peelman/simple_form

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Serious CVE-2013-0156 rubygem-activesupport: Multiple vulnerabilities in parameter parsing in ActionPack
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2013-0156). Fix: Update that package to its patched version.
• Serious CVE-2020-8165 rubygem-activesupport: potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-8165). Fix: Update that package to its patched version.
• Serious CVE-2013-0269 rubygem-json: Denial of Service and SQL Injection
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2013-0269). Fix: Update that package to its patched version.
• Serious CVE-2022-30123 rubygem-rack: crafted requests can cause shell escape sequences
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-30123). Fix: Update that package to its patched version.
• Serious CVE-2019-16676 simple_form Gem for Ruby Incorrect Access Control for forms based on user input
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2019-16676). Fix: Update that package to its patched version.
• Worth fixing CVE-2012-2660 rubygem-actionpack: Unsafe query generation
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2012-2660). Fix: Update that package to its patched version.
• Worth fixing CVE-2014-0130 rubygem-actionpack: directory traversal issue
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2014-0130). Fix: Update that package to its patched version.
• Worth fixing CVE-2016-0751 rubygem-actionpack: possible object leak and denial of service attack in Action Pack
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2016-0751). Fix: Update that package to its patched version.
• Worth fixing CVE-2016-0752 rubygem-actionpack: directory traversal flaw in Action View
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2016-0752). Fix: Update that package to its patched version.
• Worth fixing CVE-2016-2098 rubygem-actionpack: code injection vulnerability in Action View
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2016-2098). Fix: Update that package to its patched version.
• Worth fixing CVE-2021-22885 rubygem-actionpack: Possible Information Disclosure / Unintended Method Execution in Action Pack
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2021-22885). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-22792 rubygem-actionpack: Denial of Service in Action Dispatch
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2023-22792). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-22795 rubygem-actionpack: Denial of Service in Action Dispatch
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2023-22795). Fix: Update that package to its patched version.
• Worth fixing CVE-2012-2694 rubygem-actionpack: Unsafe query generation (a different flaw than CVE-2012-2660)
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2012-2694). Fix: Update that package to its patched version.
• Worth fixing CVE-2012-3424 rubygem-actionpack: DoS vulnerability in authenticate_or_request_with_http_digest
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2012-3424). Fix: Update that package to its patched version.
• Worth fixing CVE-2012-3463 rubygem-actionpack: potential XSS vulnerability in select_tag prompt
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2012-3463). Fix: Update that package to its patched version.
• Worth fixing CVE-2012-3465 rubygem-actionpack: XSS Vulnerability in strip_tags
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2012-3465). Fix: Update that package to its patched version.
• Worth fixing CVE-2013-1855 rubygem-actionpack: css_sanitization: XSS vulnerability in sanitize_css
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2013-1855). Fix: Update that package to its patched version.
• Worth fixing CVE-2013-1857 rubygem-actionpack: sanitize_protocol: XSS Vulnerability in the helper of Ruby on Rails
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2013-1857). Fix: Update that package to its patched version.
• Worth fixing CVE-2013-4491 rubygem-actionpack: i18n missing translation XSS
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2013-4491). Fix: Update that package to its patched version.
• Worth fixing CVE-2013-6414 rubygem-actionpack: Action View DoS
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2013-6414). Fix: Update that package to its patched version.
• Worth fixing CVE-2013-6415 rubygem-actionpack: number_to_currency XSS
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2013-6415). Fix: Update that package to its patched version.
• Worth fixing CVE-2013-6417 rubygem-actionpack: unsafe query generation risk (incomplete fix for CVE-2013- 0155)
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2013-6417). Fix: Update that package to its patched version.
• Worth fixing CVE-2014-0081 rubygem-actionpack: number_to_currency, number_to_percentage and number_to_human XSS vulnerability
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2014-0081). Fix: Update that package to its patched version.
• Worth fixing CVE-2014-0082 rubygem-actionpack: Action View string handling denial of service
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2014-0082). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Serious GHSA-wq4h-7r42-5hrr Possible shell escape sequence injection vulnerability in Rack
  /workdirs/scan-25eb30dc-edd0-41d8-bfa7-d8f61b8dc62e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-30123). Fix: Update that package to its patched version.
• Serious GHSA-r74q-gxcg-73hx Improper Input Validation in simple_form
  /workdirs/scan-25eb30dc-edd0-41d8-bfa7-d8f61b8dc62e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2019-16676). Fix: Update that package to its patched version.
• Worth fixing GHSA-4g8v-vg43-wpgf Actionpack has possible cross-site scripting vulnerability via User Supplied Values to redirect_to
  /workdirs/scan-25eb30dc-edd0-41d8-bfa7-d8f61b8dc62e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2023-28362). Fix: Update that package to its patched version.
• Worth fixing GHSA-6x85-j5j2-27jx actionpack Path Traversal vulnerability
  /workdirs/scan-25eb30dc-edd0-41d8-bfa7-d8f61b8dc62e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2014-0130). Fix: Update that package to its patched version.
• Worth fixing GHSA-78rc-8c29-p45g actionpack allows remote code execution via application's unrestricted use of render method
  /workdirs/scan-25eb30dc-edd0-41d8-bfa7-d8f61b8dc62e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2016-2098). Fix: Update that package to its patched version.
• Worth fixing GHSA-ffpv-c4hm-3x6v actionpack is vulnerable to denial of service via a crafted HTTP Accept header
  /workdirs/scan-25eb30dc-edd0-41d8-bfa7-d8f61b8dc62e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2016-0751). Fix: Update that package to its patched version.
• Worth fixing GHSA-hjg4-8q5f-x6fm Action Pack contains Information Disclosure / Unintended Method Execution vulnerability
  /workdirs/scan-25eb30dc-edd0-41d8-bfa7-d8f61b8dc62e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2021-22885). Fix: Update that package to its patched version.
• Worth fixing GHSA-jmgw-6vjg-jjwg actionpack Improper Input Validation vulnerability
  /workdirs/scan-25eb30dc-edd0-41d8-bfa7-d8f61b8dc62e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2013-0156). Fix: Update that package to its patched version.
• Worth fixing GHSA-vx9j-46rh-fqr8 actionview contains Path Traversal vulnerability
  /workdirs/scan-25eb30dc-edd0-41d8-bfa7-d8f61b8dc62e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2016-2097). Fix: Update that package to its patched version.
• Worth fixing GHSA-x76w-6vjr-8xgj Possible ReDoS vulnerability in query parameter filtering in Action Dispatch
  /workdirs/scan-25eb30dc-edd0-41d8-bfa7-d8f61b8dc62e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2024-41128). Fix: Update that package to its patched version.
• Worth fixing GHSA-xrr4-p6fq-hjg7 Directory traversal vulnerability in Action View in Ruby on Rails
  /workdirs/scan-25eb30dc-edd0-41d8-bfa7-d8f61b8dc62e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2016-0752). Fix: Update that package to its patched version.
• Worth fixing GHSA-2j26-frm8-cmj9 Rails Active Support has a possible DoS vulnerability in its number helpers
  /workdirs/scan-25eb30dc-edd0-41d8-bfa7-d8f61b8dc62e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33176). Fix: Update that package to its patched version.
• Worth fixing GHSA-89vf-4333-qx8v Rails Active Support has a possible XSS vulnerability in SafeBuffer#%
  /workdirs/scan-25eb30dc-edd0-41d8-bfa7-d8f61b8dc62e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33170). Fix: Update that package to its patched version.
• Worth fixing GHSA-cg4j-q9v8-6v38 Rails Active Support has a possible ReDoS vulnerability in number_to_delimited
  /workdirs/scan-25eb30dc-edd0-41d8-bfa7-d8f61b8dc62e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33169). Fix: Update that package to its patched version.
• Worth fixing GHSA-pj73-v5mw-pm9j Possible XSS Security Vulnerability in SafeBuffer#bytesplice
  /workdirs/scan-25eb30dc-edd0-41d8-bfa7-d8f61b8dc62e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2023-28120). Fix: Update that package to its patched version.
• Worth fixing GHSA-34hf-g744-jw64 i18n Vulnerable to Denial of Service Attack
  /workdirs/scan-25eb30dc-edd0-41d8-bfa7-d8f61b8dc62e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2014-10077). Fix: Update that package to its patched version.
• Worth fixing GHSA-jphg-qwrw-7w9g Unsafe object creation in json RubyGem
  /workdirs/scan-25eb30dc-edd0-41d8-bfa7-d8f61b8dc62e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-10663). Fix: Update that package to its patched version.
• Worth fixing GHSA-x457-cw4h-hq5f JSON gem has Improper Input Validation vulnerability
  /workdirs/scan-25eb30dc-edd0-41d8-bfa7-d8f61b8dc62e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2013-0269). Fix: Update that package to its patched version.
• Worth fixing GHSA-22f2-v57c-j9cx Rack vulnerable to ReDoS in content type parsing (2nd degree polynomial)
  /workdirs/scan-25eb30dc-edd0-41d8-bfa7-d8f61b8dc62e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2024-25126). Fix: Update that package to its patched version.
• Worth fixing GHSA-3h57-hmj3-gj3p Rack has possible DoS Vulnerability in Multipart MIME parsing
  /workdirs/scan-25eb30dc-edd0-41d8-bfa7-d8f61b8dc62e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2023-27530). Fix: Update that package to its patched version.
• Worth fixing GHSA-5f9h-9pjv-v6j7 Directory traversal in Rack::Directory app bundled with Rack
  /workdirs/scan-25eb30dc-edd0-41d8-bfa7-d8f61b8dc62e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-8161). Fix: Update that package to its patched version.
• Worth fixing GHSA-5r2p-j47h-mhpg Rack vulnerable to Cross-site Scripting
  /workdirs/scan-25eb30dc-edd0-41d8-bfa7-d8f61b8dc62e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2018-16471). Fix: Update that package to its patched version.
• Worth fixing GHSA-625h-95r8-8xpm Rack has an unsafe default in Rack::QueryParser allows params_limit bypass via semicolon-separated parameters
  /workdirs/scan-25eb30dc-edd0-41d8-bfa7-d8f61b8dc62e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2025-59830). Fix: Update that package to its patched version.
• Worth fixing GHSA-6xw4-3v39-52mm Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing
  /workdirs/scan-25eb30dc-edd0-41d8-bfa7-d8f61b8dc62e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2025-61919). Fix: Update that package to its patched version.
• Worth fixing GHSA-7g2v-jj9q-g3rg Possible Log Injection in Rack::CommonLogger
  /workdirs/scan-25eb30dc-edd0-41d8-bfa7-d8f61b8dc62e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2025-25184). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0