" }, { "vulnerability": "VCID-pffr-3a27-4qgx" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-qysn-w1za-83ea" }, { "vulnerability": "VCID-sgvg-768f-gybf" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-tswn-2k3y-wkhk" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-w6ws-2kbb-bfgs" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" }, { "vulnerability": "VCID-zuw7-d1r3-77h1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.7.rc4" } ], "aliases": [ "GMS-2015-43" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-94b6-kg9t-fbee" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/10793?format=api", "vulnerability_id": "VCID-94mh-kks8-4yf4", "summary": "Vulnerabilities in libxml2\nSeveral vulnerabilities were discovered in the libxml2 library that this package gem depends on.", "references": [ { "reference_url": "http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html" }, { "reference_url": "http://lists.opensuse.org/opensuse-updates/2015-12/msg00120.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://lists.opensuse.org/opensuse-updates/2015-12/msg00120.html" }, { "reference_url": "http://lists.opensuse.org/opensuse-updates/2016-01/msg00031.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://lists.opensuse.org/opensuse-updates/2016-01/msg00031.html" }, { "reference_url": "http://marc.info/?l=bugtraq&m=145382616617563&w=2", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://marc.info/?l=bugtraq&m=145382616617563&w=2" }, { "reference_url": "http://rhn.redhat.com/errata/RHSA-2015-2549.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://rhn.redhat.com/errata/RHSA-2015-2549.html" }, { "reference_url": "http://rhn.redhat.com/errata/RHSA-2015-2550.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://rhn.redhat.com/errata/RHSA-2015-2550.html" }, { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-5312.json", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-5312.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2015-5312", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.01078", "scoring_system": "epss", "scoring_elements": "0.78121", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2015-5312" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1276693", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1276693" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1819", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1819" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5312", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5312" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7497", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7497" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7498", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7498" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7499", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7499" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7500", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7500" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7941", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7941" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7942", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7942" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8035", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8035" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8241", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8241" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8317", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8317" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8710", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8710" }, { "reference_url": "https://git.gnome.org/browse/libxml2/commit/?id=69030714cde66d525a8884bda01b9e8f0abf8e1e", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://git.gnome.org/browse/libxml2/commit/?id=69030714cde66d525a8884bda01b9e8f0abf8e1e" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/commit/4205af1a2a546f79d1b48df2ad8b27299c0099c5", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/sparklemotion/nokogiri/commit/4205af1a2a546f79d1b48df2ad8b27299c0099c5" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/pull/1378", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/sparklemotion/nokogiri/pull/1378" }, { "reference_url": "https://groups.google.com/forum/#!topic/ruby-security-ann/aSbgDiwb24s", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://groups.google.com/forum/#!topic/ruby-security-ann/aSbgDiwb24s" }, { "reference_url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04944172", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04944172" }, { "reference_url": "https://security.gentoo.org/glsa/201701-37", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.gentoo.org/glsa/201701-37" }, { "reference_url": "https://support.apple.com/HT206166", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://support.apple.com/HT206166" }, { "reference_url": "https://support.apple.com/HT206167", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://support.apple.com/HT206167" }, { "reference_url": "https://support.apple.com/HT206168", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://support.apple.com/HT206168" }, { "reference_url": "https://support.apple.com/HT206169", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://support.apple.com/HT206169" }, { "reference_url": "http://www.debian.org/security/2015/dsa-3430", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.debian.org/security/2015/dsa-3430" }, { "reference_url": "http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html" }, { "reference_url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html" }, { "reference_url": "http://www.ubuntu.com/usn/USN-2834-1", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.ubuntu.com/usn/USN-2834-1" }, { "reference_url": "http://xmlsoft.org/news.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://xmlsoft.org/news.html" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5312", "reference_id": "CVE-2015-5312", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5312" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2015-5312.yml", "reference_id": "CVE-2015-5312.YML", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2015-5312.yml" }, { "reference_url": "https://github.com/advisories/GHSA-xjqg-9jvg-fgx2", "reference_id": "GHSA-xjqg-9jvg-fgx2", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-xjqg-9jvg-fgx2" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2015:2549", "reference_id": "RHSA-2015:2549", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2015:2549" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2015:2550", "reference_id": "RHSA-2015:2550", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2015:2550" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2016:1089", "reference_id": "RHSA-2016:1089", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2016:1089" }, { "reference_url": "https://usn.ubuntu.com/2834-1/", "reference_id": "USN-2834-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/2834-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/51389?format=api", "purl": "pkg:gem/nokogiri@1.6.7.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-12ee-na2t-6kg5" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-24ud-18pe-dudw" }, { "vulnerability": "VCID-2ub7-t6nu-syfs" }, { "vulnerability": "VCID-38c3-z9yc-4ybx" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-5wxq-ekcv-vqhq" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-8274-u9e9-uufm" }, { "vulnerability": "VCID-9mh9-rax2-1bbb" }, { "vulnerability": "VCID-9psz-qfqt-e3fs" }, { "vulnerability": "VCID-9qtg-gxza-6ba9" }, { "vulnerability": "VCID-9xty-6acy-mub7" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-cft6-gvm9-8qf4" }, { "vulnerability": "VCID-cq5z-6cmf-5kfs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-f91q-9psx-qkaa" }, { "vulnerability": "VCID-g5sw-gyv7-vya1" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jn4q-gdy9-eqa4" }, { "vulnerability": "VCID-jvbh-pnxm-9bg7" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-kzy6-b4n3-m7d4" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-mhpn-9y7w-ykcd" }, { "vulnerability": "VCID-p1yd-qud5-ckbu" }, { "vulnerability": "VCID-pffr-3a27-4qgx" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-qysn-w1za-83ea" }, { "vulnerability": "VCID-sgvg-768f-gybf" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-tswn-2k3y-wkhk" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-w6ws-2kbb-bfgs" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" }, { "vulnerability": "VCID-zuw7-d1r3-77h1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.7.1" } ], "aliases": [ "CVE-2015-5312", "GHSA-xjqg-9jvg-fgx2" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-94mh-kks8-4yf4" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/2202?format=api", "vulnerability_id": "VCID-9mh9-rax2-1bbb", "summary": "multiple issues", "references": [ { "reference_url": "https://access.redhat.com/errata/RHSA-2017:3401", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://access.redhat.com/errata/RHSA-2017:3401" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2018:0287", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://access.redhat.com/errata/RHSA-2018:0287" }, { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-15412.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-15412.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2017-15412", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.02535", "scoring_system": "epss", "scoring_elements": "0.85707", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2017-15412" }, { "reference_url": "https://bugzilla.gnome.org/show_bug.cgi?id=783160", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://bugzilla.gnome.org/show_bug.cgi?id=783160" }, { "reference_url": "https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html" }, { "reference_url": "https://crbug.com/727039", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://crbug.com/727039" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15412", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15412" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2017-15412.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2017-15412.yml" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/issues/1714", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/issues/1714" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2017/12/msg00014.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2017/12/msg00014.html" }, { "reference_url": "https://web.archive.org/web/20201208155618/http://www.securitytracker.com/id/1040348", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20201208155618/http://www.securitytracker.com/id/1040348" }, { "reference_url": "https://www.debian.org/security/2018/dsa-4086", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.debian.org/security/2018/dsa-4086" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1523128", "reference_id": "1523128", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1523128" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=883790", "reference_id": "883790", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=883790" }, { "reference_url": "https://security.archlinux.org/ASA-201712-5", "reference_id": "ASA-201712-5", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-201712-5" }, { "reference_url": "https://security.archlinux.org/AVG-544", "reference_id": "AVG-544", "reference_type": "", "scores": [ { "value": "Critical", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-544" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15412", "reference_id": "CVE-2017-15412", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15412" }, { "reference_url": "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-15412.html", "reference_id": "CVE-2017-15412.HTML", "reference_type": "", "scores": [], "url": "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-15412.html" }, { "reference_url": "https://security.gentoo.org/glsa/201801-03", "reference_id": "GLSA-201801-03", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.gentoo.org/glsa/201801-03" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:1190", "reference_id": "RHSA-2020:1190", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2020:1190" }, { "reference_url": "https://usn.ubuntu.com/3513-1/", "reference_id": "USN-3513-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/3513-1/" }, { "reference_url": "https://usn.ubuntu.com/3513-2/", "reference_id": "USN-3513-2", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/3513-2/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/54339?format=api", "purl": "pkg:gem/nokogiri@1.8.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-12ee-na2t-6kg5" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-24ud-18pe-dudw" }, { "vulnerability": "VCID-38c3-z9yc-4ybx" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-5wxq-ekcv-vqhq" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-9psz-qfqt-e3fs" }, { "vulnerability": "VCID-9qtg-gxza-6ba9" }, { "vulnerability": "VCID-9xty-6acy-mub7" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-cft6-gvm9-8qf4" }, { "vulnerability": "VCID-cq5z-6cmf-5kfs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-f91q-9psx-qkaa" }, { "vulnerability": "VCID-g5sw-gyv7-vya1" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jvbh-pnxm-9bg7" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-kzy6-b4n3-m7d4" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-pffr-3a27-4qgx" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-qysn-w1za-83ea" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-w6ws-2kbb-bfgs" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" }, { "vulnerability": "VCID-zuw7-d1r3-77h1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.8.2" } ], "aliases": [ "CVE-2017-15412", "GHSA-r58r-74gx-6wx3" ], "risk_score": 4.5, "exploitability": "0.5", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-9mh9-rax2-1bbb" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/13761?format=api", "vulnerability_id": "VCID-9psz-qfqt-e3fs", "summary": "Improper Input Validation\nIn `numbers.c` in libxslt, which is used by nokogiri, an `xsl:number` with certain format strings could lead to an uninitialized read in `xsltNumberFormatInsertNumbers`. This could allow an attacker to discern whether a byte on the stack contains the characters `[AaIi0]`, or any other character.", "references": [ { "reference_url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:31:22Z/" } ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html" }, { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-13117.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-13117.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2019-13117", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.04376", "scoring_system": "epss", "scoring_elements": "0.89144", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-13117" }, { "reference_url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14471", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:31:22Z/" } ], "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14471" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13117", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13117" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2019-13117.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2019-13117.yml" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/issues/1943", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/issues/1943" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxslt/commit/c5eb6cf3aba0af048596106ed839b4ae17ecbcb1", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:31:22Z/" } ], "url": "https://gitlab.gnome.org/GNOME/libxslt/commit/c5eb6cf3aba0af048596106ed839b4ae17ecbcb1" }, { "reference_url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2019/07/msg00020.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:31:22Z/" } ], "url": "https://lists.debian.org/debian-lts-announce/2019/07/msg00020.html" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ" }, { "reference_url": "https://oss-fuzz.com/testcase-detail/5631739747106816", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:31:22Z/" } ], "url": "https://oss-fuzz.com/testcase-detail/5631739747106816" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20190806-0004", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20190806-0004" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20200122-0003", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20200122-0003" }, { "reference_url": "https://usn.ubuntu.com/4164-1", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://usn.ubuntu.com/4164-1" }, { "reference_url": "https://www.oracle.com/security-alerts/cpujan2020.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:31:22Z/" } ], "url": "https://www.oracle.com/security-alerts/cpujan2020.html" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2019/11/17/2", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:31:22Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2019/11/17/2" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1728546", "reference_id": "1728546", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1728546" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931321", "reference_id": "931321", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931321" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2019-13117", "reference_id": "CVE-2019-13117", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-13117" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ/", "reference_id": "IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:31:22Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ/" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20190806-0004/", "reference_id": "ntap-20190806-0004", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:31:22Z/" } ], "url": "https://security.netapp.com/advisory/ntap-20190806-0004/" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20200122-0003/", "reference_id": "ntap-20200122-0003", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:31:22Z/" } ], "url": "https://security.netapp.com/advisory/ntap-20200122-0003/" }, { "reference_url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E", "reference_id": "r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:31:22Z/" } ], "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E", "reference_id": "rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:31:22Z/" } ], "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E" }, { "reference_url": "https://usn.ubuntu.com/4164-1/", "reference_id": "USN-4164-1", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:31:22Z/" } ], "url": "https://usn.ubuntu.com/4164-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/57262?format=api", "purl": "pkg:gem/nokogiri@1.10.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-12ee-na2t-6kg5" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-24ud-18pe-dudw" }, { "vulnerability": "VCID-38c3-z9yc-4ybx" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-5wxq-ekcv-vqhq" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-9qtg-gxza-6ba9" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-cft6-gvm9-8qf4" }, { "vulnerability": "VCID-cq5z-6cmf-5kfs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-g5sw-gyv7-vya1" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" }, { "vulnerability": "VCID-zuw7-d1r3-77h1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.10.5" } ], "aliases": [ "CVE-2019-13117", "GHSA-4hm9-844j-jmxp" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-9psz-qfqt-e3fs" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/159626?format=api", "vulnerability_id": "VCID-9qtg-gxza-6ba9", "summary": "", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-26247.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-26247.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2020-26247", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00259", "scoring_system": "epss", "scoring_elements": "0.49487", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-26247" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26247", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26247" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2020-26247.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2020-26247.yml" }, { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md#v1110--2021-01-03", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md#v1110--2021-01-03" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/commit/9c87439d9afa14a365ff13e73adc809cb2c3d97b", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/commit/9c87439d9afa14a365ff13e73adc809cb2c3d97b" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.11.0.rc4", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.11.0.rc4" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vr8q-g5c7-m54m", "reference_id": "", "reference_type": "", "scores": [ { "value": "2.6", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vr8q-g5c7-m54m" }, { "reference_url": "https://hackerone.com/reports/747489", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://hackerone.com/reports/747489" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2021/06/msg00007.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2021/06/msg00007.html" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00018.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00018.html" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26247", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26247" }, { "reference_url": "https://rubygems.org/gems/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://rubygems.org/gems/nokogiri" }, { "reference_url": "https://security.gentoo.org/glsa/202208-29", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.gentoo.org/glsa/202208-29" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1912487", "reference_id": "1912487", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1912487" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978967", "reference_id": "978967", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978967" }, { "reference_url": "https://github.com/advisories/GHSA-vr8q-g5c7-m54m", "reference_id": "GHSA-vr8q-g5c7-m54m", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-vr8q-g5c7-m54m" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:4702", "reference_id": "RHSA-2021:4702", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:4702" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:5191", "reference_id": "RHSA-2021:5191", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:5191" }, { "reference_url": "https://usn.ubuntu.com/7659-1/", "reference_id": "USN-7659-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7659-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/160955?format=api", "purl": "pkg:gem/nokogiri@1.11.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-24ud-18pe-dudw" }, { "vulnerability": "VCID-38c3-z9yc-4ybx" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-5wxq-ekcv-vqhq" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-cft6-gvm9-8qf4" }, { "vulnerability": "VCID-cq5z-6cmf-5kfs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" }, { "vulnerability": "VCID-zuw7-d1r3-77h1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.11.0" } ], "aliases": [ "CVE-2020-26247", "GHSA-vr8q-g5c7-m54m" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-9qtg-gxza-6ba9" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/13528?format=api", "vulnerability_id": "VCID-9xty-6acy-mub7", "summary": "Bypass of a protection mechanism in libxslt\nThe libxslt binary, which is included in nokogiri, allows bypass of a protection mechanism because callers of `xsltCheckRead` and `xsltCheckWrite` permit access even upon receiving a -1 error code. `xsltCheckRead` can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.", "references": [ { "reference_url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00048.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/" } ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00048.html" }, { "reference_url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00052.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/" } ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00052.html" }, { "reference_url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00053.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/" } ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00053.html" }, { "reference_url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00025.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/" } ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00025.html" }, { "reference_url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00001.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/" } ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00001.html" }, { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-11068.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-11068.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2019-11068", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.01127", "scoring_system": "epss", "scoring_elements": "0.7861", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-11068" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11068", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11068" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.6", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/blob/f7aa3b0b29d6fe5fafe93dacd9b96b6b3d16b7ec/CHANGELOG.md?plain=1#L826", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/blob/f7aa3b0b29d6fe5fafe93dacd9b96b6b3d16b7ec/CHANGELOG.md?plain=1#L826" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/commit/fe034aedcc59b566740567d621843731686676b9", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/commit/fe034aedcc59b566740567d621843731686676b9" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/issues/1892", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/issues/1892" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/pull/1898", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/pull/1898" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxslt/commit/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/" } ], "url": "https://gitlab.gnome.org/GNOME/libxslt/commit/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2019/04/msg00016.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/" } ], "url": "https://lists.debian.org/debian-lts-announce/2019/04/msg00016.html" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36TEYN37XCCKN2XUMRTBBW67BPNMSW4K", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36TEYN37XCCKN2XUMRTBBW67BPNMSW4K" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36TEYN37XCCKN2XUMRTBBW67BPNMSW4K/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36TEYN37XCCKN2XUMRTBBW67BPNMSW4K/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCOAX2IHUMKCM3ILHTMGLHCDSBTLP2JU", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCOAX2IHUMKCM3ILHTMGLHCDSBTLP2JU" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCOAX2IHUMKCM3ILHTMGLHCDSBTLP2JU/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCOAX2IHUMKCM3ILHTMGLHCDSBTLP2JU/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SK4YNISS22MJY22YX5I6V2U63QZAUEHA", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SK4YNISS22MJY22YX5I6V2U63QZAUEHA" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SK4YNISS22MJY22YX5I6V2U63QZAUEHA/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SK4YNISS22MJY22YX5I6V2U63QZAUEHA/" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20191017-0001", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20191017-0001" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20191017-0001/", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/" } ], "url": "https://security.netapp.com/advisory/ntap-20191017-0001/" }, { "reference_url": "https://usn.ubuntu.com/3947-1", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://usn.ubuntu.com/3947-1" }, { "reference_url": "https://usn.ubuntu.com/3947-1/", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/" } ], "url": "https://usn.ubuntu.com/3947-1/" }, { "reference_url": "https://usn.ubuntu.com/3947-2", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://usn.ubuntu.com/3947-2" }, { "reference_url": "https://usn.ubuntu.com/3947-2/", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/" } ], "url": "https://usn.ubuntu.com/3947-2/" }, { "reference_url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/" } ], "url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2019/04/22/1", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2019/04/22/1" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2019/04/23/5", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2019/04/23/5" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1709697", "reference_id": "1709697", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1709697" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36TEYN37XCCKN2XUMRTBBW67BPNMSW4K/", "reference_id": "36TEYN37XCCKN2XUMRTBBW67BPNMSW4K", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36TEYN37XCCKN2XUMRTBBW67BPNMSW4K/" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=926895", "reference_id": "926895", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=926895" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11068", "reference_id": "CVE-2019-11068", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11068" }, { "reference_url": "https://people.canonical.com/~ubuntu-security/cve/CVE-2019-11068", "reference_id": "CVE-2019-11068", "reference_type": "", "scores": [], "url": "https://people.canonical.com/~ubuntu-security/cve/CVE-2019-11068" }, { "reference_url": "https://security-tracker.debian.org/tracker/CVE-2019-11068", "reference_id": "CVE-2019-11068", "reference_type": "", "scores": [], "url": "https://security-tracker.debian.org/tracker/CVE-2019-11068" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2019-11068.yml", "reference_id": "CVE-2019-11068.YML", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2019-11068.yml" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GCOAX2IHUMKCM3ILHTMGLHCDSBTLP2JU/", "reference_id": "GCOAX2IHUMKCM3ILHTMGLHCDSBTLP2JU", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GCOAX2IHUMKCM3ILHTMGLHCDSBTLP2JU/" }, { "reference_url": "https://github.com/advisories/GHSA-qxcg-xjjg-66mj", "reference_id": "GHSA-qxcg-xjjg-66mj", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-qxcg-xjjg-66mj" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:4005", "reference_id": "RHSA-2020:4005", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2020:4005" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:4464", "reference_id": "RHSA-2020:4464", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2020:4464" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SK4YNISS22MJY22YX5I6V2U63QZAUEHA/", "reference_id": "SK4YNISS22MJY22YX5I6V2U63QZAUEHA", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:18:22Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SK4YNISS22MJY22YX5I6V2U63QZAUEHA/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/76921?format=api", "purl": "pkg:gem/nokogiri@1.10.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-12ee-na2t-6kg5" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-24ud-18pe-dudw" }, { "vulnerability": "VCID-38c3-z9yc-4ybx" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-5wxq-ekcv-vqhq" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-9psz-qfqt-e3fs" }, { "vulnerability": "VCID-9qtg-gxza-6ba9" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-cft6-gvm9-8qf4" }, { "vulnerability": "VCID-cq5z-6cmf-5kfs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-g5sw-gyv7-vya1" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-kzy6-b4n3-m7d4" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-pffr-3a27-4qgx" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-qysn-w1za-83ea" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-w6ws-2kbb-bfgs" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" }, { "vulnerability": "VCID-zuw7-d1r3-77h1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.10.3" }, { "url": "http://public2.vulnerablecode.io/api/packages/56778?format=api", "purl": "pkg:gem/nokogiri@1.10.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-12ee-na2t-6kg5" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-24ud-18pe-dudw" }, { "vulnerability": "VCID-38c3-z9yc-4ybx" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-5wxq-ekcv-vqhq" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-9psz-qfqt-e3fs" }, { "vulnerability": "VCID-9qtg-gxza-6ba9" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-cft6-gvm9-8qf4" }, { "vulnerability": "VCID-cq5z-6cmf-5kfs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-g5sw-gyv7-vya1" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-qysn-w1za-83ea" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" }, { "vulnerability": "VCID-zuw7-d1r3-77h1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.10.4" } ], "aliases": [ "CVE-2019-11068", "GHSA-qxcg-xjjg-66mj" ], "risk_score": 4.5, "exploitability": "0.5", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-9xty-6acy-mub7" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/83728?format=api", "vulnerability_id": "VCID-ajrr-ueqy-2bam", "summary": "", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-6461.json", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-6461.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2013-6461", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.02046", "scoring_system": "epss", "scoring_elements": "0.8414", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2013-6461" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6461", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6461" }, { "reference_url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90059", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90059" }, { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://groups.google.com/forum/#!topic/ruby-security-ann/DeJpjTAg1FA", "reference_id": "", "reference_type": "", "scores": [], "url": "https://groups.google.com/forum/#!topic/ruby-security-ann/DeJpjTAg1FA" }, { "reference_url": "https://web.archive.org/web/20200804224345/https://www.securityfocus.com/bid/64513", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20200804224345/https://www.securityfocus.com/bid/64513" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2013/12/27/2", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2013/12/27/2" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1046664", "reference_id": "1046664", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1046664" }, { "reference_url": "https://access.redhat.com/security/cve/cve-2013-6461", "reference_id": "CVE-2013-6461", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://access.redhat.com/security/cve/cve-2013-6461" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6461", "reference_id": "CVE-2013-6461", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6461" }, { "reference_url": "https://security-tracker.debian.org/tracker/CVE-2013-6461", "reference_id": "CVE-2013-6461", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security-tracker.debian.org/tracker/CVE-2013-6461" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2013-6461.yml", "reference_id": "CVE-2013-6461.YML", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2013-6461.yml" }, { "reference_url": "https://github.com/advisories/GHSA-jmhh-w7xp-wg39", "reference_id": "GHSA-jmhh-w7xp-wg39", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-jmhh-w7xp-wg39" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/76766?format=api", "purl": "pkg:gem/nokogiri@1.5.11", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-12ee-na2t-6kg5" }, { "vulnerability": "VCID-1h5h-pvc7-9yhh" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-24ud-18pe-dudw" }, { "vulnerability": "VCID-2ub7-t6nu-syfs" }, { "vulnerability": "VCID-38c3-z9yc-4ybx" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-5wxq-ekcv-vqhq" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-8274-u9e9-uufm" }, { "vulnerability": "VCID-94b6-kg9t-fbee" }, { "vulnerability": "VCID-94mh-kks8-4yf4" }, { "vulnerability": "VCID-9mh9-rax2-1bbb" }, { "vulnerability": "VCID-9psz-qfqt-e3fs" }, { "vulnerability": "VCID-9qtg-gxza-6ba9" }, { "vulnerability": "VCID-9xty-6acy-mub7" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-cft6-gvm9-8qf4" }, { "vulnerability": "VCID-cq5z-6cmf-5kfs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-f91q-9psx-qkaa" }, { "vulnerability": "VCID-g5sw-gyv7-vya1" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-hmj1-53pj-2ugn" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jn4q-gdy9-eqa4" }, { "vulnerability": "VCID-jvbh-pnxm-9bg7" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-kzy6-b4n3-m7d4" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-mhpn-9y7w-ykcd" }, { "vulnerability": "VCID-p1yd-qud5-ckbu" }, { "vulnerability": "VCID-pffr-3a27-4qgx" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-qysn-w1za-83ea" }, { "vulnerability": "VCID-sgvg-768f-gybf" }, { "vulnerability": "VCID-snqn-nz53-f3b7" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-tswn-2k3y-wkhk" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-w6ws-2kbb-bfgs" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" }, { "vulnerability": "VCID-zuw7-d1r3-77h1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.5.11" }, { "url": "http://public2.vulnerablecode.io/api/packages/51390?format=api", "purl": "pkg:gem/nokogiri@1.6.0.rc1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-12ee-na2t-6kg5" }, { "vulnerability": "VCID-1h5h-pvc7-9yhh" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1ksa-wbqf-j7fu" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-24ud-18pe-dudw" }, { "vulnerability": "VCID-2ub7-t6nu-syfs" }, { "vulnerability": "VCID-38c3-z9yc-4ybx" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-5wxq-ekcv-vqhq" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-8274-u9e9-uufm" }, { "vulnerability": "VCID-94b6-kg9t-fbee" }, { "vulnerability": "VCID-94mh-kks8-4yf4" }, { "vulnerability": "VCID-9mh9-rax2-1bbb" }, { "vulnerability": "VCID-9psz-qfqt-e3fs" }, { "vulnerability": "VCID-9qtg-gxza-6ba9" }, { "vulnerability": "VCID-9xty-6acy-mub7" }, { "vulnerability": "VCID-ajrr-ueqy-2bam" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-cft6-gvm9-8qf4" }, { "vulnerability": "VCID-cq5z-6cmf-5kfs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-f91q-9psx-qkaa" }, { "vulnerability": "VCID-g5sw-gyv7-vya1" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-hmj1-53pj-2ugn" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jn4q-gdy9-eqa4" }, { "vulnerability": "VCID-jvbh-pnxm-9bg7" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-kzy6-b4n3-m7d4" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-mhpn-9y7w-ykcd" }, { "vulnerability": "VCID-p1yd-qud5-ckbu" }, { "vulnerability": "VCID-pffr-3a27-4qgx" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-qysn-w1za-83ea" }, { "vulnerability": "VCID-sgvg-768f-gybf" }, { "vulnerability": "VCID-snqn-nz53-f3b7" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-tswn-2k3y-wkhk" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-w6ws-2kbb-bfgs" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" }, { "vulnerability": "VCID-zuw7-d1r3-77h1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.0.rc1" }, { "url": "http://public2.vulnerablecode.io/api/packages/76764?format=api", "purl": "pkg:gem/nokogiri@1.6.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-12ee-na2t-6kg5" }, { "vulnerability": "VCID-1h5h-pvc7-9yhh" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-24ud-18pe-dudw" }, { "vulnerability": "VCID-2ub7-t6nu-syfs" }, { "vulnerability": "VCID-38c3-z9yc-4ybx" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-5wxq-ekcv-vqhq" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-8274-u9e9-uufm" }, { "vulnerability": "VCID-94b6-kg9t-fbee" }, { "vulnerability": "VCID-94mh-kks8-4yf4" }, { "vulnerability": "VCID-9mh9-rax2-1bbb" }, { "vulnerability": "VCID-9psz-qfqt-e3fs" }, { "vulnerability": "VCID-9qtg-gxza-6ba9" }, { "vulnerability": "VCID-9xty-6acy-mub7" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-b2g7-1rh9-jkgb" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-cft6-gvm9-8qf4" }, { "vulnerability": "VCID-cq5z-6cmf-5kfs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-f91q-9psx-qkaa" }, { "vulnerability": "VCID-g5sw-gyv7-vya1" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-hmj1-53pj-2ugn" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jn4q-gdy9-eqa4" }, { "vulnerability": "VCID-jvbh-pnxm-9bg7" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-kzy6-b4n3-m7d4" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-mhpn-9y7w-ykcd" }, { "vulnerability": "VCID-p1yd-qud5-ckbu" }, { "vulnerability": "VCID-pffr-3a27-4qgx" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-qysn-w1za-83ea" }, { "vulnerability": "VCID-sgvg-768f-gybf" }, { "vulnerability": "VCID-snqn-nz53-f3b7" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-tswn-2k3y-wkhk" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-w6ws-2kbb-bfgs" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" }, { "vulnerability": "VCID-zuw7-d1r3-77h1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.1" } ], "aliases": [ "CVE-2013-6461", "GHSA-jmhh-w7xp-wg39", "OSV-101458" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ajrr-ueqy-2bam" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/17320?format=api", "vulnerability_id": "VCID-arq2-c738-tugt", "summary": "Nokogiri updates packaged libxml2 to v2.10.4 to resolve multiple CVEs\n### Summary\n\nNokogiri v1.14.3 upgrades the packaged version of its dependency libxml2 to [v2.10.4](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.10.4) from v2.10.3.\n\nlibxml2 v2.10.4 addresses the following known vulnerabilities:\n\n- [CVE-2023-29469](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29469): Hashing of empty dict strings isn't deterministic\n- [CVE-2023-28484](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28484): Fix null deref in xmlSchemaFixupComplexType\n- Schemas: Fix null-pointer-deref in xmlSchemaCheckCOSSTDerivedOK\n\nPlease note that this advisory only applies to the CRuby implementation of Nokogiri `< 1.14.3`, and only if the _packaged_ libraries are being used. If you've overridden defaults at installation time to use _system_ libraries instead of packaged libraries, you should instead pay attention to your distro's `libxml2` release announcements.\n\n\n### Mitigation\n\nUpgrade to Nokogiri `>= 1.14.3`.\n\nUsers who are unable to upgrade Nokogiri may also choose a more complicated mitigation: compile and link Nokogiri against external libraries libxml2 `>= 2.10.4` which will also address these same issues.\n\n\n### Impact\n\nNo public information has yet been published about the security-related issues other than the upstream commits. Examination of those changesets indicate that the more serious issues relate to libxml2 dereferencing NULL pointers and potentially segfaulting while parsing untrusted inputs.\n\nThe commits can be examined at:\n\n- [[CVE-2023-29469] Hashing of empty dict strings isn't deterministic (09a2dd45) · Commits · GNOME / libxml2 · GitLab](https://gitlab.gnome.org/GNOME/libxml2/-/commit/09a2dd453007f9c7205274623acdd73747c22d64)\n- [[CVE-2023-28484] Fix null deref in xmlSchemaFixupComplexType (647e072e) · Commits · GNOME / libxml2 · GitLab](https://gitlab.gnome.org/GNOME/libxml2/-/commit/647e072ea0a2f12687fa05c172f4c4713fdb0c4f)\n- [schemas: Fix null-pointer-deref in xmlSchemaCheckCOSSTDerivedOK (4c6922f7) · Commits · GNOME / libxml2 · GitLab](https://gitlab.gnome.org/GNOME/libxml2/-/commit/4c6922f763ad958c48ff66f82823ae21f2e92ee6)", "references": [ { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28484", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28484" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29469", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29469" }, { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/09a2dd453007f9c7205274623acdd73747c22d64", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/09a2dd453007f9c7205274623acdd73747c22d64" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/4c6922f763ad958c48ff66f82823ae21f2e92ee6", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/4c6922f763ad958c48ff66f82823ae21f2e92ee6" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/647e072ea0a2f12687fa05c172f4c4713fdb0c4f", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/647e072ea0a2f12687fa05c172f4c4713fdb0c4f" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.10.4", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.10.4" }, { "reference_url": "https://github.com/advisories/GHSA-pxvg-2qj5-37jq", "reference_id": "GHSA-pxvg-2qj5-37jq", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-pxvg-2qj5-37jq" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-pxvg-2qj5-37jq", "reference_id": "GHSA-pxvg-2qj5-37jq", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-pxvg-2qj5-37jq" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/63408?format=api", "purl": "pkg:gem/nokogiri@1.14.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.14.3" } ], "aliases": [ "GHSA-pxvg-2qj5-37jq", "GMS-2023-1115" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-arq2-c738-tugt" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/204496?format=api", "vulnerability_id": "VCID-bj99-tt95-63ak", "summary": "", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-40304.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-40304.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-40304", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00219", "scoring_system": "epss", "scoring_elements": "0.44522", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-40304" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40304", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40304" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://nokogiri.org/CHANGELOG.html#1139-2022-10-18", "reference_id": "", "reference_type": "", "scores": [], "url": "https://nokogiri.org/CHANGELOG.html#1139-2022-10-18" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1022225", "reference_id": "1022225", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1022225" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/1b41ec4e9433b05bb0376be4725804c54ef1d80b", "reference_id": "1b41ec4e9433b05bb0376be4725804c54ef1d80b", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-28T19:47:33Z/" } ], "url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/1b41ec4e9433b05bb0376be4725804c54ef1d80b" }, { "reference_url": "http://seclists.org/fulldisclosure/2022/Dec/21", "reference_id": "21", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-28T19:47:33Z/" } ], "url": "http://seclists.org/fulldisclosure/2022/Dec/21" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136288", "reference_id": "2136288", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136288" }, { "reference_url": "http://seclists.org/fulldisclosure/2022/Dec/24", "reference_id": "24", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-28T19:47:33Z/" } ], "url": "http://seclists.org/fulldisclosure/2022/Dec/24" }, { "reference_url": "http://seclists.org/fulldisclosure/2022/Dec/25", "reference_id": "25", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-28T19:47:33Z/" } ], "url": "http://seclists.org/fulldisclosure/2022/Dec/25" }, { "reference_url": "http://seclists.org/fulldisclosure/2022/Dec/26", "reference_id": "26", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-28T19:47:33Z/" } ], "url": "http://seclists.org/fulldisclosure/2022/Dec/26" }, { "reference_url": "http://seclists.org/fulldisclosure/2022/Dec/27", "reference_id": "27", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-28T19:47:33Z/" } ], "url": "http://seclists.org/fulldisclosure/2022/Dec/27" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40304", "reference_id": "CVE-2022-40304", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40304" }, { "reference_url": "https://security.gentoo.org/glsa/202210-39", "reference_id": "GLSA-202210-39", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202210-39" }, { "reference_url": "https://support.apple.com/kb/HT213531", "reference_id": "HT213531", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-28T19:47:33Z/" } ], "url": "https://support.apple.com/kb/HT213531" }, { "reference_url": "https://support.apple.com/kb/HT213533", "reference_id": "HT213533", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-28T19:47:33Z/" } ], "url": "https://support.apple.com/kb/HT213533" }, { "reference_url": "https://support.apple.com/kb/HT213534", "reference_id": "HT213534", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-28T19:47:33Z/" } ], "url": "https://support.apple.com/kb/HT213534" }, { "reference_url": "https://support.apple.com/kb/HT213535", "reference_id": "HT213535", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-28T19:47:33Z/" } ], "url": "https://support.apple.com/kb/HT213535" }, { "reference_url": "https://support.apple.com/kb/HT213536", "reference_id": "HT213536", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-28T19:47:33Z/" } ], "url": "https://support.apple.com/kb/HT213536" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20221209-0003/", "reference_id": "ntap-20221209-0003", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-28T19:47:33Z/" } ], "url": "https://security.netapp.com/advisory/ntap-20221209-0003/" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8841", "reference_id": "RHSA-2022:8841", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8841" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0173", "reference_id": "RHSA-2023:0173", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0173" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0338", "reference_id": "RHSA-2023:0338", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0338" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:0413", "reference_id": "RHSA-2024:0413", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:0413" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/-/tags", "reference_id": "tags", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-28T19:47:33Z/" } ], "url": "https://gitlab.gnome.org/GNOME/libxml2/-/tags" }, { "reference_url": "https://usn.ubuntu.com/5760-1/", "reference_id": "USN-5760-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5760-1/" }, { "reference_url": "https://usn.ubuntu.com/5760-2/", "reference_id": "USN-5760-2", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5760-2/" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/-/tags/v2.10.3", "reference_id": "v2.10.3", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-28T19:47:33Z/" } ], "url": "https://gitlab.gnome.org/GNOME/libxml2/-/tags/v2.10.3" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/79536?format=api", "purl": "pkg:gem/nokogiri@1.13.9", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.13.9" } ], "aliases": [ "CVE-2022-40304" ], "risk_score": 3.5, "exploitability": "0.5", "weighted_severity": "7.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-bj99-tt95-63ak" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/3398?format=api", "vulnerability_id": "VCID-cft6-gvm9-8qf4", "summary": "xml external entity injection", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-41098.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-41098.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-41098", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00251", "scoring_system": "epss", "scoring_elements": "0.48579", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-41098" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2021-41098.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2021-41098.yml" }, { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/commit/5bf729ff3cc84709ee3c3248c981584088bf9f6d", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/commit/5bf729ff3cc84709ee3c3248c981584088bf9f6d" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-2rr5-8q37-2w7h", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-2rr5-8q37-2w7h" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2008914", "reference_id": "2008914", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2008914" }, { "reference_url": "https://security.archlinux.org/AVG-2424", "reference_id": "AVG-2424", "reference_type": "", "scores": [ { "value": "High", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-2424" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41098", "reference_id": "CVE-2021-41098", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41098" }, { "reference_url": "https://github.com/advisories/GHSA-2rr5-8q37-2w7h", "reference_id": "GHSA-2rr5-8q37-2w7h", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-2rr5-8q37-2w7h" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/58133?format=api", "purl": "pkg:gem/nokogiri@1.12.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.12.5" } ], "aliases": [ "CVE-2021-41098", "GHSA-2rr5-8q37-2w7h" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-cft6-gvm9-8qf4" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/345938?format=api", "vulnerability_id": "VCID-cq5z-6cmf-5kfs", "summary": "Update packaged dependency libxml2 from 2.9.10 to 2.9.12\n### Summary\n\nNokogiri v1.11.4 updates the vendored libxml2 from v2.9.10 to v2.9.12 which addresses:\n\n- [CVE-2019-20388](https://security.archlinux.org/CVE-2019-20388) (Medium severity)\n- [CVE-2020-24977](https://security.archlinux.org/CVE-2020-24977) (Medium severity)\n- [CVE-2021-3517](https://security.archlinux.org/CVE-2021-3517) (Medium severity)\n- [CVE-2021-3518](https://security.archlinux.org/CVE-2021-3518) (Medium severity)\n- [CVE-2021-3537](https://security.archlinux.org/CVE-2021-3537) (Low severity)\n- [CVE-2021-3541](https://security.archlinux.org/CVE-2021-3541) (Low severity)\n\nNote that two additional CVEs were addressed upstream but are not relevant to this release. [CVE-2021-3516](https://security.archlinux.org/CVE-2021-3516) via `xmllint` is not present in Nokogiri, and [CVE-2020-7595](https://security.archlinux.org/CVE-2020-7595) has been patched in Nokogiri since v1.10.8 (see #1992).\n\nPlease note that this advisory only applies to the CRuby implementation of Nokogiri `< 1.11.4`, and only if the packaged version of libxml2 is being used. If you've overridden defaults at installation time to use system libraries instead of packaged libraries, you should instead pay attention to your distro's `libxml2` release announcements.\n\n\n### Mitigation\n\nUpgrade to Nokogiri `>= 1.11.4`.\n\n\n### Impact\n\nI've done a brief analysis of the published CVEs that are addressed in this upstream release. The libxml2 maintainers have not released a canonical set of CVEs, and so this list is pieced together from secondary sources and may be incomplete.\n\nAll information below is sourced from [security.archlinux.org](https://security.archlinux.org), which appears to have the most up-to-date information as of this analysis.\n\n#### [CVE-2019-20388](https://security.archlinux.org/CVE-2019-20388)\n\n- **Severity**: Medium\n- **Type**: Denial of service\n- **Description**: A memory leak was found in the xmlSchemaValidateStream function of libxml2. Applications that use this library may be vulnerable to memory not being freed leading to a denial of service.\n- **Fixed**: https://gitlab.gnome.org/GNOME/libxml2/commit/7ffcd44d7e6c46704f8af0321d9314cd26e0e18a\n\nVerified that the fix commit first appears in v2.9.11. It seems possible that this issue would be present in programs using Nokogiri < v1.11.4.\n\n\n#### [CVE-2020-7595](https://security.archlinux.org/CVE-2020-7595)\n\n- **Severity**: Medium\n- **Type**: Denial of service\n- **Description**: xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.\n- **Fixed**: https://gitlab.gnome.org/GNOME/libxml2/commit/0e1a49c8907645d2e155f0d89d4d9895ac5112b5\n\nThis has been patched in Nokogiri since v1.10.8 (see #1992).\n\n\n#### [CVE-2020-24977](https://security.archlinux.org/CVE-2020-24977)\n\n- **Severity**: Medium\n- **Type**: Information disclosure\n- **Description**: GNOME project libxml2 <= 2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c.\n- **Fixed**: https://gitlab.gnome.org/GNOME/libxml2/commit/50f06b3efb638efb0abd95dc62dca05ae67882c2\n\nVerified that the fix commit first appears in v2.9.11. It seems possible that this issue would be present in programs using Nokogiri < v1.11.4.\n\n\n#### [CVE-2021-3516](https://security.archlinux.org/CVE-2021-3516)\n\n- **Severity**: Medium\n- **Type**: Arbitrary code execution (no remote vector)\n- **Description**: A use-after-free security issue was found libxml2 before version 2.9.11 when \"xmllint --html --push\" is used to process crafted files.\n- **Issue**: https://gitlab.gnome.org/GNOME/libxml2/-/issues/230\n- **Fixed**: https://gitlab.gnome.org/GNOME/libxml2/-/commit/1358d157d0bd83be1dfe356a69213df9fac0b539\n\nVerified that the fix commit first appears in v2.9.11. This vector does not exist within Nokogiri, which does not ship `xmllint`.\n\n\n#### [CVE-2021-3517](https://security.archlinux.org/CVE-2021-3517)\n\n- **Severity**: Medium\n- **Type**: Arbitrary code execution\n- **Description**: A heap-based buffer overflow was found in libxml2 before version 2.9.11 when processing truncated UTF-8 input.\n- **Issue**: https://gitlab.gnome.org/GNOME/libxml2/-/issues/235\n- **Fixed**: https://gitlab.gnome.org/GNOME/libxml2/-/commit/bf22713507fe1fc3a2c4b525cf0a88c2dc87a3a2\n\nVerified that the fix commit first appears in v2.9.11. It seems possible that this issue would be present in programs using Nokogiri < v1.11.4.\n\n\n#### [CVE-2021-3518](https://security.archlinux.org/CVE-2021-3518)\n\n- **Severity**: Medium\n- **Type**: Arbitrary code execution\n- **Description**: A use-after-free security issue was found in libxml2 before version 2.9.11 in xmlXIncludeDoProcess() in xinclude.c when processing crafted files.\n- **Issue**: https://gitlab.gnome.org/GNOME/libxml2/-/issues/237\n- **Fixed**: https://gitlab.gnome.org/GNOME/libxml2/-/commit/1098c30a040e72a4654968547f415be4e4c40fe7\n\nVerified that the fix commit first appears in v2.9.11. It seems possible that this issue would be present in programs using Nokogiri < v1.11.4.\n\n\n#### [CVE-2021-3537](https://security.archlinux.org/CVE-2021-3537)\n\n- **Severity**: Low\n- **Type**: Denial of service\n- **Description**: It was found that libxml2 before version 2.9.11 did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application.\n- **Issue**: https://gitlab.gnome.org/GNOME/libxml2/-/issues/243\n- **Fixed**: https://gitlab.gnome.org/GNOME/libxml2/-/commit/babe75030c7f64a37826bb3342317134568bef61\n\nVerified that the fix commit first appears in v2.9.11. It seems possible that this issue would be present in programs using Nokogiri < v1.11.4.\n\n\n#### [CVE-2021-3541](https://security.archlinux.org/CVE-2021-3541)\n\n- **Severity**: Low\n- **Type**: Denial of service\n- **Description**: A security issue was found in libxml2 before version 2.9.11. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.\n- **Fixed**: https://gitlab.gnome.org/GNOME/libxml2/-/commit/8598060bacada41a0eb09d95c97744ff4e428f8e\n\nVerified that the fix commit first appears in v2.9.11. It seems possible that this issue would be present in programs using Nokogiri < v1.11.4, however Nokogiri's default parse options prevent the attack from succeeding (it is necessary to opt into `DTDLOAD` which is off by default).\n\nFor more details supporting this analysis of this CVE, please visit #2233.", "references": [ { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/commit/9b90a8854f74b5f672a437ba0043a503bc259d1b", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/commit/9b90a8854f74b5f672a437ba0043a503bc259d1b" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-7rrm-v45f-jp64", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-7rrm-v45f-jp64" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3541", "reference_id": "CVE-2021-3541", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3541" }, { "reference_url": "https://github.com/advisories/GHSA-7rrm-v45f-jp64", "reference_id": "GHSA-7rrm-v45f-jp64", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-7rrm-v45f-jp64" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/57350?format=api", "purl": "pkg:gem/nokogiri@1.11.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-cft6-gvm9-8qf4" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.11.4" } ], "aliases": [ "GHSA-7rrm-v45f-jp64", "GMS-2021-171" ], "risk_score": 3.4, "exploitability": "0.5", "weighted_severity": "6.8", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-cq5z-6cmf-5kfs" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/345937?format=api", "vulnerability_id": "VCID-e37h-xnn4-hbcn", "summary": "Nokogiri patches vendored libxml2 to resolve multiple CVEs\n## Summary\n\nNokogiri v1.18.9 patches the vendored libxml2 to address\nCVE-2025-6021, CVE-2025-6170, CVE-2025-49794, CVE-2025-49795,\nand CVE-2025-49796.\n\n## Impact and severity\n\n### CVE-2025-6021\n\nA flaw was found in libxml2's xmlBuildQName function, where integer\noverflows in buffer size calculations can lead to a stack-based\nbuffer overflow. This issue can result in memory corruption or a\ndenial of service when processing crafted input.\n\nNVD claims a severity of 7.5 High\n(CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)\n\nFixed by applying https://gitlab.gnome.org/GNOME/libxml2/-/commit/17d950ae\n\n### CVE-2025-6170\n\nA flaw was found in the interactive shell of the xmllint command-line\ntool, used for parsing XML files. When a user inputs an overly long\ncommand, the program does not check the input size properly, which\ncan cause it to crash. This issue might allow attackers to run\nharmful code in rare configurations without modern protections.\n\nNVD claims a severity of 2.5 Low\n(CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L)\n\nFixed by applying https://gitlab.gnome.org/GNOME/libxml2/-/commit/5e9ec5c1\n\n### CVE-2025-49794\n\nA use-after-free vulnerability was found in libxml2. This issue\noccurs when parsing XPath elements under certain circumstances when\nthe XML schematron has the <sch:name path=\"...\"/> schema elements.\nThis flaw allows a malicious actor to craft a malicious XML document\nused as input for libxml, resulting in the program's crash using\nlibxml or other possible undefined behaviors.\n\nNVD claims a severity of 9.1 Critical\n(CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)\n\nFixed by applying https://gitlab.gnome.org/GNOME/libxml2/-/commit/81cef8c5\n\n### CVE-2025-49795\n\nA NULL pointer dereference vulnerability was found in libxml2 when\nprocessing XPath XML expressions. This flaw allows an attacker to\ncraft a malicious XML input to libxml2, leading to a denial of service.\n\nNVD claims a severity of 7.5 High\n(CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)\n\nFixed by applying https://gitlab.gnome.org/GNOME/libxml2/-/commit/62048278\n\n### CVE-2025-49796\n\nA vulnerability was found in libxml2. Processing certain sch:name\nelements from the input XML file can trigger a memory corruption\nissue. This flaw allows an attacker to craft a malicious XML input\nfile that can lead libxml to crash, resulting in a denial of service\nor other possible undefined behavior due to sensitive data being\ncorrupted in memory.\n\nNVD claims a severity of 9.1 Critical\n(CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)\n\nFixed by applying https://gitlab.gnome.org/GNOME/libxml2/-/commit/81cef8c5\n\n## Affected Versions\n\n- Nokogiri < 1.18.9 when using CRuby (MRI) with vendored libxml2\n\n## Patched Versions\n\n- Nokogiri >= 1.18.9\n\n## Mitigation\n\nUpgrade to Nokogiri v1.18.9 or later.\n\nUsers who are unable to upgrade Nokogiri may also choose a more\ncomplicated mitigation: compile and link Nokogiri against patched\nexternal libxml2 libraries which will also address these same issues.", "references": [ { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/pull/3526", "reference_id": "", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/pull/3526" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-353f-x4gh-cqq8", "reference_id": "", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-353f-x4gh-cqq8" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49794", "reference_id": "", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49794" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49795", "reference_id": "", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49795" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49796", "reference_id": "", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49796" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6021", "reference_id": "", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6021" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6170", "reference_id": "", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6170" }, { "reference_url": "https://github.com/advisories/GHSA-353f-x4gh-cqq8", "reference_id": "GHSA-353f-x4gh-cqq8", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-353f-x4gh-cqq8" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/168187?format=api", "purl": "pkg:gem/nokogiri@1.18.9", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-gpcm-1wx2-guhq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.18.9" } ], "aliases": [ "GHSA-353f-x4gh-cqq8" ], "risk_score": 4.5, "exploitability": "0.5", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-e37h-xnn4-hbcn" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/12811?format=api", "vulnerability_id": "VCID-f91q-9psx-qkaa", "summary": "NULL Pointer Dereference\nA NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.", "references": [ { "reference_url": "https://access.redhat.com/errata/RHSA-2019:1543", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-03T21:07:49Z/" } ], "url": "https://access.redhat.com/errata/RHSA-2019:1543" }, { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-14404.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-14404.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2018-14404", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.20012", "scoring_system": "epss", "scoring_elements": "0.95579", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2018-14404" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901817", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-03T21:07:49Z/" } ], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901817" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1595985", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-03T21:07:49Z/" } ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1595985" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14404", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14404" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/issues/1785", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/issues/1785" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/issues/10", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-03T21:07:49Z/" } ], "url": "https://gitlab.gnome.org/GNOME/libxml2/issues/10" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-03T21:07:49Z/" } ], "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-03T21:07:49Z/" } ], "url": "https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20190719-0002", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20190719-0002" }, { "reference_url": "https://usn.ubuntu.com/3739-1", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://usn.ubuntu.com/3739-1" }, { "reference_url": "https://usn.ubuntu.com/3739-2", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://usn.ubuntu.com/3739-2" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14404", "reference_id": "CVE-2018-14404", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14404" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2018-14404.yml", "reference_id": "CVE-2018-14404.YML", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2018-14404.yml" }, { "reference_url": "https://github.com/advisories/GHSA-6qvp-r6r3-9p7h", "reference_id": "GHSA-6qvp-r6r3-9p7h", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-6qvp-r6r3-9p7h" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20190719-0002/", "reference_id": "ntap-20190719-0002", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-03T21:07:49Z/" } ], "url": "https://security.netapp.com/advisory/ntap-20190719-0002/" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:1190", "reference_id": "RHSA-2020:1190", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2020:1190" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:1827", "reference_id": "RHSA-2020:1827", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2020:1827" }, { "reference_url": "https://usn.ubuntu.com/3739-2/", "reference_id": "USN-3739-2", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-03T21:07:49Z/" } ], "url": "https://usn.ubuntu.com/3739-2/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/56340?format=api", "purl": "pkg:gem/nokogiri@1.8.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-12ee-na2t-6kg5" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-24ud-18pe-dudw" }, { "vulnerability": "VCID-38c3-z9yc-4ybx" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-5wxq-ekcv-vqhq" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-9psz-qfqt-e3fs" }, { "vulnerability": "VCID-9qtg-gxza-6ba9" }, { "vulnerability": "VCID-9xty-6acy-mub7" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-cft6-gvm9-8qf4" }, { "vulnerability": "VCID-cq5z-6cmf-5kfs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-g5sw-gyv7-vya1" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-kzy6-b4n3-m7d4" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-pffr-3a27-4qgx" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-qysn-w1za-83ea" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-w6ws-2kbb-bfgs" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" }, { "vulnerability": "VCID-zuw7-d1r3-77h1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.8.5" } ], "aliases": [ "CVE-2018-14404", "GHSA-6qvp-r6r3-9p7h" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-f91q-9psx-qkaa" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/5986?format=api", "vulnerability_id": "VCID-g5sw-gyv7-vya1", "summary": "multiple issues", "references": [ { "reference_url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00036.html", "reference_id": "", "reference_type": "", "scores": [], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00036.html" }, { "reference_url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00061.html", "reference_id": "", "reference_type": "", "scores": [], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00061.html" }, { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-24977.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-24977.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2020-24977", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00697", "scoring_system": "epss", "scoring_elements": "0.72256", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-24977" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24977", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24977" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/50f06b3efb638efb0abd95dc62dca05ae67882c2", "reference_id": "", "reference_type": "", "scores": [], "url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/50f06b3efb638efb0abd95dc62dca05ae67882c2" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/178", "reference_id": "", "reference_type": "", "scores": [], "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/178" }, { "reference_url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2NQ5GTDYOVH26PBCPYXXMGW5ZZXWMGZC/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2NQ5GTDYOVH26PBCPYXXMGW5ZZXWMGZC/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5KTUAGDLEHTH6HU66HBFAFTSQ3OKRAN3/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5KTUAGDLEHTH6HU66HBFAFTSQ3OKRAN3/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/674LQPJO2P2XTBTREFR5LOZMBTZ4PZAY/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/674LQPJO2P2XTBTREFR5LOZMBTZ4PZAY/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7KQXOHIE3MNY3VQXEN7LDQUJNIHOVHAW/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7KQXOHIE3MNY3VQXEN7LDQUJNIHOVHAW/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ENEHQIBMSI6TZVS35Y6I4FCTYUQDLJVP/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ENEHQIBMSI6TZVS35Y6I4FCTYUQDLJVP/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H3IQ7OQXBKWD3YP7HO6KCNOMLE5ZO2IR/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H3IQ7OQXBKWD3YP7HO6KCNOMLE5ZO2IR/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J3ICASXZI2UQYFJAOQWHSTNWGED3VXOE/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J3ICASXZI2UQYFJAOQWHSTNWGED3VXOE/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JCHXIWR5DHYO3RSO7RAHEC6VJKXD2EH2/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JCHXIWR5DHYO3RSO7RAHEC6VJKXD2EH2/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O7MEWYKIKMV2SKMGH4IDWVU3ZGJXBCPQ/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O7MEWYKIKMV2SKMGH4IDWVU3ZGJXBCPQ/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RIQAMBA2IJUTQG5VOP5LZVIZRNCKXHEQ/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RIQAMBA2IJUTQG5VOP5LZVIZRNCKXHEQ/" }, { "reference_url": "https://security.gentoo.org/glsa/202107-05", "reference_id": "", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202107-05" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20200924-0001/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://security.netapp.com/advisory/ntap-20200924-0001/" }, { "reference_url": "https://www.oracle.com/security-alerts/cpuoct2021.html", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.oracle.com/security-alerts/cpuoct2021.html" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1877788", "reference_id": "1877788", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1877788" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=969529", "reference_id": "969529", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=969529" }, { "reference_url": "https://security.archlinux.org/ASA-202011-15", "reference_id": "ASA-202011-15", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-202011-15" }, { "reference_url": "https://security.archlinux.org/AVG-1263", "reference_id": "AVG-1263", "reference_type": "", "scores": [ { "value": "Medium", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1263" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2020-24977", "reference_id": "CVE-2020-24977", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-24977" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:1597", "reference_id": "RHSA-2021:1597", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:1597" }, { "reference_url": "https://usn.ubuntu.com/4991-1/", "reference_id": "USN-4991-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/4991-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/57350?format=api", "purl": "pkg:gem/nokogiri@1.11.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-cft6-gvm9-8qf4" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.11.4" } ], "aliases": [ "CVE-2020-24977" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-g5sw-gyv7-vya1" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/22601?format=api", "vulnerability_id": "VCID-gpcm-1wx2-guhq", "summary": "Nokogiri does not check the return value from xmlC14NExecute\nNokogiri's CRuby extension fails to check the return value from `xmlC14NExecute` in the method `Nokogiri::XML::Document#canonicalize` and `Nokogiri::XML::Node#canonicalize`. When canonicalization fails, an empty string is returned instead of raising an exception. This incorrect return value may allow downstream libraries to accept invalid or incomplete canonicalized XML, which has been demonstrated to enable signature validation bypass in SAML libraries.\n\nJRuby is not affected, as the Java implementation correctly raises `RuntimeError` on canonicalization failure.", "references": [ { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/advisories/GHSA-wx95-c6cv-8532", "reference_id": "GHSA-wx95-c6cv-8532", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-wx95-c6cv-8532" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-wx95-c6cv-8532", "reference_id": "GHSA-wx95-c6cv-8532", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-wx95-c6cv-8532" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/72892?format=api", "purl": "pkg:gem/nokogiri@1.19.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-gpcm-1wx2-guhq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.19.1" } ], "aliases": [ "GHSA-wx95-c6cv-8532" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-gpcm-1wx2-guhq" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/10757?format=api", "vulnerability_id": "VCID-hmj1-53pj-2ugn", "summary": "Multiple vulnerabilities in libxml2, libxslt\nThe vendored libxml2 and libxslt libraries have multiple vulnerabilities: CVE-2015-1819 CVE-2015-7941_1 CVE-2015-7941_2 CVE-2015-7942 CVE-2015-7942-2 CVE-2015-8035 CVE-2015-7995", "references": [ { "reference_url": "https://github.com/sparklemotion/nokogiri/blob/master/CHANGELOG.rdoc#167rc4--2015-11-22", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/sparklemotion/nokogiri/blob/master/CHANGELOG.rdoc#167rc4--2015-11-22" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/blob/v1.6.6.x/CHANGELOG.rdoc#1663--2015-11-16", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/sparklemotion/nokogiri/blob/v1.6.6.x/CHANGELOG.rdoc#1663--2015-11-16" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/commit/ac6106f1e641d50b27752c52b355e01d03ae8829", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/sparklemotion/nokogiri/commit/ac6106f1e641d50b27752c52b355e01d03ae8829" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/commit/ee52b7be5b47e1029af98f6b7eb6df7fc5ffd359", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/sparklemotion/nokogiri/commit/ee52b7be5b47e1029af98f6b7eb6df7fc5ffd359" }, { "reference_url": "https://groups.google.com/forum/#!topic/nokogiri-talk/gEpHWo2xLCE", "reference_id": "", "reference_type": "", "scores": [], "url": "https://groups.google.com/forum/#!topic/nokogiri-talk/gEpHWo2xLCE" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/51336?format=api", "purl": "pkg:gem/nokogiri@1.6.6.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-12ee-na2t-6kg5" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-24ud-18pe-dudw" }, { "vulnerability": "VCID-2ub7-t6nu-syfs" }, { "vulnerability": "VCID-38c3-z9yc-4ybx" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-5wxq-ekcv-vqhq" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-8274-u9e9-uufm" }, { "vulnerability": "VCID-94b6-kg9t-fbee" }, { "vulnerability": "VCID-94mh-kks8-4yf4" }, { "vulnerability": "VCID-9mh9-rax2-1bbb" }, { "vulnerability": "VCID-9psz-qfqt-e3fs" }, { "vulnerability": "VCID-9qtg-gxza-6ba9" }, { "vulnerability": "VCID-9xty-6acy-mub7" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-b2g7-1rh9-jkgb" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-cft6-gvm9-8qf4" }, { "vulnerability": "VCID-cq5z-6cmf-5kfs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-f91q-9psx-qkaa" }, { "vulnerability": "VCID-g5sw-gyv7-vya1" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jn4q-gdy9-eqa4" }, { "vulnerability": "VCID-jvbh-pnxm-9bg7" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-kzy6-b4n3-m7d4" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-mhpn-9y7w-ykcd" }, { "vulnerability": "VCID-p1yd-qud5-ckbu" }, { "vulnerability": "VCID-pffr-3a27-4qgx" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-qysn-w1za-83ea" }, { "vulnerability": "VCID-sgvg-768f-gybf" }, { "vulnerability": "VCID-snqn-nz53-f3b7" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-tswn-2k3y-wkhk" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-w6ws-2kbb-bfgs" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" }, { "vulnerability": "VCID-zuw7-d1r3-77h1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.6.3" }, { "url": "http://public2.vulnerablecode.io/api/packages/51280?format=api", "purl": "pkg:gem/nokogiri@1.6.7.rc4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-12ee-na2t-6kg5" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-24ud-18pe-dudw" }, { "vulnerability": "VCID-2ub7-t6nu-syfs" }, { "vulnerability": "VCID-38c3-z9yc-4ybx" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-5wxq-ekcv-vqhq" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-8274-u9e9-uufm" }, { "vulnerability": "VCID-94mh-kks8-4yf4" }, { "vulnerability": "VCID-9mh9-rax2-1bbb" }, { "vulnerability": "VCID-9psz-qfqt-e3fs" }, { "vulnerability": "VCID-9qtg-gxza-6ba9" }, { "vulnerability": "VCID-9xty-6acy-mub7" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-b2g7-1rh9-jkgb" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-cft6-gvm9-8qf4" }, { "vulnerability": "VCID-cq5z-6cmf-5kfs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-f91q-9psx-qkaa" }, { "vulnerability": "VCID-g5sw-gyv7-vya1" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jn4q-gdy9-eqa4" }, { "vulnerability": "VCID-jvbh-pnxm-9bg7" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-kzy6-b4n3-m7d4" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-mhpn-9y7w-ykcd" }, { "vulnerability": "VCID-p1yd-qud5-ckbu" }, { "vulnerability": "VCID-pffr-3a27-4qgx" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-qysn-w1za-83ea" }, { "vulnerability": "VCID-sgvg-768f-gybf" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-tswn-2k3y-wkhk" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-w6ws-2kbb-bfgs" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" }, { "vulnerability": "VCID-zuw7-d1r3-77h1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.7.rc4" } ], "aliases": [ "GMS-2015-42" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-hmj1-53pj-2ugn" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/15483?format=api", "vulnerability_id": "VCID-jjqw-bevm-f7b2", "summary": "Denial of Service (DoS) in Nokogiri on JRuby\n## Summary\n\nNokogiri `v1.13.4` updates the vendored `org.cyberneko.html` library to `1.9.22.noko2` which addresses [CVE-2022-24839](https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv). That CVE is rated 7.5 (High Severity).\n\nSee [GHSA-9849-p7jc-9rmv](https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv) for more information.\n\nPlease note that this advisory only applies to the **JRuby** implementation of Nokogiri `< 1.13.4`.\n\n\n## Mitigation\n\nUpgrade to Nokogiri `>= 1.13.4`.\n\n\n## Impact\n\n### [CVE-2022-24839](https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv) in nekohtml\n\n- **Severity**: High 7.5\n- **Type**: [CWE-400](https://cwe.mitre.org/data/definitions/400.html) Uncontrolled Resource Consumption\n- **Description**: The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup.\n- **See also**: [GHSA-9849-p7jc-9rmv](https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv)", "references": [ { "reference_url": "https://github.com/sparklemotion/nekohtml/commit/a800fce3b079def130ed42a408ff1d09f89e773d", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nekohtml/commit/a800fce3b079def130ed42a408ff1d09f89e773d" }, { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.4", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.4" }, { "reference_url": "https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ", "reference_id": "", "reference_type": "", "scores": [], "url": "https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ" }, { "reference_url": "https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ?utm_medium=email&utm_source=footer", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ?utm_medium=email&utm_source=footer" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24839", "reference_id": "CVE-2022-24839", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24839" }, { "reference_url": "https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv", "reference_id": "GHSA-9849-p7jc-9rmv", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv" }, { "reference_url": "https://github.com/advisories/GHSA-gx8x-g87m-h5q6", "reference_id": "GHSA-gx8x-g87m-h5q6", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-gx8x-g87m-h5q6" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-gx8x-g87m-h5q6", "reference_id": "GHSA-gx8x-g87m-h5q6", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-gx8x-g87m-h5q6" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/60098?format=api", "purl": "pkg:gem/nokogiri@1.13.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.13.4" } ], "aliases": [ "GHSA-gx8x-g87m-h5q6", "GMS-2022-786" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-jjqw-bevm-f7b2" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/2556?format=api", "vulnerability_id": "VCID-jn4q-gdy9-eqa4", "summary": "multiple issues", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-5029.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-5029.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2017-5029", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.01266", "scoring_system": "epss", "scoring_elements": "0.79769", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2017-5029" }, { "reference_url": "https://crbug.com/676623", "reference_id": "", "reference_type": "", "scores": [], "url": "https://crbug.com/676623" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5029", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5029" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5030", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5030" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5031", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5031" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5032", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5032" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5033", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5033" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5034", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5034" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5035", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5035" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5036", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5036" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5037", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5037" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5038", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5038" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5039", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5039" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5040", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5040" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5041", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5041" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5042", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5042" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5043", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5043" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5044", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5044" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5045", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5045" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5046", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5046" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.3", "scoring_system": "cvssv2", "scoring_elements": "AV:L/AC:M/Au:N/C:N/I:P/A:P" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://git.gnome.org/browse/libxslt/commit/?id=08ab2774b870de1c7b5a48693df75e8154addae5", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://git.gnome.org/browse/libxslt/commit/?id=08ab2774b870de1c7b5a48693df75e8154addae5" }, { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/issues/1634", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/issues/1634" }, { "reference_url": "https://ubuntu.com/security/notices/USN-3271-1", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://ubuntu.com/security/notices/USN-3271-1" }, { "reference_url": "http://www.securityfocus.com/bid/96767", "reference_id": "", "reference_type": "", "scores": [], "url": "http://www.securityfocus.com/bid/96767" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1431033", "reference_id": "1431033", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1431033" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=858546", "reference_id": "858546", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=858546" }, { "reference_url": "https://security.archlinux.org/ASA-201703-4", "reference_id": "ASA-201703-4", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-201703-4" }, { "reference_url": "https://security.archlinux.org/ASA-201703-5", "reference_id": "ASA-201703-5", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-201703-5" }, { "reference_url": "https://security.archlinux.org/AVG-195", "reference_id": "AVG-195", "reference_type": "", "scores": [ { "value": "Critical", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-195" }, { "reference_url": "https://security.archlinux.org/AVG-196", "reference_id": "AVG-196", "reference_type": "", "scores": [ { "value": "Critical", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-196" }, { "reference_url": "https://security.archlinux.org/AVG-197", "reference_id": "AVG-197", "reference_type": "", "scores": [ { "value": "Critical", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-197" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5029", "reference_id": "CVE-2017-5029", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5029" }, { "reference_url": "https://ubuntu.com/security/CVE-2017-5029", "reference_id": "CVE-2017-5029", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://ubuntu.com/security/CVE-2017-5029" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2017-5029.yml", "reference_id": "CVE-2017-5029.YML", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2017-5029.yml" }, { "reference_url": "https://github.com/advisories/GHSA-pf6m-fxpq-fg8v", "reference_id": "GHSA-pf6m-fxpq-fg8v", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-pf6m-fxpq-fg8v" }, { "reference_url": "https://security.gentoo.org/glsa/201804-01", "reference_id": "GLSA-201804-01", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/201804-01" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2017:0499", "reference_id": "RHSA-2017:0499", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2017:0499" }, { "reference_url": "https://usn.ubuntu.com/3236-1/", "reference_id": "USN-3236-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/3236-1/" }, { "reference_url": "https://usn.ubuntu.com/3271-1/", "reference_id": "USN-3271-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/3271-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/51850?format=api", "purl": "pkg:gem/nokogiri@1.7.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-12ee-na2t-6kg5" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-24ud-18pe-dudw" }, { "vulnerability": "VCID-38c3-z9yc-4ybx" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-5wxq-ekcv-vqhq" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-9mh9-rax2-1bbb" }, { "vulnerability": "VCID-9psz-qfqt-e3fs" }, { "vulnerability": "VCID-9qtg-gxza-6ba9" }, { "vulnerability": "VCID-9xty-6acy-mub7" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-cft6-gvm9-8qf4" }, { "vulnerability": "VCID-cq5z-6cmf-5kfs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-f91q-9psx-qkaa" }, { "vulnerability": "VCID-g5sw-gyv7-vya1" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jvbh-pnxm-9bg7" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-kzy6-b4n3-m7d4" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-p1yd-qud5-ckbu" }, { "vulnerability": "VCID-pffr-3a27-4qgx" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-qysn-w1za-83ea" }, { "vulnerability": "VCID-sgvg-768f-gybf" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-tswn-2k3y-wkhk" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-w6ws-2kbb-bfgs" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" }, { "vulnerability": "VCID-zuw7-d1r3-77h1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.7.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/73831?format=api", "purl": "pkg:gem/nokogiri@1.7.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-12ee-na2t-6kg5" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-24ud-18pe-dudw" }, { "vulnerability": "VCID-38c3-z9yc-4ybx" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-5wxq-ekcv-vqhq" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-9mh9-rax2-1bbb" }, { "vulnerability": "VCID-9psz-qfqt-e3fs" }, { "vulnerability": "VCID-9qtg-gxza-6ba9" }, { "vulnerability": "VCID-9xty-6acy-mub7" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-cft6-gvm9-8qf4" }, { "vulnerability": "VCID-cq5z-6cmf-5kfs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-f91q-9psx-qkaa" }, { "vulnerability": "VCID-g5sw-gyv7-vya1" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jvbh-pnxm-9bg7" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-kzy6-b4n3-m7d4" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-p1yd-qud5-ckbu" }, { "vulnerability": "VCID-pffr-3a27-4qgx" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-qysn-w1za-83ea" }, { "vulnerability": "VCID-sgvg-768f-gybf" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-tswn-2k3y-wkhk" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-w6ws-2kbb-bfgs" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" }, { "vulnerability": "VCID-zuw7-d1r3-77h1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.7.2" } ], "aliases": [ "CVE-2017-5029", "GHSA-pf6m-fxpq-fg8v" ], "risk_score": 4.5, "exploitability": "0.5", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-jn4q-gdy9-eqa4" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/12242?format=api", "vulnerability_id": "VCID-jvbh-pnxm-9bg7", "summary": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nIn the Loofah gem for Ruby, denylisted HTML attributes may occur in sanitized output by republishing a crafted HTML fragment.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-8048.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-8048.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2018-8048", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00689", "scoring_system": "epss", "scoring_elements": "0.72098", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2018-8048" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8048", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8048" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/flavorjones/loofah", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/flavorjones/loofah" }, { "reference_url": "https://github.com/flavorjones/loofah/commit/f739cf8eac5851f328b8044281d6653f74eff116", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/flavorjones/loofah/commit/f739cf8eac5851f328b8044281d6653f74eff116" }, { "reference_url": "https://github.com/flavorjones/loofah/issues/144", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/flavorjones/loofah/issues/144" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/pull/1746", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/pull/1746" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20191122-0003", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20191122-0003" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20191122-0003/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://security.netapp.com/advisory/ntap-20191122-0003/" }, { "reference_url": "https://www.debian.org/security/2018/dsa-4171", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.debian.org/security/2018/dsa-4171" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2018/03/19/5", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2018/03/19/5" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1559071", "reference_id": "1559071", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1559071" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=893596", "reference_id": "893596", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=893596" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8048", "reference_id": "CVE-2018-8048", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8048" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/loofah/CVE-2018-8048.yml", "reference_id": "CVE-2018-8048.YML", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/loofah/CVE-2018-8048.yml" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2018-8048.yml", "reference_id": "CVE-2018-8048.YML", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2018-8048.yml" }, { "reference_url": "https://github.com/advisories/GHSA-x7rv-cr6v-4vm4", "reference_id": "GHSA-x7rv-cr6v-4vm4", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-x7rv-cr6v-4vm4" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/54223?format=api", "purl": "pkg:gem/nokogiri@1.8.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-12ee-na2t-6kg5" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-24ud-18pe-dudw" }, { "vulnerability": "VCID-38c3-z9yc-4ybx" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-5wxq-ekcv-vqhq" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-9psz-qfqt-e3fs" }, { "vulnerability": "VCID-9qtg-gxza-6ba9" }, { "vulnerability": "VCID-9xty-6acy-mub7" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-cft6-gvm9-8qf4" }, { "vulnerability": "VCID-cq5z-6cmf-5kfs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-f91q-9psx-qkaa" }, { "vulnerability": "VCID-g5sw-gyv7-vya1" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-kzy6-b4n3-m7d4" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-pffr-3a27-4qgx" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-qysn-w1za-83ea" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-w6ws-2kbb-bfgs" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" }, { "vulnerability": "VCID-zuw7-d1r3-77h1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.8.3" } ], "aliases": [ "CVE-2018-8048", "GHSA-x7rv-cr6v-4vm4" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-jvbh-pnxm-9bg7" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/15489?format=api", "vulnerability_id": "VCID-jwaq-3j9v-nbde", "summary": "Inefficient Regular Expression Complexity\nNokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokogiri `>= 1.13.4`. There are no known workarounds for this issue.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-24836.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-24836.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-24836", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.01827", "scoring_system": "epss", "scoring_elements": "0.83216", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-24836" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24836", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24836" }, { "reference_url": "http://seclists.org/fulldisclosure/2022/Dec/23", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://seclists.org/fulldisclosure/2022/Dec/23" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/commit/e444525ef1634b675cd1cf52d39f4320ef0aecfd", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/commit/e444525ef1634b675cd1cf52d39f4320ef0aecfd" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.4", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.4" }, { "reference_url": "https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ?utm_medium=email&utm_source=footer", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ?utm_medium=email&utm_source=footer" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00013.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00013.html" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00018.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00018.html" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6DHCOWMA5PQTIQIMDENA7R2Y5BDYAIYM", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6DHCOWMA5PQTIQIMDENA7R2Y5BDYAIYM" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6DHCOWMA5PQTIQIMDENA7R2Y5BDYAIYM/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6DHCOWMA5PQTIQIMDENA7R2Y5BDYAIYM/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OUPLBUZVM4WPFSXBEP2JS3R6LMKRTLFC", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OUPLBUZVM4WPFSXBEP2JS3R6LMKRTLFC" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OUPLBUZVM4WPFSXBEP2JS3R6LMKRTLFC/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OUPLBUZVM4WPFSXBEP2JS3R6LMKRTLFC/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XMDCWRQXJQ3TFSETPCEFMQ6RR6ME5UA3", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XMDCWRQXJQ3TFSETPCEFMQ6RR6ME5UA3" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XMDCWRQXJQ3TFSETPCEFMQ6RR6ME5UA3/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XMDCWRQXJQ3TFSETPCEFMQ6RR6ME5UA3/" }, { "reference_url": "https://security.gentoo.org/glsa/202208-29", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.gentoo.org/glsa/202208-29" }, { "reference_url": "https://support.apple.com/kb/HT213532", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://support.apple.com/kb/HT213532" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1009787", "reference_id": "1009787", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1009787" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2074346", "reference_id": "2074346", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2074346" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24836", "reference_id": "CVE-2022-24836", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24836" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2022-24836.yml", "reference_id": "CVE-2022-24836.YML", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2022-24836.yml" }, { "reference_url": "https://github.com/advisories/GHSA-crjr-9rc5-ghw8", "reference_id": "GHSA-crjr-9rc5-ghw8", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-crjr-9rc5-ghw8" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-crjr-9rc5-ghw8", "reference_id": "GHSA-crjr-9rc5-ghw8", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-crjr-9rc5-ghw8" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8506", "reference_id": "RHSA-2022:8506", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8506" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/60098?format=api", "purl": "pkg:gem/nokogiri@1.13.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.13.4" } ], "aliases": [ "CVE-2022-24836", "GHSA-crjr-9rc5-ghw8" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-jwaq-3j9v-nbde" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/19362?format=api", "vulnerability_id": "VCID-ktaj-j2nh-zug6", "summary": "Duplicate\nThis advisory duplicates another.", "references": [ { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/discussions/3146", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/discussions/3146" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/92721970", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/92721970" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/604", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/604" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.5", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.5" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25062", "reference_id": "CVE-2024-25062", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25062" }, { "reference_url": "https://github.com/advisories/GHSA-xc9x-jj77-9p9j", "reference_id": "GHSA-xc9x-jj77-9p9j", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-xc9x-jj77-9p9j" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xc9x-jj77-9p9j", "reference_id": "GHSA-xc9x-jj77-9p9j", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xc9x-jj77-9p9j" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-xc9x-jj77-9p9j.yml", "reference_id": "GHSA-xc9x-jj77-9p9j.yml", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-xc9x-jj77-9p9j.yml" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/67577?format=api", "purl": "pkg:gem/nokogiri@1.15.6", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.15.6" }, { "url": "http://public2.vulnerablecode.io/api/packages/164329?format=api", "purl": "pkg:gem/nokogiri@1.16.0.rc1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.16.0.rc1" }, { "url": "http://public2.vulnerablecode.io/api/packages/67576?format=api", "purl": "pkg:gem/nokogiri@1.16.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.16.2" } ], "aliases": [ "GHSA-xc9x-jj77-9p9j", "GMS-2024-127" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ktaj-j2nh-zug6" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/13760?format=api", "vulnerability_id": "VCID-kzy6-b4n3-m7d4", "summary": "Improper Input Validation\nIn `numbers.c` in libxslt, which is used by nokogiri, a type holding grouping characters of an `xsl:number` instruction was too narrow and an invalid character/length combination could be passed to `xsltNumberFormatDecimal`, leading to a read of uninitialized stack data.", "references": [ { "reference_url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html" }, { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-13118.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-13118.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2019-13118", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.01008", "scoring_system": "epss", "scoring_elements": "0.77366", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-13118" }, { "reference_url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15069", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15069" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13118", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13118" }, { "reference_url": "http://seclists.org/fulldisclosure/2019/Aug/11", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "http://seclists.org/fulldisclosure/2019/Aug/11" }, { "reference_url": "http://seclists.org/fulldisclosure/2019/Aug/13", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "http://seclists.org/fulldisclosure/2019/Aug/13" }, { "reference_url": "http://seclists.org/fulldisclosure/2019/Aug/14", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "http://seclists.org/fulldisclosure/2019/Aug/14" }, { "reference_url": "http://seclists.org/fulldisclosure/2019/Aug/15", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "http://seclists.org/fulldisclosure/2019/Aug/15" }, { "reference_url": "http://seclists.org/fulldisclosure/2019/Jul/22", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "http://seclists.org/fulldisclosure/2019/Jul/22" }, { "reference_url": "http://seclists.org/fulldisclosure/2019/Jul/23", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "http://seclists.org/fulldisclosure/2019/Jul/23" }, { "reference_url": "http://seclists.org/fulldisclosure/2019/Jul/24", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "http://seclists.org/fulldisclosure/2019/Jul/24" }, { "reference_url": "http://seclists.org/fulldisclosure/2019/Jul/26", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "http://seclists.org/fulldisclosure/2019/Jul/26" }, { "reference_url": "http://seclists.org/fulldisclosure/2019/Jul/31", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "http://seclists.org/fulldisclosure/2019/Jul/31" }, { "reference_url": "http://seclists.org/fulldisclosure/2019/Jul/37", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "http://seclists.org/fulldisclosure/2019/Jul/37" }, { "reference_url": "http://seclists.org/fulldisclosure/2019/Jul/38", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "http://seclists.org/fulldisclosure/2019/Jul/38" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/blob/f7aa3b0b29d6fe5fafe93dacd9b96b6b3d16b7ec/CHANGELOG.md?plain=1#L796", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/blob/f7aa3b0b29d6fe5fafe93dacd9b96b6b3d16b7ec/CHANGELOG.md?plain=1#L796" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/commit/43a175339b47b8c604508813fc75b83f13cd173e", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/commit/43a175339b47b8c604508813fc75b83f13cd173e" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/issues/1943", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/issues/1943" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.10.5", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.10.5" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxslt/commit/6ce8de69330783977dd14f6569419489875fb71b", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://gitlab.gnome.org/GNOME/libxslt/commit/6ce8de69330783977dd14f6569419489875fb71b" }, { "reference_url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2019/07/msg00020.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://lists.debian.org/debian-lts-announce/2019/07/msg00020.html" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ" }, { "reference_url": "https://oss-fuzz.com/testcase-detail/5197371471822848", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://oss-fuzz.com/testcase-detail/5197371471822848" }, { "reference_url": "https://seclists.org/bugtraq/2019/Aug/21", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://seclists.org/bugtraq/2019/Aug/21" }, { "reference_url": "https://seclists.org/bugtraq/2019/Aug/22", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://seclists.org/bugtraq/2019/Aug/22" }, { "reference_url": "https://seclists.org/bugtraq/2019/Aug/23", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://seclists.org/bugtraq/2019/Aug/23" }, { "reference_url": "https://seclists.org/bugtraq/2019/Aug/25", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://seclists.org/bugtraq/2019/Aug/25" }, { "reference_url": "https://seclists.org/bugtraq/2019/Jul/35", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://seclists.org/bugtraq/2019/Jul/35" }, { "reference_url": "https://seclists.org/bugtraq/2019/Jul/36", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://seclists.org/bugtraq/2019/Jul/36" }, { "reference_url": "https://seclists.org/bugtraq/2019/Jul/37", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://seclists.org/bugtraq/2019/Jul/37" }, { "reference_url": "https://seclists.org/bugtraq/2019/Jul/40", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://seclists.org/bugtraq/2019/Jul/40" }, { "reference_url": "https://seclists.org/bugtraq/2019/Jul/41", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://seclists.org/bugtraq/2019/Jul/41" }, { "reference_url": "https://seclists.org/bugtraq/2019/Jul/42", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://seclists.org/bugtraq/2019/Jul/42" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20190806-0004", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20190806-0004" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20200122-0003", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20200122-0003" }, { "reference_url": "https://support.apple.com/kb/HT210346", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://support.apple.com/kb/HT210346" }, { "reference_url": "https://support.apple.com/kb/HT210348", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://support.apple.com/kb/HT210348" }, { "reference_url": "https://support.apple.com/kb/HT210351", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://support.apple.com/kb/HT210351" }, { "reference_url": "https://support.apple.com/kb/HT210353", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://support.apple.com/kb/HT210353" }, { "reference_url": "https://support.apple.com/kb/HT210356", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://support.apple.com/kb/HT210356" }, { "reference_url": "https://support.apple.com/kb/HT210357", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://support.apple.com/kb/HT210357" }, { "reference_url": "https://support.apple.com/kb/HT210358", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://support.apple.com/kb/HT210358" }, { "reference_url": "https://usn.ubuntu.com/4164-1", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://usn.ubuntu.com/4164-1" }, { "reference_url": "https://www.oracle.com/security-alerts/cpujan2020.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://www.oracle.com/security-alerts/cpujan2020.html" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2019/11/17/2", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2019/11/17/2" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1728541", "reference_id": "1728541", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1728541" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931320", "reference_id": "931320", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931320" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2019-13118", "reference_id": "CVE-2019-13118", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-13118" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ/", "reference_id": "IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ/" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20190806-0004/", "reference_id": "ntap-20190806-0004", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://security.netapp.com/advisory/ntap-20190806-0004/" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20200122-0003/", "reference_id": "ntap-20200122-0003", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://security.netapp.com/advisory/ntap-20200122-0003/" }, { "reference_url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E", "reference_id": "r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E", "reference_id": "rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E" }, { "reference_url": "https://usn.ubuntu.com/4164-1/", "reference_id": "USN-4164-1", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T18:35:56Z/" } ], "url": "https://usn.ubuntu.com/4164-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/57262?format=api", "purl": "pkg:gem/nokogiri@1.10.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-12ee-na2t-6kg5" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-24ud-18pe-dudw" }, { "vulnerability": "VCID-38c3-z9yc-4ybx" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-5wxq-ekcv-vqhq" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-9qtg-gxza-6ba9" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-cft6-gvm9-8qf4" }, { "vulnerability": "VCID-cq5z-6cmf-5kfs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-g5sw-gyv7-vya1" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" }, { "vulnerability": "VCID-zuw7-d1r3-77h1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.10.5" } ], "aliases": [ "CVE-2019-13118", "GHSA-cf46-6xxh-pc75" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-kzy6-b4n3-m7d4" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/345935?format=api", "vulnerability_id": "VCID-m542-6h3p-gudj", "summary": "Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171\n## Summary\n\nNokogiri v1.18.3 upgrades its dependency libxml2 to\n[v2.13.6](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.6).\n\nlibxml2 v2.13.6 addresses:\n\n- CVE-2025-24928\n - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/847\n- CVE-2024-56171\n - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/828\n\n## Impact\n\n### CVE-2025-24928\n\nStack-buffer overflow is possible when reporting DTD validation\nerrors if the input contains a long (~3kb) QName prefix.\n\n### CVE-2024-56171\n\nUse-after-free is possible during validation against untrusted\nXML Schemas (.xsd) and, potentially, validation of untrusted documents\nagainst trusted Schemas if they make use of `xsd:keyref` in combination\nwith recursively defined types that have additional identity constraints.", "references": [ { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-vvfq-8hwr-qm4m.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/GHSA-vvfq-8hwr-qm4m.yml" }, { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vvfq-8hwr-qm4m", "reference_id": "", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vvfq-8hwr-qm4m" }, { "reference_url": "https://github.com/advisories/GHSA-vvfq-8hwr-qm4m", "reference_id": "GHSA-vvfq-8hwr-qm4m", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-vvfq-8hwr-qm4m" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/165996?format=api", "purl": "pkg:gem/nokogiri@1.18.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.18.3" } ], "aliases": [ "GHSA-vvfq-8hwr-qm4m" ], "risk_score": 1.4, "exploitability": "0.5", "weighted_severity": "2.7", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-m542-6h3p-gudj" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/10899?format=api", "vulnerability_id": "VCID-mhpn-9y7w-ykcd", "summary": "Uncontrolled Resource Consumption\ndict.c in libxml2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via an unexpected character immediately after the \"<!DOCTYPE html\" substring in a crafted HTML document.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-8806.json", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-8806.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2015-8806", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.08565", "scoring_system": "epss", "scoring_elements": "0.92533", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2015-8806" }, { "reference_url": "https://bugzilla.gnome.org/show_bug.cgi?id=749115", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://bugzilla.gnome.org/show_bug.cgi?id=749115" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8806", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8806" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1762", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1762" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1833", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1833" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1834", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1834" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1835", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1835" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1836", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1836" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1837", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1837" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1838", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1838" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1839", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1839" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1840", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1840" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2073", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2073" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3627", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3627" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3705", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3705" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4447", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4447" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4449", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4449" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4483", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4483" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv2", "scoring_elements": "AV:N/AC:M/Au:N/C:P/I:N/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/commit/03d402212707bd5dfa0a21b7de5e91a7f9d90028", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/sparklemotion/nokogiri/commit/03d402212707bd5dfa0a21b7de5e91a7f9d90028" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/issues/1473", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/issues/1473" }, { "reference_url": "https://mail.gnome.org/archives/xml/2016-May/msg00023.html", "reference_id": "", "reference_type": "", "scores": [], "url": "https://mail.gnome.org/archives/xml/2016-May/msg00023.html" }, { "reference_url": "https://security.gentoo.org/glsa/201701-37", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.gentoo.org/glsa/201701-37" }, { "reference_url": "https://web.archive.org/web/20160928171015/http://www.securityfocus.com/bid/82071", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20160928171015/http://www.securityfocus.com/bid/82071" }, { "reference_url": "https://www.debian.org/security/2016/dsa-3593", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.debian.org/security/2016/dsa-3593" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2016/02/03/5", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2016/02/03/5" }, { "reference_url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html" }, { "reference_url": "http://www.ubuntu.com/usn/usn-2994-1/", "reference_id": "", "reference_type": "", "scores": [], "url": "http://www.ubuntu.com/usn/usn-2994-1/" }, { "reference_url": "http://www.ubuntu.com/usn/USN-2994-1", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.ubuntu.com/usn/USN-2994-1" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1304636", "reference_id": "1304636", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1304636" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=813613", "reference_id": "813613", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=813613" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8806", "reference_id": "CVE-2015-8806", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8806" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2015-8806.yml", "reference_id": "CVE-2015-8806.YML", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2015-8806.yml" }, { "reference_url": "https://github.com/advisories/GHSA-7hp2-xwpj-95jq", "reference_id": "GHSA-7hp2-xwpj-95jq", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-7hp2-xwpj-95jq" }, { "reference_url": "https://usn.ubuntu.com/2994-1/", "reference_id": "USN-2994-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/2994-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/51582?format=api", "purl": "pkg:gem/nokogiri@1.6.8", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-12ee-na2t-6kg5" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-24ud-18pe-dudw" }, { "vulnerability": "VCID-38c3-z9yc-4ybx" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-5wxq-ekcv-vqhq" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-8274-u9e9-uufm" }, { "vulnerability": "VCID-9mh9-rax2-1bbb" }, { "vulnerability": "VCID-9psz-qfqt-e3fs" }, { "vulnerability": "VCID-9qtg-gxza-6ba9" }, { "vulnerability": "VCID-9xty-6acy-mub7" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-cft6-gvm9-8qf4" }, { "vulnerability": "VCID-cq5z-6cmf-5kfs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-f91q-9psx-qkaa" }, { "vulnerability": "VCID-g5sw-gyv7-vya1" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jn4q-gdy9-eqa4" }, { "vulnerability": "VCID-jvbh-pnxm-9bg7" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-kzy6-b4n3-m7d4" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-p1yd-qud5-ckbu" }, { "vulnerability": "VCID-pffr-3a27-4qgx" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-qysn-w1za-83ea" }, { "vulnerability": "VCID-sgvg-768f-gybf" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-tswn-2k3y-wkhk" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-w6ws-2kbb-bfgs" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" }, { "vulnerability": "VCID-zuw7-d1r3-77h1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.8" } ], "aliases": [ "CVE-2015-8806", "GHSA-7hp2-xwpj-95jq" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-mhpn-9y7w-ykcd" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/11943?format=api", "vulnerability_id": "VCID-p1yd-qud5-ckbu", "summary": "Loop with Unreachable Exit Condition ('Infinite Loop')\nparser.c in libxml2 does not prevent infinite recursion in parameter entities.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-16932.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-16932.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2017-16932", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.21755", "scoring_system": "epss", "scoring_elements": "0.95841", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2017-16932" }, { "reference_url": "https://blog.clamav.net/2018/07/clamav-01001-has-been-released.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-04T13:30:08Z/" } ], "url": "https://blog.clamav.net/2018/07/clamav-01001-has-been-released.html" }, { "reference_url": "https://bugzilla.gnome.org/show_bug.cgi?id=759579", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-04T13:30:08Z/" } ], "url": "https://bugzilla.gnome.org/show_bug.cgi?id=759579" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16932", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16932" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/GNOME/libxml2/commit/899a5d9f0ed13b8e32449a08a361e0de127dd961", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-04T13:30:08Z/" } ], "url": "https://github.com/GNOME/libxml2/commit/899a5d9f0ed13b8e32449a08a361e0de127dd961" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/issues/1714", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/issues/1714" }, { "reference_url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-04T13:30:08Z/" } ], "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-04T13:30:08Z/" } ], "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2017/11/msg00041.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-04T13:30:08Z/" } ], "url": "https://lists.debian.org/debian-lts-announce/2017/11/msg00041.html" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-04T13:30:08Z/" } ], "url": "https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html" }, { "reference_url": "https://usn.ubuntu.com/3739-1", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://usn.ubuntu.com/3739-1" }, { "reference_url": "https://usn.ubuntu.com/3739-1/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-04T13:30:08Z/" } ], "url": "https://usn.ubuntu.com/3739-1/" }, { "reference_url": "https://usn.ubuntu.com/usn/usn-3504-1/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/usn/usn-3504-1/" }, { "reference_url": "http://xmlsoft.org/news.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-04T13:30:08Z/" } ], "url": "http://xmlsoft.org/news.html" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1517316", "reference_id": "1517316", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1517316" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=882613", "reference_id": "882613", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=882613" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/899a5d9f0ed13b8e32449a08a361e0de127dd961", "reference_id": "899a5d9f0ed13b8e32449a08a361e0de127dd961", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-12-04T13:30:08Z/" } ], "url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/899a5d9f0ed13b8e32449a08a361e0de127dd961" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16932", "reference_id": "CVE-2017-16932", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16932" }, { "reference_url": "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-16932.html", "reference_id": "CVE-2017-16932.HTML", "reference_type": "", "scores": [], "url": "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-16932.html" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2017-16932.yml", "reference_id": "CVE-2017-16932.YML", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2017-16932.yml" }, { "reference_url": "https://github.com/advisories/GHSA-x2fm-93ww-ggvx", "reference_id": "GHSA-x2fm-93ww-ggvx", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-x2fm-93ww-ggvx" }, { "reference_url": "https://usn.ubuntu.com/3504-1/", "reference_id": "USN-3504-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/3504-1/" }, { "reference_url": "https://usn.ubuntu.com/3504-2/", "reference_id": "USN-3504-2", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/3504-2/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/53076?format=api", "purl": "pkg:gem/nokogiri@1.8.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-12ee-na2t-6kg5" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-24ud-18pe-dudw" }, { "vulnerability": "VCID-38c3-z9yc-4ybx" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-5wxq-ekcv-vqhq" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-9mh9-rax2-1bbb" }, { "vulnerability": "VCID-9psz-qfqt-e3fs" }, { "vulnerability": "VCID-9qtg-gxza-6ba9" }, { "vulnerability": "VCID-9xty-6acy-mub7" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-cft6-gvm9-8qf4" }, { "vulnerability": "VCID-cq5z-6cmf-5kfs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-f91q-9psx-qkaa" }, { "vulnerability": "VCID-g5sw-gyv7-vya1" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jvbh-pnxm-9bg7" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-kzy6-b4n3-m7d4" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-pffr-3a27-4qgx" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-qysn-w1za-83ea" }, { "vulnerability": "VCID-sgvg-768f-gybf" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-w6ws-2kbb-bfgs" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" }, { "vulnerability": "VCID-zuw7-d1r3-77h1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.8.1" } ], "aliases": [ "CVE-2017-16932", "GHSA-x2fm-93ww-ggvx" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-p1yd-qud5-ckbu" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/147227?format=api", "vulnerability_id": "VCID-pffr-3a27-4qgx", "summary": "", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2019-5477", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.07465", "scoring_system": "epss", "scoring_elements": "0.91889", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-5477" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5477", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5477" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/commit/5d30128343573a9428c86efc758ba2c66e9f12dc", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/commit/5d30128343573a9428c86efc758ba2c66e9f12dc" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/issues/1915", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/issues/1915" }, { "reference_url": "https://github.com/tenderlove/rexical/blob/master/CHANGELOG.rdoc", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/tenderlove/rexical/blob/master/CHANGELOG.rdoc" }, { "reference_url": "https://github.com/tenderlove/rexical/commit/a652474dbc66be350055db3e8f9b3a7b3fd75926", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/tenderlove/rexical/commit/a652474dbc66be350055db3e8f9b3a7b3fd75926" }, { "reference_url": "https://hackerone.com/reports/650835", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://hackerone.com/reports/650835" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2019/09/msg00027.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2019/09/msg00027.html" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00018.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00018.html" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00019.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00019.html" }, { "reference_url": "https://security.gentoo.org/glsa/202006-05", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.gentoo.org/glsa/202006-05" }, { "reference_url": "https://usn.ubuntu.com/4175-1", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://usn.ubuntu.com/4175-1" }, { "reference_url": "https://usn.ubuntu.com/4175-1/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/4175-1/" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=934802", "reference_id": "934802", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=934802" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=940905", "reference_id": "940905", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=940905" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5477", "reference_id": "CVE-2019-5477", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5477" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2019-5477.yml", "reference_id": "CVE-2019-5477.YML", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2019-5477.yml" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rexical/CVE-2019-5477.yml", "reference_id": "CVE-2019-5477.YML", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rexical/CVE-2019-5477.yml" }, { "reference_url": "https://github.com/advisories/GHSA-cr5j-953j-xw5p", "reference_id": "GHSA-cr5j-953j-xw5p", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-cr5j-953j-xw5p" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/56778?format=api", "purl": "pkg:gem/nokogiri@1.10.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-12ee-na2t-6kg5" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-24ud-18pe-dudw" }, { "vulnerability": "VCID-38c3-z9yc-4ybx" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-5wxq-ekcv-vqhq" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-9psz-qfqt-e3fs" }, { "vulnerability": "VCID-9qtg-gxza-6ba9" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-cft6-gvm9-8qf4" }, { "vulnerability": "VCID-cq5z-6cmf-5kfs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-g5sw-gyv7-vya1" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-qysn-w1za-83ea" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" }, { "vulnerability": "VCID-zuw7-d1r3-77h1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.10.4" } ], "aliases": [ "CVE-2019-5477", "GHSA-cr5j-953j-xw5p" ], "risk_score": 4.5, "exploitability": "0.5", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-pffr-3a27-4qgx" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/3021?format=api", "vulnerability_id": "VCID-pjeb-1jpy-kkea", "summary": "arbitrary code execution", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-23308.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-23308.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-23308", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00074", "scoring_system": "epss", "scoring_elements": "0.22493", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-23308" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23308", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23308" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/GNOME/libxml2/commit/652dd12a858989b14eed4e84e453059cd3ba340e", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/GNOME/libxml2/commit/652dd12a858989b14eed4e84e453059cd3ba340e" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.2", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.2" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/-/blob/v2.9.13/NEWS", "reference_id": "", "reference_type": "", "scores": [], "url": "https://gitlab.gnome.org/GNOME/libxml2/-/blob/v2.9.13/NEWS" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1006489", "reference_id": "1006489", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1006489" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2056913", "reference_id": "2056913", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2056913" }, { "reference_url": "https://security.archlinux.org/AVG-2726", "reference_id": "AVG-2726", "reference_type": "", "scores": [ { "value": "High", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-2726" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23308", "reference_id": "CVE-2022-23308", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23308" }, { "reference_url": "https://security.gentoo.org/glsa/202210-03", "reference_id": "GLSA-202210-03", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202210-03" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0899", "reference_id": "RHSA-2022:0899", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0899" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1389", "reference_id": "RHSA-2022:1389", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1389" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1390", "reference_id": "RHSA-2022:1390", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1390" }, { "reference_url": "https://usn.ubuntu.com/5324-1/", "reference_id": "USN-5324-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5324-1/" }, { "reference_url": "https://usn.ubuntu.com/5422-1/", "reference_id": "USN-5422-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5422-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/59779?format=api", "purl": "pkg:gem/nokogiri@1.13.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.13.2" } ], "aliases": [ "CVE-2022-23308" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-pjeb-1jpy-kkea" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/78532?format=api", "vulnerability_id": "VCID-pzwn-gux6-y3hj", "summary": "", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-6685.json", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-6685.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2012-6685", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00323", "scoring_system": "epss", "scoring_elements": "0.5559", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2012-6685" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1178970", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1178970" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6685", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6685" }, { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/commit/599856367150709497a3a03bee930bd76504d95d", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/sparklemotion/nokogiri/commit/599856367150709497a3a03bee930bd76504d95d" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/issues/693", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/issues/693" }, { "reference_url": "https://nokogiri.org/CHANGELOG.html#154-2012-06-12", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nokogiri.org/CHANGELOG.html#154-2012-06-12" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6685", "reference_id": "CVE-2012-6685", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6685" }, { "reference_url": "https://github.com/advisories/GHSA-6wj9-77wq-jq7p", "reference_id": "GHSA-6wj9-77wq-jq7p", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-6wj9-77wq-jq7p" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/76696?format=api", "purl": "pkg:gem/nokogiri@1.5.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-12ee-na2t-6kg5" }, { "vulnerability": "VCID-1h5h-pvc7-9yhh" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1ksa-wbqf-j7fu" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-24ud-18pe-dudw" }, { "vulnerability": "VCID-2ub7-t6nu-syfs" }, { "vulnerability": "VCID-38c3-z9yc-4ybx" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-5wxq-ekcv-vqhq" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-8274-u9e9-uufm" }, { "vulnerability": "VCID-94b6-kg9t-fbee" }, { "vulnerability": "VCID-94mh-kks8-4yf4" }, { "vulnerability": "VCID-9mh9-rax2-1bbb" }, { "vulnerability": "VCID-9psz-qfqt-e3fs" }, { "vulnerability": "VCID-9qtg-gxza-6ba9" }, { "vulnerability": "VCID-9xty-6acy-mub7" }, { "vulnerability": "VCID-ajrr-ueqy-2bam" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-cft6-gvm9-8qf4" }, { "vulnerability": "VCID-cq5z-6cmf-5kfs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-f91q-9psx-qkaa" }, { "vulnerability": "VCID-g5sw-gyv7-vya1" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-hmj1-53pj-2ugn" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jn4q-gdy9-eqa4" }, { "vulnerability": "VCID-jvbh-pnxm-9bg7" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-kzy6-b4n3-m7d4" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-mhpn-9y7w-ykcd" }, { "vulnerability": "VCID-p1yd-qud5-ckbu" }, { "vulnerability": "VCID-pffr-3a27-4qgx" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-qysn-w1za-83ea" }, { "vulnerability": "VCID-sgvg-768f-gybf" }, { "vulnerability": "VCID-snqn-nz53-f3b7" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-tswn-2k3y-wkhk" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-w6ws-2kbb-bfgs" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" }, { "vulnerability": "VCID-zuw7-d1r3-77h1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.5.4" } ], "aliases": [ "CVE-2012-6685", "GHSA-6wj9-77wq-jq7p", "OSV-90946" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-pzwn-gux6-y3hj" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/345933?format=api", "vulnerability_id": "VCID-qm8g-u6z7-4kgb", "summary": "Nokogiri updates packaged libxslt to v1.1.43 to resolve multiple CVEs\n## Summary\n\nNokogiri v1.18.4 upgrades its dependency libxslt to\n[v1.1.43](https://gitlab.gnome.org/GNOME/libxslt/-/releases/v1.1.43).\n\nlibxslt v1.1.43 resolves:\n\n- CVE-2025-24855: Fix use-after-free of XPath context node\n- CVE-2024-55549: Fix UAF related to excluded namespaces\n\n## Impact\n\n### CVE-2025-24855\n\n- \"Use-after-free due to xsltEvalXPathStringNs leaking xpathCtxt->node\"\n- MITRE has rated this 7.8 High CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H\n- Upstream report: https://gitlab.gnome.org/GNOME/libxslt/-/issues/128\n- NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2025-24855\n\n### CVE-2024-55549\n\n- \"Use-after-free related to excluded result prefixes\"\n- MITRE has rated this 7.8 High CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H\n- Upstream report: https://gitlab.gnome.org/GNOME/libxslt/-/issues/127\n- NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2024-55549", "references": [ { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-mrxw-mxhj-p664", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-mrxw-mxhj-p664" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxslt/-/issues/127", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://gitlab.gnome.org/GNOME/libxslt/-/issues/127" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxslt/-/issues/128", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://gitlab.gnome.org/GNOME/libxslt/-/issues/128" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55549", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55549" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24855", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24855" }, { "reference_url": "https://github.com/advisories/GHSA-mrxw-mxhj-p664", "reference_id": "GHSA-mrxw-mxhj-p664", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-mrxw-mxhj-p664" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/165997?format=api", "purl": "pkg:gem/nokogiri@1.18.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.18.4" } ], "aliases": [ "GHSA-mrxw-mxhj-p664" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-qm8g-u6z7-4kgb" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/1720?format=api", "vulnerability_id": "VCID-qysn-w1za-83ea", "summary": "multiple issues", "references": [ { "reference_url": "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00010.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/" } ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00010.html" }, { "reference_url": "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/" } ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html" }, { "reference_url": "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/" } ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html" }, { "reference_url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/" } ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:0514", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/" } ], "url": "https://access.redhat.com/errata/RHSA-2020:0514" }, { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-18197.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-18197.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2019-18197", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.04534", "scoring_system": "epss", "scoring_elements": "0.89343", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-18197" }, { "reference_url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15746", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/" } ], "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15746" }, { "reference_url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15768", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/" } ], "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15768" }, { "reference_url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15914", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/" } ], "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15914" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18197", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18197" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2019-18197.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2019-18197.yml" }, { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/blob/01ab95f3e37429ed8d3b380a8d2f73902eb325d9/CHANGELOG.md?plain=1#L934", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/blob/01ab95f3e37429ed8d3b380a8d2f73902eb325d9/CHANGELOG.md?plain=1#L934" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/issues/1943", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/issues/1943" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxslt/commit/2232473733b7313d67de8836ea3b29eec6e8e285", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/" } ], "url": "https://gitlab.gnome.org/GNOME/libxslt/commit/2232473733b7313d67de8836ea3b29eec6e8e285" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00037.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/" } ], "url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00037.html" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20191031-0004", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20191031-0004" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20200416-0004", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20200416-0004" }, { "reference_url": "https://usn.ubuntu.com/4164-1", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://usn.ubuntu.com/4164-1" }, { "reference_url": "https://www.oracle.com/security-alerts/cpuapr2020.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/" } ], "url": "https://www.oracle.com/security-alerts/cpuapr2020.html" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2019/11/17/2", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2019/11/17/2" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1770768", "reference_id": "1770768", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1770768" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=942646", "reference_id": "942646", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=942646" }, { "reference_url": "https://security.archlinux.org/ASA-202002-3", "reference_id": "ASA-202002-3", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-202002-3" }, { "reference_url": "https://security.archlinux.org/AVG-1092", "reference_id": "AVG-1092", "reference_type": "", "scores": [ { "value": "Critical", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1092" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2019-18197", "reference_id": "CVE-2019-18197", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-18197" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20191031-0004/", "reference_id": "ntap-20191031-0004", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/" } ], "url": "https://security.netapp.com/advisory/ntap-20191031-0004/" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20200416-0004/", "reference_id": "ntap-20200416-0004", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/" } ], "url": "https://security.netapp.com/advisory/ntap-20200416-0004/" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:4005", "reference_id": "RHSA-2020:4005", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2020:4005" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:4464", "reference_id": "RHSA-2020:4464", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2020:4464" }, { "reference_url": "https://usn.ubuntu.com/4164-1/", "reference_id": "USN-4164-1", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-05-28T18:27:54Z/" } ], "url": "https://usn.ubuntu.com/4164-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/57262?format=api", "purl": "pkg:gem/nokogiri@1.10.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-12ee-na2t-6kg5" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-24ud-18pe-dudw" }, { "vulnerability": "VCID-38c3-z9yc-4ybx" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-5wxq-ekcv-vqhq" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-9qtg-gxza-6ba9" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-cft6-gvm9-8qf4" }, { "vulnerability": "VCID-cq5z-6cmf-5kfs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-g5sw-gyv7-vya1" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" }, { "vulnerability": "VCID-zuw7-d1r3-77h1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.10.5" } ], "aliases": [ "CVE-2019-18197", "GHSA-242x-7cm6-4w8j" ], "risk_score": 4.5, "exploitability": "0.5", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-qysn-w1za-83ea" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/6161?format=api", "vulnerability_id": "VCID-sgvg-768f-gybf", "summary": "denial of service", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-18258.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-18258.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2017-18258", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00898", "scoring_system": "epss", "scoring_elements": "0.75983", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2017-18258" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18258", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18258" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://git.gnome.org/browse/libxml2/commit/?id=e2a9122b8dde53d320750451e9907a7dcb2ca8bb", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://git.gnome.org/browse/libxml2/commit/?id=e2a9122b8dde53d320750451e9907a7dcb2ca8bb" }, { "reference_url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10284", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10284" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20190719-0001", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20190719-0001" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20190719-0001/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://security.netapp.com/advisory/ntap-20190719-0001/" }, { "reference_url": "https://usn.ubuntu.com/3739-1", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://usn.ubuntu.com/3739-1" }, { "reference_url": "https://usn.ubuntu.com/3739-1/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/3739-1/" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1566749", "reference_id": "1566749", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1566749" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=895245", "reference_id": "895245", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=895245" }, { "reference_url": "https://security.archlinux.org/AVG-671", "reference_id": "AVG-671", "reference_type": "", "scores": [ { "value": "Medium", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-671" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18258", "reference_id": "CVE-2017-18258", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18258" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2017-18258.yml", "reference_id": "CVE-2017-18258.YML", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2017-18258.yml" }, { "reference_url": "https://github.com/advisories/GHSA-882p-jqgm-f45g", "reference_id": "GHSA-882p-jqgm-f45g", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-882p-jqgm-f45g" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:1190", "reference_id": "RHSA-2020:1190", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2020:1190" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/54339?format=api", "purl": "pkg:gem/nokogiri@1.8.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-12ee-na2t-6kg5" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-24ud-18pe-dudw" }, { "vulnerability": "VCID-38c3-z9yc-4ybx" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-5wxq-ekcv-vqhq" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-9psz-qfqt-e3fs" }, { "vulnerability": "VCID-9qtg-gxza-6ba9" }, { "vulnerability": "VCID-9xty-6acy-mub7" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-cft6-gvm9-8qf4" }, { "vulnerability": "VCID-cq5z-6cmf-5kfs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-f91q-9psx-qkaa" }, { "vulnerability": "VCID-g5sw-gyv7-vya1" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jvbh-pnxm-9bg7" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-kzy6-b4n3-m7d4" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-pffr-3a27-4qgx" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-qysn-w1za-83ea" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-w6ws-2kbb-bfgs" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" }, { "vulnerability": "VCID-zuw7-d1r3-77h1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.8.2" } ], "aliases": [ "CVE-2017-18258", "GHSA-882p-jqgm-f45g" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-sgvg-768f-gybf" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/10708?format=api", "vulnerability_id": "VCID-snqn-nz53-f3b7", "summary": "Vulnerabilities in libxml2 and libxslt\nSeveral vulnerabilities were discovered in the libxml2 and libxslt libraries that this package gem depends on.", "references": [ { "reference_url": "http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html" }, { "reference_url": "http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html" }, { "reference_url": "http://lists.apple.com/archives/security-announce/2016/Mar/msg00002.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://lists.apple.com/archives/security-announce/2016/Mar/msg00002.html" }, { "reference_url": "http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html" }, { "reference_url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172710.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172710.html" }, { "reference_url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172943.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172943.html" }, { "reference_url": "http://lists.opensuse.org/opensuse-updates/2015-12/msg00120.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://lists.opensuse.org/opensuse-updates/2015-12/msg00120.html" }, { "reference_url": "http://lists.opensuse.org/opensuse-updates/2016-01/msg00031.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://lists.opensuse.org/opensuse-updates/2016-01/msg00031.html" }, { "reference_url": "http://rhn.redhat.com/errata/RHSA-2015-1419.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://rhn.redhat.com/errata/RHSA-2015-1419.html" }, { "reference_url": "http://rhn.redhat.com/errata/RHSA-2015-2550.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://rhn.redhat.com/errata/RHSA-2015-2550.html" }, { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-1819.json", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-1819.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2015-1819", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.02045", "scoring_system": "epss", "scoring_elements": "0.84139", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2015-1819" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1819", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1819" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5312", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5312" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7497", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7497" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7498", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7498" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7499", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7499" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7500", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7500" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7941", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7941" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7942", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7942" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8035", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8035" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8241", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8241" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8317", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8317" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8710", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8710" }, { "reference_url": "https://git.gnome.org/browse/libxml2/commit/?id=213f1fe0d76d30eaed6e5853057defc43e6df2c9", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://git.gnome.org/browse/libxml2/commit/?id=213f1fe0d76d30eaed6e5853057defc43e6df2c9" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/commit/8f3de6d88d0da11fb62a45daa61b85ce71b4af59", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/sparklemotion/nokogiri/commit/8f3de6d88d0da11fb62a45daa61b85ce71b4af59" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/issues/1374", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/issues/1374" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/pull/1376", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/sparklemotion/nokogiri/pull/1376" }, { "reference_url": "https://security.gentoo.org/glsa/201507-08", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.gentoo.org/glsa/201507-08" }, { "reference_url": "https://security.gentoo.org/glsa/201701-37", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.gentoo.org/glsa/201701-37" }, { "reference_url": "https://support.apple.com/HT206166", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://support.apple.com/HT206166" }, { "reference_url": "https://support.apple.com/HT206167", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://support.apple.com/HT206167" }, { "reference_url": "https://support.apple.com/HT206168", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://support.apple.com/HT206168" }, { "reference_url": "https://support.apple.com/HT206169", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://support.apple.com/HT206169" }, { "reference_url": "http://www.debian.org/security/2015/dsa-3430", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.debian.org/security/2015/dsa-3430" }, { "reference_url": "http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html" }, { "reference_url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html" }, { "reference_url": "http://www.ubuntu.com/usn/USN-2812-1", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.ubuntu.com/usn/USN-2812-1" }, { "reference_url": "http://xmlsoft.org/news.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://xmlsoft.org/news.html" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1211278", "reference_id": "1211278", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1211278" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=782782", "reference_id": "782782", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=782782" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1819", "reference_id": "CVE-2015-1819", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1819" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2015-1819.yml", "reference_id": "CVE-2015-1819.YML", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2015-1819.yml" }, { "reference_url": "https://github.com/advisories/GHSA-q7wx-62r7-j2x7", "reference_id": "GHSA-q7wx-62r7-j2x7", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-q7wx-62r7-j2x7" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2015:1419", "reference_id": "RHSA-2015:1419", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2015:1419" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2015:2550", "reference_id": "RHSA-2015:2550", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2015:2550" }, { "reference_url": "https://usn.ubuntu.com/2812-1/", "reference_id": "USN-2812-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/2812-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/51279?format=api", "purl": "pkg:gem/nokogiri@1.6.6.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-12ee-na2t-6kg5" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-24ud-18pe-dudw" }, { "vulnerability": "VCID-2ub7-t6nu-syfs" }, { "vulnerability": "VCID-38c3-z9yc-4ybx" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-5wxq-ekcv-vqhq" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-8274-u9e9-uufm" }, { "vulnerability": "VCID-94mh-kks8-4yf4" }, { "vulnerability": "VCID-9mh9-rax2-1bbb" }, { "vulnerability": "VCID-9psz-qfqt-e3fs" }, { "vulnerability": "VCID-9qtg-gxza-6ba9" }, { "vulnerability": "VCID-9xty-6acy-mub7" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-b2g7-1rh9-jkgb" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-cft6-gvm9-8qf4" }, { "vulnerability": "VCID-cq5z-6cmf-5kfs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-f91q-9psx-qkaa" }, { "vulnerability": "VCID-g5sw-gyv7-vya1" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jn4q-gdy9-eqa4" }, { "vulnerability": "VCID-jvbh-pnxm-9bg7" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-kzy6-b4n3-m7d4" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-mhpn-9y7w-ykcd" }, { "vulnerability": "VCID-p1yd-qud5-ckbu" }, { "vulnerability": "VCID-pffr-3a27-4qgx" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-qysn-w1za-83ea" }, { "vulnerability": "VCID-sgvg-768f-gybf" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-tswn-2k3y-wkhk" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-w6ws-2kbb-bfgs" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" }, { "vulnerability": "VCID-zuw7-d1r3-77h1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.6.4" }, { "url": "http://public2.vulnerablecode.io/api/packages/51280?format=api", "purl": "pkg:gem/nokogiri@1.6.7.rc4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-12ee-na2t-6kg5" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-24ud-18pe-dudw" }, { "vulnerability": "VCID-2ub7-t6nu-syfs" }, { "vulnerability": "VCID-38c3-z9yc-4ybx" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-5wxq-ekcv-vqhq" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-8274-u9e9-uufm" }, { "vulnerability": "VCID-94mh-kks8-4yf4" }, { "vulnerability": "VCID-9mh9-rax2-1bbb" }, { "vulnerability": "VCID-9psz-qfqt-e3fs" }, { "vulnerability": "VCID-9qtg-gxza-6ba9" }, { "vulnerability": "VCID-9xty-6acy-mub7" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-b2g7-1rh9-jkgb" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-cft6-gvm9-8qf4" }, { "vulnerability": "VCID-cq5z-6cmf-5kfs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-f91q-9psx-qkaa" }, { "vulnerability": "VCID-g5sw-gyv7-vya1" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jn4q-gdy9-eqa4" }, { "vulnerability": "VCID-jvbh-pnxm-9bg7" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-kzy6-b4n3-m7d4" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-mhpn-9y7w-ykcd" }, { "vulnerability": "VCID-p1yd-qud5-ckbu" }, { "vulnerability": "VCID-pffr-3a27-4qgx" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-qysn-w1za-83ea" }, { "vulnerability": "VCID-sgvg-768f-gybf" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-tswn-2k3y-wkhk" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-w6ws-2kbb-bfgs" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" }, { "vulnerability": "VCID-zuw7-d1r3-77h1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.6.7.rc4" } ], "aliases": [ "CVE-2015-1819", "GHSA-q7wx-62r7-j2x7" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-snqn-nz53-f3b7" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/15487?format=api", "vulnerability_id": "VCID-tdsp-x2ft-1yfy", "summary": "Out-of-bounds Write in zlib affects Nokogiri\n## Summary\n\nNokogiri v1.13.4 updates the vendored zlib from 1.2.11 to 1.2.12, which addresses [CVE-2018-25032](https://nvd.nist.gov/vuln/detail/CVE-2018-25032). That CVE is scored as CVSS 7.4 \"High\" on the NVD record as of 2022-04-05.\n\nPlease note that this advisory only applies to the CRuby implementation of Nokogiri `< 1.13.4`, and only if the packaged version of `zlib` is being used. Please see [this document](https://nokogiri.org/LICENSE-DEPENDENCIES.html#default-platform-release-ruby) for a complete description of which platform gems vendor `zlib`. If you've overridden defaults at installation time to use system libraries instead of packaged libraries, you should instead pay attention to your distro's `zlib` release announcements. \n\n## Mitigation\n\nUpgrade to Nokogiri `>= v1.13.4`.\n\n## Impact\n\n### [CVE-2018-25032](https://nvd.nist.gov/vuln/detail/CVE-2018-25032) in zlib\n\n- **Severity**: High\n- **Type**: [CWE-787](https://cwe.mitre.org/data/definitions/787.html) Out of bounds write\n- **Description**: zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.", "references": [ { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.4", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.4" }, { "reference_url": "https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ?utm_medium=email&utm_source=footer", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ?utm_medium=email&utm_source=footer" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2018-25032", "reference_id": "CVE-2018-25032", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-25032" }, { "reference_url": "https://github.com/advisories/GHSA-jc36-42cf-vqwj", "reference_id": "GHSA-jc36-42cf-vqwj", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-jc36-42cf-vqwj" }, { "reference_url": "https://github.com/advisories/GHSA-v6gp-9mmm-c6p5", "reference_id": "GHSA-v6gp-9mmm-c6p5", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-v6gp-9mmm-c6p5" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v6gp-9mmm-c6p5", "reference_id": "GHSA-v6gp-9mmm-c6p5", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v6gp-9mmm-c6p5" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/60098?format=api", "purl": "pkg:gem/nokogiri@1.13.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.13.4" } ], "aliases": [ "GHSA-v6gp-9mmm-c6p5", "GMS-2022-787" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-tdsp-x2ft-1yfy" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/11610?format=api", "vulnerability_id": "VCID-tswn-2k3y-wkhk", "summary": "Vulnerabilities in libxml2\nThe version of libxml2 packaged with Nokogiri contains several vulnerabilities. Nokogiri has mitigated these issues by upgrading to libxml It was discovered that a type confusion error existed in libxml2. An attacker could use this to specially construct XML data that could cause a denial of service or possibly execute arbitrary code. (CVE-2017-0663) It was discovered that libxml2 did not properly validate parsed entity references. An attacker could use this to specially construct XML data that could expose sensitive information. (CVE-2017-7375) It was discovered that a buffer overflow existed in libxml2 when handling HTTP redirects. An attacker could use this to specially construct XML data that could cause a denial of service or possibly execute arbitrary code. (CVE-2017-7376) Marcel Böhme and Van-Thuan Pham discovered a buffer overflow in libxml2 when handling elements. An attacker could use this to specially construct XML data that could cause a denial of service or possibly execute arbitrary code. (CVE-2017-9047) Marcel Böhme and Van-Thuan Pham discovered a buffer overread in libxml2 when handling elements. An attacker could use this to specially construct XML data that could cause a denial of service. (CVE-2017-9048) Marcel Böhme and Van-Thuan Pham discovered multiple buffer overreads in libxml2 when handling parameter-entity references. An attacker could use these to specially construct XML data that could cause a denial of service. (CVE-2017-9049, CVE-2017-9050)", "references": [ { "reference_url": "https://github.com/sparklemotion/nokogiri/issues/1673", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/sparklemotion/nokogiri/issues/1673" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/53076?format=api", "purl": "pkg:gem/nokogiri@1.8.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-12ee-na2t-6kg5" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-24ud-18pe-dudw" }, { "vulnerability": "VCID-38c3-z9yc-4ybx" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-5wxq-ekcv-vqhq" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-9mh9-rax2-1bbb" }, { "vulnerability": "VCID-9psz-qfqt-e3fs" }, { "vulnerability": "VCID-9qtg-gxza-6ba9" }, { "vulnerability": "VCID-9xty-6acy-mub7" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-cft6-gvm9-8qf4" }, { "vulnerability": "VCID-cq5z-6cmf-5kfs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-f91q-9psx-qkaa" }, { "vulnerability": "VCID-g5sw-gyv7-vya1" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jvbh-pnxm-9bg7" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-kzy6-b4n3-m7d4" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-pffr-3a27-4qgx" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-qysn-w1za-83ea" }, { "vulnerability": "VCID-sgvg-768f-gybf" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-w6ws-2kbb-bfgs" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" }, { "vulnerability": "VCID-zuw7-d1r3-77h1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.8.1" } ], "aliases": [ "USN-3424-1" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-tswn-2k3y-wkhk" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/195640?format=api", "vulnerability_id": "VCID-uud6-jbnt-dkhb", "summary": "", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-29181.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-29181.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-29181", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.04183", "scoring_system": "epss", "scoring_elements": "0.88889", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-29181" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29181", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29181" }, { "reference_url": "http://seclists.org/fulldisclosure/2022/Dec/23", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://seclists.org/fulldisclosure/2022/Dec/23" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2022-29181.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2022-29181.yml" }, { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/commit/83cc451c3f29df397caa890afc3b714eae6ab8f7", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-22T15:41:19Z/" } ], "url": "https://github.com/sparklemotion/nokogiri/commit/83cc451c3f29df397caa890afc3b714eae6ab8f7" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/commit/db05ba9a1bd4b90aa6c76742cf6102a7c7297267", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-22T15:41:19Z/" } ], "url": "https://github.com/sparklemotion/nokogiri/commit/db05ba9a1bd4b90aa6c76742cf6102a7c7297267" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.6", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-22T15:41:19Z/" } ], "url": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.6" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xh29-r2w5-wx8m", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-22T15:41:19Z/" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xh29-r2w5-wx8m" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29181", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29181" }, { "reference_url": "https://security.gentoo.org/glsa/202208-29", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.gentoo.org/glsa/202208-29" }, { "reference_url": "https://securitylab.github.com/advisories/GHSL-2022-031_GHSL-2022-032_Nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-22T15:41:19Z/" } ], "url": "https://securitylab.github.com/advisories/GHSL-2022-031_GHSL-2022-032_Nokogiri" }, { "reference_url": "https://support.apple.com/kb/HT213532", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://support.apple.com/kb/HT213532" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2088684", "reference_id": "2088684", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2088684" }, { "reference_url": "https://github.com/advisories/GHSA-xh29-r2w5-wx8m", "reference_id": "GHSA-xh29-r2w5-wx8m", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-xh29-r2w5-wx8m" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8506", "reference_id": "RHSA-2022:8506", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8506" }, { "reference_url": "https://usn.ubuntu.com/7659-1/", "reference_id": "USN-7659-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7659-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/162044?format=api", "purl": "pkg:gem/nokogiri@1.13.6", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.13.6" } ], "aliases": [ "CVE-2022-29181", "GHSA-xh29-r2w5-wx8m" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-uud6-jbnt-dkhb" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/15138?format=api", "vulnerability_id": "VCID-vkzp-3xvx-zfby", "summary": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in nokogiri.", "references": [ { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/advisories/GHSA-fq42-c5rg-92c2", "reference_id": "GHSA-fq42-c5rg-92c2", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-fq42-c5rg-92c2" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-fq42-c5rg-92c2", "reference_id": "GHSA-fq42-c5rg-92c2", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-fq42-c5rg-92c2" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/59779?format=api", "purl": "pkg:gem/nokogiri@1.13.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.13.2" } ], "aliases": [ "GHSA-fq42-c5rg-92c2", "GMS-2022-163" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-vkzp-3xvx-zfby" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/204495?format=api", "vulnerability_id": "VCID-vsfg-94ug-vydr", "summary": "", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-40303.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-40303.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-40303", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0023", "scoring_system": "epss", "scoring_elements": "0.45883", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-40303" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40303", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40303" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40304", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40304" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://nokogiri.org/CHANGELOG.html#1139-2022-10-18", "reference_id": "", "reference_type": "", "scores": [], "url": "https://nokogiri.org/CHANGELOG.html#1139-2022-10-18" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1022224", "reference_id": "1022224", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1022224" }, { "reference_url": "http://seclists.org/fulldisclosure/2022/Dec/21", "reference_id": "21", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-29T04:23:26Z/" } ], "url": "http://seclists.org/fulldisclosure/2022/Dec/21" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136266", "reference_id": "2136266", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136266" }, { "reference_url": "http://seclists.org/fulldisclosure/2022/Dec/24", "reference_id": "24", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-29T04:23:26Z/" } ], "url": "http://seclists.org/fulldisclosure/2022/Dec/24" }, { "reference_url": "http://seclists.org/fulldisclosure/2022/Dec/25", "reference_id": "25", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-29T04:23:26Z/" } ], "url": "http://seclists.org/fulldisclosure/2022/Dec/25" }, { "reference_url": "http://seclists.org/fulldisclosure/2022/Dec/26", "reference_id": "26", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-29T04:23:26Z/" } ], "url": "http://seclists.org/fulldisclosure/2022/Dec/26" }, { "reference_url": "http://seclists.org/fulldisclosure/2022/Dec/27", "reference_id": "27", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-29T04:23:26Z/" } ], "url": "http://seclists.org/fulldisclosure/2022/Dec/27" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/c846986356fc149915a74972bf198abc266bc2c0", "reference_id": "c846986356fc149915a74972bf198abc266bc2c0", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-29T04:23:26Z/" } ], "url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/c846986356fc149915a74972bf198abc266bc2c0" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40303", "reference_id": "CVE-2022-40303", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40303" }, { "reference_url": "https://security.gentoo.org/glsa/202210-39", "reference_id": "GLSA-202210-39", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202210-39" }, { "reference_url": "https://support.apple.com/kb/HT213531", "reference_id": "HT213531", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-29T04:23:26Z/" } ], "url": "https://support.apple.com/kb/HT213531" }, { "reference_url": "https://support.apple.com/kb/HT213533", "reference_id": "HT213533", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-29T04:23:26Z/" } ], "url": "https://support.apple.com/kb/HT213533" }, { "reference_url": "https://support.apple.com/kb/HT213534", "reference_id": "HT213534", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-29T04:23:26Z/" } ], "url": "https://support.apple.com/kb/HT213534" }, { "reference_url": "https://support.apple.com/kb/HT213535", "reference_id": "HT213535", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-29T04:23:26Z/" } ], "url": "https://support.apple.com/kb/HT213535" }, { "reference_url": "https://support.apple.com/kb/HT213536", "reference_id": "HT213536", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-29T04:23:26Z/" } ], "url": "https://support.apple.com/kb/HT213536" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20221209-0003/", "reference_id": "ntap-20221209-0003", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-29T04:23:26Z/" } ], "url": "https://security.netapp.com/advisory/ntap-20221209-0003/" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8841", "reference_id": "RHSA-2022:8841", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8841" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0173", "reference_id": "RHSA-2023:0173", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0173" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0338", "reference_id": "RHSA-2023:0338", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0338" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2024:0413", "reference_id": "RHSA-2024:0413", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2024:0413" }, { "reference_url": "https://usn.ubuntu.com/5760-1/", "reference_id": "USN-5760-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5760-1/" }, { "reference_url": "https://usn.ubuntu.com/5760-2/", "reference_id": "USN-5760-2", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5760-2/" }, { "reference_url": "https://usn.ubuntu.com/7659-1/", "reference_id": "USN-7659-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7659-1/" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxml2/-/tags/v2.10.3", "reference_id": "v2.10.3", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-29T04:23:26Z/" } ], "url": "https://gitlab.gnome.org/GNOME/libxml2/-/tags/v2.10.3" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/79536?format=api", "purl": "pkg:gem/nokogiri@1.13.9", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.13.9" } ], "aliases": [ "CVE-2022-40303" ], "risk_score": 3.4, "exploitability": "0.5", "weighted_severity": "6.8", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-vsfg-94ug-vydr" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/1869?format=api", "vulnerability_id": "VCID-w6ws-2kbb-bfgs", "summary": "multiple issues", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-5815.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-5815.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2019-5815", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00111", "scoring_system": "epss", "scoring_elements": "0.29283", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-5815" }, { "reference_url": "https://bugs.chromium.org/p/chromium/issues/detail?id=930663", "reference_id": "", "reference_type": "", "scores": [], "url": "https://bugs.chromium.org/p/chromium/issues/detail?id=930663" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13698", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13698" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5805", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5805" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5806", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5806" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5807", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5807" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5808", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5808" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5809", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5809" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5810", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5810" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5811", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5811" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5813", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5813" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5814", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5814" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5815", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5815" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5818", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5818" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5819", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5819" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5820", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5820" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5821", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5821" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5822", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5822" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5823", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5823" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5824", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5824" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5825", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5825" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5826", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5826" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5827", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5827" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5828", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5828" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5829", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5829" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5830", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5830" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5831", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5831" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5832", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5832" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5833", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5833" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5834", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5834" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5836", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5836" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5837", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5837" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5838", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5838" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5839", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5839" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5840", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5840" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5841", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5841" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5842", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5842" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5843", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5843" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5847", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5847" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5848", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5848" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5849", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5849" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5850", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5850" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5851", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5851" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5852", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5852" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5853", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5853" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5854", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5854" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5855", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5855" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5856", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5856" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5857", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5857" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5858", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5858" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5859", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5859" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5860", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5860" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5861", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5861" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5862", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5862" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5864", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5864" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5865", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5865" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5867", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5867" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5868", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5868" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6503", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6503" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6504", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6504" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2019-5815.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2019-5815.yml" }, { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/issues/2630", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/issues/2630" }, { "reference_url": "https://gitlab.gnome.org/GNOME/libxslt/commit/08b62c25871b38d5d573515ca8a065b4b8f64f6b", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://gitlab.gnome.org/GNOME/libxslt/commit/08b62c25871b38d5d573515ca8a065b4b8f64f6b" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00010.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00010.html" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1702905", "reference_id": "1702905", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1702905" }, { "reference_url": "https://security.archlinux.org/ASA-201904-12", "reference_id": "ASA-201904-12", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-201904-12" }, { "reference_url": "https://security.archlinux.org/AVG-952", "reference_id": "AVG-952", "reference_type": "", "scores": [ { "value": "Critical", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-952" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5815", "reference_id": "CVE-2019-5815", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5815" }, { "reference_url": "https://security.gentoo.org/glsa/201908-18", "reference_id": "GLSA-201908-18", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/201908-18" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2019:1021", "reference_id": "RHSA-2019:1021", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2019:1021" }, { "reference_url": "https://usn.ubuntu.com/5575-1/", "reference_id": "USN-5575-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5575-1/" }, { "reference_url": "https://usn.ubuntu.com/5575-2/", "reference_id": "USN-5575-2", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5575-2/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/56778?format=api", "purl": "pkg:gem/nokogiri@1.10.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-12ee-na2t-6kg5" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-24ud-18pe-dudw" }, { "vulnerability": "VCID-38c3-z9yc-4ybx" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-5wxq-ekcv-vqhq" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-9psz-qfqt-e3fs" }, { "vulnerability": "VCID-9qtg-gxza-6ba9" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-cft6-gvm9-8qf4" }, { "vulnerability": "VCID-cq5z-6cmf-5kfs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-g5sw-gyv7-vya1" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-qysn-w1za-83ea" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" }, { "vulnerability": "VCID-zuw7-d1r3-77h1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.10.4" }, { "url": "http://public2.vulnerablecode.io/api/packages/57262?format=api", "purl": "pkg:gem/nokogiri@1.10.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-12ee-na2t-6kg5" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-24ud-18pe-dudw" }, { "vulnerability": "VCID-38c3-z9yc-4ybx" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-5wxq-ekcv-vqhq" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-9qtg-gxza-6ba9" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-cft6-gvm9-8qf4" }, { "vulnerability": "VCID-cq5z-6cmf-5kfs" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-g5sw-gyv7-vya1" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" }, { "vulnerability": "VCID-zuw7-d1r3-77h1" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.10.5" } ], "aliases": [ "CVE-2019-5815", "GHSA-vmfx-gcfq-wvm2" ], "risk_score": 4.5, "exploitability": "0.5", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-w6ws-2kbb-bfgs" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/15491?format=api", "vulnerability_id": "VCID-ykfz-evfp-uyhw", "summary": "XML Injection in Xerces Java affects Nokogiri\n## Summary\n\nNokogiri v1.13.4 updates the vendored `xerces:xercesImpl` from 2.12.0 to 2.12.2, which addresses [CVE-2022-23437](https://nvd.nist.gov/vuln/detail/CVE-2022-23437). That CVE is scored as CVSS 6.5 \"Medium\" on the NVD record.\n\nPlease note that this advisory only applies to the **JRuby** implementation of Nokogiri `< 1.13.4`.\n\n## Mitigation\n\nUpgrade to Nokogiri `>= v1.13.4`.\n\n## Impact\n\n### [CVE-2022-23437](https://nvd.nist.gov/vuln/detail/CVE-2022-23437) in xerces-J\n\n- **Severity**: Medium\n- **Type**: [CWE-91](https://cwe.mitre.org/data/definitions/91.html) XML Injection (aka Blind XPath Injection)\n- **Description**: There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.\n- **See also**: https://github.com/advisories/GHSA-h65f-jvqw-m9fj", "references": [ { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.4", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.4" }, { "reference_url": "https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ?utm_medium=email&utm_source=footer", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ?utm_medium=email&utm_source=footer" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23437", "reference_id": "CVE-2022-23437", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23437" }, { "reference_url": "https://github.com/advisories/GHSA-h65f-jvqw-m9fj", "reference_id": "GHSA-h65f-jvqw-m9fj", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-h65f-jvqw-m9fj" }, { "reference_url": "https://github.com/advisories/GHSA-xxx9-3xcr-gjj3", "reference_id": "GHSA-xxx9-3xcr-gjj3", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-xxx9-3xcr-gjj3" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xxx9-3xcr-gjj3", "reference_id": "GHSA-xxx9-3xcr-gjj3", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xxx9-3xcr-gjj3" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/60098?format=api", "purl": "pkg:gem/nokogiri@1.13.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.13.4" } ], "aliases": [ "GHSA-xxx9-3xcr-gjj3", "GMS-2022-788" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ykfz-evfp-uyhw" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/340591?format=api", "vulnerability_id": "VCID-zka7-1e8v-d3d7", "summary": "Update bundled libxml2 to v2.10.3 to resolve multiple CVEs", "references": [ { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/advisories/GHSA-2qc6-mcvw-92cw", "reference_id": "GHSA-2qc6-mcvw-92cw", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-2qc6-mcvw-92cw" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-2qc6-mcvw-92cw", "reference_id": "GHSA-2qc6-mcvw-92cw", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-2qc6-mcvw-92cw" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/79536?format=api", "purl": "pkg:gem/nokogiri@1.13.9", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.13.9" } ], "aliases": [ "GHSA-2qc6-mcvw-92cw" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-zka7-1e8v-d3d7" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/3102?format=api", "vulnerability_id": "VCID-zqnw-e1eq-dqbv", "summary": "arbitrary code execution", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-25032.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.2", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-25032.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2018-25032", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00089", "scoring_system": "epss", "scoring_elements": "0.25373", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2018-25032" }, { "reference_url": "https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-25032", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-25032" }, { "reference_url": "http://seclists.org/fulldisclosure/2022/May/33", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "http://seclists.org/fulldisclosure/2022/May/33" }, { "reference_url": "http://seclists.org/fulldisclosure/2022/May/35", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "http://seclists.org/fulldisclosure/2022/May/35" }, { "reference_url": "http://seclists.org/fulldisclosure/2022/May/38", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "http://seclists.org/fulldisclosure/2022/May/38" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531" }, { "reference_url": "https://github.com/madler/zlib/compare/v1.2.11...v1.2.12", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://github.com/madler/zlib/compare/v1.2.11...v1.2.12" }, { "reference_url": "https://github.com/madler/zlib/issues/605", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://github.com/madler/zlib/issues/605" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2022/04/msg00000.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://lists.debian.org/debian-lts-announce/2022/04/msg00000.html" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00008.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00008.html" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DCZFIJBJTZ7CL5QXBFKTQ22Q26VINRUF", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DCZFIJBJTZ7CL5QXBFKTQ22Q26VINRUF" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DCZFIJBJTZ7CL5QXBFKTQ22Q26VINRUF/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DCZFIJBJTZ7CL5QXBFKTQ22Q26VINRUF/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DF62MVMH3QUGMBDCB3DY2ERQ6EBHTADB", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DF62MVMH3QUGMBDCB3DY2ERQ6EBHTADB" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DF62MVMH3QUGMBDCB3DY2ERQ6EBHTADB/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DF62MVMH3QUGMBDCB3DY2ERQ6EBHTADB/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JZZPTWRYQULAOL3AW7RZJNVZ2UONXCV4", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JZZPTWRYQULAOL3AW7RZJNVZ2UONXCV4" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JZZPTWRYQULAOL3AW7RZJNVZ2UONXCV4/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JZZPTWRYQULAOL3AW7RZJNVZ2UONXCV4/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NS2D2GFPFGOJUL4WQ3DUAY7HF4VWQ77F", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NS2D2GFPFGOJUL4WQ3DUAY7HF4VWQ77F" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NS2D2GFPFGOJUL4WQ3DUAY7HF4VWQ77F/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NS2D2GFPFGOJUL4WQ3DUAY7HF4VWQ77F/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VOKNP2L734AEL47NRYGVZIKEFOUBQY5Y", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VOKNP2L734AEL47NRYGVZIKEFOUBQY5Y" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VOKNP2L734AEL47NRYGVZIKEFOUBQY5Y/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VOKNP2L734AEL47NRYGVZIKEFOUBQY5Y/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XOKFMSNQ5D5WGMALBNBXU3GE442V74WU", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XOKFMSNQ5D5WGMALBNBXU3GE442V74WU" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XOKFMSNQ5D5WGMALBNBXU3GE442V74WU/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XOKFMSNQ5D5WGMALBNBXU3GE442V74WU/" }, { "reference_url": "https://security.gentoo.org/glsa/202210-42", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://security.gentoo.org/glsa/202210-42" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20220526-0009", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20220526-0009" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20220526-0009/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://security.netapp.com/advisory/ntap-20220526-0009/" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20220729-0004", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20220729-0004" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20220729-0004/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://security.netapp.com/advisory/ntap-20220729-0004/" }, { "reference_url": "https://support.apple.com/kb/HT213255", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://support.apple.com/kb/HT213255" }, { "reference_url": "https://support.apple.com/kb/HT213256", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://support.apple.com/kb/HT213256" }, { "reference_url": "https://support.apple.com/kb/HT213257", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://support.apple.com/kb/HT213257" }, { "reference_url": "https://www.debian.org/security/2022/dsa-5111", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://www.debian.org/security/2022/dsa-5111" }, { "reference_url": "https://www.openwall.com/lists/oss-security/2022/03/24/1", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://www.openwall.com/lists/oss-security/2022/03/24/1" }, { "reference_url": "https://www.openwall.com/lists/oss-security/2022/03/28/1", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://www.openwall.com/lists/oss-security/2022/03/28/1" }, { "reference_url": "https://www.openwall.com/lists/oss-security/2022/03/28/3", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://www.openwall.com/lists/oss-security/2022/03/28/3" }, { "reference_url": "https://www.oracle.com/security-alerts/cpujul2022.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://www.oracle.com/security-alerts/cpujul2022.html" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2022/03/25/2", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2022/03/25/2" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2022/03/26/1", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "http://www.openwall.com/lists/oss-security/2022/03/26/1" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1008265", "reference_id": "1008265", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1008265" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2067945", "reference_id": "2067945", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2067945" }, { "reference_url": "https://security.archlinux.org/ASA-202204-3", "reference_id": "ASA-202204-3", "reference_type": "", "scores": [], "url": "https://security.archlinux.org/ASA-202204-3" }, { "reference_url": "https://security.archlinux.org/AVG-2657", "reference_id": "AVG-2657", "reference_type": "", "scores": [ { "value": "High", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-2657" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2018-25032", "reference_id": "CVE-2018-25032", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-25032" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2018-25032.yml", "reference_id": "CVE-2018-25032.YML", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2018-25032.yml" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DCZFIJBJTZ7CL5QXBFKTQ22Q26VINRUF/", "reference_id": "DCZFIJBJTZ7CL5QXBFKTQ22Q26VINRUF", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DCZFIJBJTZ7CL5QXBFKTQ22Q26VINRUF/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DF62MVMH3QUGMBDCB3DY2ERQ6EBHTADB/", "reference_id": "DF62MVMH3QUGMBDCB3DY2ERQ6EBHTADB", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DF62MVMH3QUGMBDCB3DY2ERQ6EBHTADB/" }, { "reference_url": "https://github.com/advisories/GHSA-jc36-42cf-vqwj", "reference_id": "GHSA-jc36-42cf-vqwj", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-jc36-42cf-vqwj" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v6gp-9mmm-c6p5", "reference_id": "GHSA-v6gp-9mmm-c6p5", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v6gp-9mmm-c6p5" }, { "reference_url": "https://security.gentoo.org/glsa/202405-22", "reference_id": "GLSA-202405-22", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202405-22" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZZPTWRYQULAOL3AW7RZJNVZ2UONXCV4/", "reference_id": "JZZPTWRYQULAOL3AW7RZJNVZ2UONXCV4", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZZPTWRYQULAOL3AW7RZJNVZ2UONXCV4/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NS2D2GFPFGOJUL4WQ3DUAY7HF4VWQ77F/", "reference_id": "NS2D2GFPFGOJUL4WQ3DUAY7HF4VWQ77F", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NS2D2GFPFGOJUL4WQ3DUAY7HF4VWQ77F/" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1591", "reference_id": "RHSA-2022:1591", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1591" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1642", "reference_id": "RHSA-2022:1642", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1642" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1661", "reference_id": "RHSA-2022:1661", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1661" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:2192", "reference_id": "RHSA-2022:2192", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:2192" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:2197", "reference_id": "RHSA-2022:2197", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:2197" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:2198", "reference_id": "RHSA-2022:2198", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:2198" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:2201", "reference_id": "RHSA-2022:2201", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:2201" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:2213", "reference_id": "RHSA-2022:2213", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:2213" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:2214", "reference_id": "RHSA-2022:2214", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:2214" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:4584", "reference_id": "RHSA-2022:4584", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:4584" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:4592", "reference_id": "RHSA-2022:4592", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:4592" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:4845", "reference_id": "RHSA-2022:4845", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:4845" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:4896", "reference_id": "RHSA-2022:4896", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:4896" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:5439", "reference_id": "RHSA-2022:5439", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:5439" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:7144", "reference_id": "RHSA-2022:7144", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:7144" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:7813", "reference_id": "RHSA-2022:7813", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:7813" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:8420", "reference_id": "RHSA-2022:8420", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:8420" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0943", "reference_id": "RHSA-2023:0943", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0943" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0975", "reference_id": "RHSA-2023:0975", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0975" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2023:0976", "reference_id": "RHSA-2023:0976", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2023:0976" }, { "reference_url": "https://usn.ubuntu.com/5355-1/", "reference_id": "USN-5355-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5355-1/" }, { "reference_url": "https://usn.ubuntu.com/5355-2/", "reference_id": "USN-5355-2", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5355-2/" }, { "reference_url": "https://usn.ubuntu.com/5359-1/", "reference_id": "USN-5359-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5359-1/" }, { "reference_url": "https://usn.ubuntu.com/5359-2/", "reference_id": "USN-5359-2", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5359-2/" }, { "reference_url": "https://usn.ubuntu.com/5739-1/", "reference_id": "USN-5739-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5739-1/" }, { "reference_url": "https://usn.ubuntu.com/6736-1/", "reference_id": "USN-6736-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/6736-1/" }, { "reference_url": "https://usn.ubuntu.com/6736-2/", "reference_id": "USN-6736-2", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/6736-2/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOKNP2L734AEL47NRYGVZIKEFOUBQY5Y/", "reference_id": "VOKNP2L734AEL47NRYGVZIKEFOUBQY5Y", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOKNP2L734AEL47NRYGVZIKEFOUBQY5Y/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOKFMSNQ5D5WGMALBNBXU3GE442V74WU/", "reference_id": "XOKFMSNQ5D5WGMALBNBXU3GE442V74WU", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T13:30:25Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOKFMSNQ5D5WGMALBNBXU3GE442V74WU/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/60098?format=api", "purl": "pkg:gem/nokogiri@1.13.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.13.4" } ], "aliases": [ "CVE-2018-25032", "GHSA-jc36-42cf-vqwj" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-zqnw-e1eq-dqbv" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/3406?format=api", "vulnerability_id": "VCID-zuw7-d1r3-77h1", "summary": "multiple issues", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-3518.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.6", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-3518.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-3518", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0025", "scoring_system": "epss", "scoring_elements": "0.48554", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-3518" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1954242", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1954242" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3518", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3518" }, { "reference_url": "http://seclists.org/fulldisclosure/2021/Jul/54", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://seclists.org/fulldisclosure/2021/Jul/54" }, { "reference_url": "http://seclists.org/fulldisclosure/2021/Jul/55", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://seclists.org/fulldisclosure/2021/Jul/55" }, { "reference_url": "http://seclists.org/fulldisclosure/2021/Jul/58", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://seclists.org/fulldisclosure/2021/Jul/58" }, { "reference_url": "http://seclists.org/fulldisclosure/2021/Jul/59", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://seclists.org/fulldisclosure/2021/Jul/59" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/sparklemotion/nokogiri", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri" }, { "reference_url": "https://github.com/sparklemotion/nokogiri/blob/2edbbef95f1dc12c1ddc5ebda71b9159026245fe/CHANGELOG.md?plain=1#L722", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/sparklemotion/nokogiri/blob/2edbbef95f1dc12c1ddc5ebda71b9159026245fe/CHANGELOG.md?plain=1#L722" }, { "reference_url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/" }, { "reference_url": "https://nokogiri.org/CHANGELOG.html#1114-2021-05-14", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nokogiri.org/CHANGELOG.html#1114-2021-05-14" }, { "reference_url": "https://security.gentoo.org/glsa/202107-05", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.gentoo.org/glsa/202107-05" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20210625-0002", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.netapp.com/advisory/ntap-20210625-0002" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20210625-0002/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://security.netapp.com/advisory/ntap-20210625-0002/" }, { "reference_url": "https://support.apple.com/kb/HT212601", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://support.apple.com/kb/HT212601" }, { "reference_url": "https://support.apple.com/kb/HT212602", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://support.apple.com/kb/HT212602" }, { "reference_url": "https://support.apple.com/kb/HT212604", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://support.apple.com/kb/HT212604" }, { "reference_url": "https://support.apple.com/kb/HT212605", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://support.apple.com/kb/HT212605" }, { "reference_url": "https://www.oracle.com/security-alerts/cpuapr2022.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" }, { "reference_url": "https://www.oracle.com/security-alerts/cpujul2022.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.oracle.com/security-alerts/cpujul2022.html" }, { "reference_url": "https://www.oracle.com/security-alerts/cpuoct2021.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.oracle.com/security-alerts/cpuoct2021.html" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=987737", "reference_id": "987737", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=987737" }, { "reference_url": "https://security.archlinux.org/AVG-1883", "reference_id": "AVG-1883", "reference_type": "", "scores": [ { "value": "High", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1883" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3518", "reference_id": "CVE-2021-3518", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3518" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2021-3518.yml", "reference_id": "CVE-2021-3518.YML", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2021-3518.yml" }, { "reference_url": "https://github.com/advisories/GHSA-v4f8-2847-rwm7", "reference_id": "GHSA-v4f8-2847-rwm7", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-v4f8-2847-rwm7" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:2569", "reference_id": "RHSA-2021:2569", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:2569" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1389", "reference_id": "RHSA-2022:1389", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1389" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:1390", "reference_id": "RHSA-2022:1390", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:1390" }, { "reference_url": "https://usn.ubuntu.com/4991-1/", "reference_id": "USN-4991-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/4991-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/57350?format=api", "purl": "pkg:gem/nokogiri@1.11.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-12a5-5jss-nfd1" }, { "vulnerability": "VCID-1ks1-3a4g-eqe7" }, { "vulnerability": "VCID-1pqt-8ppw-eqa6" }, { "vulnerability": "VCID-48nc-c7xx-j7ap" }, { "vulnerability": "VCID-4yvf-h1z3-nfd7" }, { "vulnerability": "VCID-6b72-3exf-qfhs" }, { "vulnerability": "VCID-arq2-c738-tugt" }, { "vulnerability": "VCID-bj99-tt95-63ak" }, { "vulnerability": "VCID-cft6-gvm9-8qf4" }, { "vulnerability": "VCID-e37h-xnn4-hbcn" }, { "vulnerability": "VCID-gpcm-1wx2-guhq" }, { "vulnerability": "VCID-jjqw-bevm-f7b2" }, { "vulnerability": "VCID-jwaq-3j9v-nbde" }, { "vulnerability": "VCID-ktaj-j2nh-zug6" }, { "vulnerability": "VCID-m542-6h3p-gudj" }, { "vulnerability": "VCID-pjeb-1jpy-kkea" }, { "vulnerability": "VCID-qm8g-u6z7-4kgb" }, { "vulnerability": "VCID-tdsp-x2ft-1yfy" }, { "vulnerability": "VCID-uud6-jbnt-dkhb" }, { "vulnerability": "VCID-vkzp-3xvx-zfby" }, { "vulnerability": "VCID-vsfg-94ug-vydr" }, { "vulnerability": "VCID-ykfz-evfp-uyhw" }, { "vulnerability": "VCID-zka7-1e8v-d3d7" }, { "vulnerability": "VCID-zqnw-e1eq-dqbv" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.11.4" } ], "aliases": [ "CVE-2021-3518", "GHSA-v4f8-2847-rwm7" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-zuw7-d1r3-77h1" } ], "fixing_vulnerabilities": [], "risk_score": "4.5", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/nokogiri@1.5.0" }