avo (RubyGems)
Advisories
13
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 4.0.0.beta.51 or later clears every advisory below that has a fix.
Upgrade commands
bundler
bundle update avo # Gemfile: gem "avo", ">= 4.0.0.beta.51"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-pqpw-cvm4-8mv9 Avo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy |
Medium EPSS 0.42% |
>= 2.28.0, < 3.32.0 | 3.32.0 |
| GHSA-8fq9-273g-6mrg Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation |
Critical EPSS 0.41% |
< 3.32.1 | 3.32.1 |
| GHSA-8fq9-273g-6mrg Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation |
Critical EPSS 0.41% |
>= 4.0.0.beta.1, < 4.0.0.beta.51 | 4.0.0.beta.51 |
| GHSA-qc5p-3mg5-9fh8 Avo: Broken Access Control Through Unauthorized Execution of Arbitrary Action Classes Across Resources |
High EPSS 0.29% |
< 3.31.2 | 3.31.2 |
| GHSA-762r-27w2-q22j Avo has a XSS vulnerability on `return_to` param |
Medium EPSS 0.27% |
< 3.30.3 | 3.30.3 |
| GHSA-g8vp-2v5p-9qfh Cross-site scripting (XSS) in Action messages on Avo |
Medium EPSS 0.71% |
< 2.47.0 | 2.47.0 |
| GHSA-g8vp-2v5p-9qfh Cross-site scripting (XSS) in Action messages on Avo |
Medium EPSS 0.71% |
>= 3.0.0.beta1, < 3.3.0 | 3.3.0 |
| GHSA-ghjv-mh6x-7q6h avo vulnerable to stored cross-site scripting (XSS) in key_value field |
Medium EPSS 0.74% |
< 2.47.0 | 2.47.0 |
| GHSA-ghjv-mh6x-7q6h avo vulnerable to stored cross-site scripting (XSS) in key_value field |
Medium EPSS 0.74% |
>= 3.0.0.beta1, < 3.2.4 | 3.2.4 |
| GHSA-86h2-2g4g-29qx avo possible unsafe reflection / partial DoS vulnerability |
High EPSS 1.61% |
< 2.33.3 | 2.33.3 |
| GHSA-86h2-2g4g-29qx avo possible unsafe reflection / partial DoS vulnerability |
High EPSS 1.61% |
>= 3.0.0.pre1, <= 3.0.0.pre12 | No fix yet |
| GHSA-5cr9-5jx3-2g39 avo vulnerable to Stored XSS (Cross Site Scripting) in html content based fields |
High EPSS 0.56% |
>= 3.0.0.pre1, <= 3.0.0.pre12 | No fix yet |
| GHSA-5cr9-5jx3-2g39 avo vulnerable to Stored XSS (Cross Site Scripting) in html content based fields |
High EPSS 0.56% |
< 2.33.3 | 2.33.3 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor