ncb000gt/goathub

API keys, passwords or tokens committed into the repo.

• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  test/functional/users_controller_test.rb:11
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  test/fixtures/feeds/single_item.xml:5
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  test/functional/users_controller_test.rb:11
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  test/functional/users_controller_test.rb:12
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  test/fixtures/feeds/three_items.xml:5
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  config/initializers/secret_token.rb:7
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  test/fixtures/feeds/first_update.xml:5
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  test/fixtures/feeds/second_update.xml:5
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Serious CVE-2013-0156 rubygem-activesupport: Multiple vulnerabilities in parameter parsing in ActionPack
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2013-0156). Fix: Update that package to its patched version.
• Serious CVE-2013-0155 rubygem-activerecord: Unsafe Query Generation Risk in Ruby on Rails
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2013-0155). Fix: Update that package to its patched version.
• Serious CVE-2013-0277 rubygem-activerecord: Serialized Attributes YAML Vulnerability with Rails 2.3 and 3.0
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2013-0277). Fix: Update that package to its patched version.
• Serious CVE-2022-32224 activerecord: Possible RCE escalation bug with Serialized Columns in Active Record
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-32224). Fix: Update that package to its patched version.
• Serious CVE-2013-0333 rubygem-activesupport: json to yaml parsing
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2013-0333). Fix: Update that package to its patched version.
• Serious CVE-2020-8165 rubygem-activesupport: potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-8165). Fix: Update that package to its patched version.
• Serious CVE-2013-0269 rubygem-json: Denial of Service and SQL Injection
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2013-0269). Fix: Update that package to its patched version.
• Serious CVE-2022-30123 rubygem-rack: crafted requests can cause shell escape sequences
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-30123). Fix: Update that package to its patched version.
• Worth fixing CVE-2013-4389 rubygem-actionmailer: email address processing DoS
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2013-4389). Fix: Update that package to its patched version.
• Worth fixing CVE-2012-2660 rubygem-actionpack: Unsafe query generation
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2012-2660). Fix: Update that package to its patched version.
• Worth fixing CVE-2014-0130 rubygem-actionpack: directory traversal issue
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2014-0130). Fix: Update that package to its patched version.
• Worth fixing CVE-2016-0751 rubygem-actionpack: possible object leak and denial of service attack in Action Pack
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2016-0751). Fix: Update that package to its patched version.
• Worth fixing CVE-2016-0752 rubygem-actionpack: directory traversal flaw in Action View
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2016-0752). Fix: Update that package to its patched version.
• Worth fixing CVE-2016-2098 rubygem-actionpack: code injection vulnerability in Action View
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2016-2098). Fix: Update that package to its patched version.
• Worth fixing CVE-2021-22885 rubygem-actionpack: Possible Information Disclosure / Unintended Method Execution in Action Pack
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2021-22885). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-22792 rubygem-actionpack: Denial of Service in Action Dispatch
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2023-22792). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-22795 rubygem-actionpack: Denial of Service in Action Dispatch
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2023-22795). Fix: Update that package to its patched version.
• Worth fixing CVE-2011-2197 Potential XSS Vulnerability in Ruby on Rails Applications
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2011-2197). Fix: Update that package to its patched version.
• Worth fixing CVE-2011-2929 Filter Skipping Vulnerability in Ruby on Rails 3.0/actionpack
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2011-2929). Fix: Update that package to its patched version.
• Worth fixing CVE-2011-2931 Cross-site scripting (XSS) vulnerability in the strip_tags helper in a ...
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2011-2931). Fix: Update that package to its patched version.
• Worth fixing CVE-2011-4319 rubygem-actionpack: XSS in the 'translate' helper method
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2011-4319). Fix: Update that package to its patched version.
• Worth fixing CVE-2012-1099 rubygem-actionpack: XSS in the 'select' helper
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2012-1099). Fix: Update that package to its patched version.
• Worth fixing CVE-2012-2694 rubygem-actionpack: Unsafe query generation (a different flaw than CVE-2012-2660)
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2012-2694). Fix: Update that package to its patched version.
• Worth fixing CVE-2012-3424 rubygem-actionpack: DoS vulnerability in authenticate_or_request_with_http_digest
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2012-3424). Fix: Update that package to its patched version.
• Worth fixing CVE-2012-3463 rubygem-actionpack: potential XSS vulnerability in select_tag prompt
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2012-3463). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Serious GHSA-3hhc-qp5v-9p2j Active Record RCE bug with Serialized Columns
  /workdirs/scan-21f81bdc-e811-4758-be69-77af87ad6f29/Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-32224). Fix: Update that package to its patched version.
• Serious GHSA-f57c-hx33-hvh8 Active Record component in Ruby on Rails has a data-type injection vulnerability
  /workdirs/scan-21f81bdc-e811-4758-be69-77af87ad6f29/Gemfile.lock
  A package you depend on has a known security hole (CVE-2013-3221). Fix: Update that package to its patched version.
• Serious GHSA-fhj9-cjjh-27vm Active Record contains deserialization of arbitrary YAML
  /workdirs/scan-21f81bdc-e811-4758-be69-77af87ad6f29/Gemfile.lock
  A package you depend on has a known security hole (CVE-2013-0277). Fix: Update that package to its patched version.
• Serious GHSA-wq4h-7r42-5hrr Possible shell escape sequence injection vulnerability in Rack
  /workdirs/scan-21f81bdc-e811-4758-be69-77af87ad6f29/Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-30123). Fix: Update that package to its patched version.
• Worth fixing GHSA-h47h-mwp9-c6q6 Possible ReDoS vulnerability in block_format in Action Mailer
  /workdirs/scan-21f81bdc-e811-4758-be69-77af87ad6f29/Gemfile.lock
  A package you depend on has a known security hole (CVE-2024-47889). Fix: Update that package to its patched version.
• Worth fixing GHSA-4g8v-vg43-wpgf Actionpack has possible cross-site scripting vulnerability via User Supplied Values to redirect_to
  /workdirs/scan-21f81bdc-e811-4758-be69-77af87ad6f29/Gemfile.lock
  A package you depend on has a known security hole (CVE-2023-28362). Fix: Update that package to its patched version.
• Worth fixing GHSA-6x85-j5j2-27jx actionpack Path Traversal vulnerability
  /workdirs/scan-21f81bdc-e811-4758-be69-77af87ad6f29/Gemfile.lock
  A package you depend on has a known security hole (CVE-2014-0130). Fix: Update that package to its patched version.
• Worth fixing GHSA-78rc-8c29-p45g actionpack allows remote code execution via application's unrestricted use of render method
  /workdirs/scan-21f81bdc-e811-4758-be69-77af87ad6f29/Gemfile.lock
  A package you depend on has a known security hole (CVE-2016-2098). Fix: Update that package to its patched version.
• Worth fixing GHSA-ffpv-c4hm-3x6v actionpack is vulnerable to denial of service via a crafted HTTP Accept header
  /workdirs/scan-21f81bdc-e811-4758-be69-77af87ad6f29/Gemfile.lock
  A package you depend on has a known security hole (CVE-2016-0751). Fix: Update that package to its patched version.
• Worth fixing GHSA-hjg4-8q5f-x6fm Action Pack contains Information Disclosure / Unintended Method Execution vulnerability
  /workdirs/scan-21f81bdc-e811-4758-be69-77af87ad6f29/Gemfile.lock
  A package you depend on has a known security hole (CVE-2021-22885). Fix: Update that package to its patched version.
• Worth fixing GHSA-jmgw-6vjg-jjwg actionpack Improper Input Validation vulnerability
  /workdirs/scan-21f81bdc-e811-4758-be69-77af87ad6f29/Gemfile.lock
  A package you depend on has a known security hole (CVE-2013-0156). Fix: Update that package to its patched version.
• Worth fixing GHSA-vx9j-46rh-fqr8 actionview contains Path Traversal vulnerability
  /workdirs/scan-21f81bdc-e811-4758-be69-77af87ad6f29/Gemfile.lock
  A package you depend on has a known security hole (CVE-2016-2097). Fix: Update that package to its patched version.
• Worth fixing GHSA-xrr4-p6fq-hjg7 Directory traversal vulnerability in Action View in Ruby on Rails
  /workdirs/scan-21f81bdc-e811-4758-be69-77af87ad6f29/Gemfile.lock
  A package you depend on has a known security hole (CVE-2016-0752). Fix: Update that package to its patched version.
• Worth fixing GHSA-579w-22j4-4749 Denial of Service Vulnerability in ActiveRecord's PostgreSQL adapter
  /workdirs/scan-21f81bdc-e811-4758-be69-77af87ad6f29/Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-44566). Fix: Update that package to its patched version.
• Worth fixing GHSA-76r7-hhxj-r776 Active Record logging vulnerable to ANSI escape injection
  /workdirs/scan-21f81bdc-e811-4758-be69-77af87ad6f29/Gemfile.lock
  A package you depend on has a known security hole (CVE-2025-55193). Fix: Update that package to its patched version.
• Worth fixing GHSA-76wq-xw4h-f8wj activerecord vulnerable to SQL Injection
  /workdirs/scan-21f81bdc-e811-4758-be69-77af87ad6f29/Gemfile.lock
  A package you depend on has a known security hole (CVE-2012-2695). Fix: Update that package to its patched version.
• Worth fixing GHSA-gh2w-j7cx-2664 Active Record contains SQL Injection
  /workdirs/scan-21f81bdc-e811-4758-be69-77af87ad6f29/Gemfile.lock
  A package you depend on has a known security hole (CVE-2012-6496). Fix: Update that package to its patched version.
• Worth fixing GHSA-h6w6-xmqv-7q78 activerecord vulnerable to SQL Injection
  /workdirs/scan-21f81bdc-e811-4758-be69-77af87ad6f29/Gemfile.lock
  A package you depend on has a known security hole (CVE-2011-2930). Fix: Update that package to its patched version.
• Worth fixing GHSA-mhwp-qhpc-h3jm SQL Injection in Active Record
  /workdirs/scan-21f81bdc-e811-4758-be69-77af87ad6f29/Gemfile.lock
  A package you depend on has a known security hole (CVE-2014-3482). Fix: Update that package to its patched version.
• Worth fixing GHSA-46j2-xjgp-jrfm Information disclosure issue in Active Resource
  /workdirs/scan-21f81bdc-e811-4758-be69-77af87ad6f29/Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-8151). Fix: Update that package to its patched version.
• Worth fixing GHSA-2j26-frm8-cmj9 Rails Active Support has a possible DoS vulnerability in its number helpers
  /workdirs/scan-21f81bdc-e811-4758-be69-77af87ad6f29/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33176). Fix: Update that package to its patched version.
• Worth fixing GHSA-89vf-4333-qx8v Rails Active Support has a possible XSS vulnerability in SafeBuffer#%
  /workdirs/scan-21f81bdc-e811-4758-be69-77af87ad6f29/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33170). Fix: Update that package to its patched version.
• Worth fixing GHSA-cg4j-q9v8-6v38 Rails Active Support has a possible ReDoS vulnerability in number_to_delimited
  /workdirs/scan-21f81bdc-e811-4758-be69-77af87ad6f29/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33169). Fix: Update that package to its patched version.
• Worth fixing GHSA-pj73-v5mw-pm9j Possible XSS Security Vulnerability in SafeBuffer#bytesplice
  /workdirs/scan-21f81bdc-e811-4758-be69-77af87ad6f29/Gemfile.lock
  A package you depend on has a known security hole (CVE-2023-28120). Fix: Update that package to its patched version.
• Worth fixing GHSA-xgr2-v94m-rc9g activesupport in Rails vulnerable to incorrect data conversion
  /workdirs/scan-21f81bdc-e811-4758-be69-77af87ad6f29/Gemfile.lock
  A package you depend on has a known security hole (CVE-2013-0333). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0