publify_core (RubyGems)
Advisories
15
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 10.0.2 or later clears every advisory below that has a fix.
Upgrade commands
bundler
bundle update publify_core # Gemfile: gem "publify_core", ">= 10.0.2"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-8fm5-gg2f-f66q Publify Vulnerable To Cross-Site Scripting (XSS) Via Redirects Requiring User Interaction |
Medium EPSS 0.27% |
< 10.0.2 | 10.0.2 |
| GHSA-g7gf-2rqw-5rwx Publify contains Weak Password Requirements |
Medium EPSS 0.70% |
< 9.2.10 | 9.2.10 |
| GHSA-rc42-jghf-vr8f Integer overflow in publify_core |
Critical EPSS 30.78% |
< 9.2.10 | 9.2.10 |
| GHSA-79wq-g4v9-gfj4 Publify Core does not strip metadata from images |
Medium EPSS 0.58% |
< 9.2.10 | 9.2.10 |
| GHSA-q3rm-f527-ghxj Publify Improper Input Validation vulnerability |
Critical EPSS 0.94% |
< 9.2.10 | 9.2.10 |
| GHSA-wmh9-x28j-c6gr Cross site scripting in publify |
Medium EPSS 0.60% |
>= 8.0, < 9.2.5 | 9.2.5 |
| GHSA-3h7v-wqw7-ff28 Cross site scripting in publify |
Medium EPSS 0.60% |
>= 8.0, < 9.2.5 | 9.2.5 |
| GHSA-c273-c6vg-4pv5 Publify has Improper Access Controls |
Medium EPSS 0.84% |
< 9.2.9 | 9.2.9 |
| GHSA-3hwx-c6cp-q972 Publify vulnerable to cross site scripting |
Critical EPSS 0.77% |
< 9.2.9 | 9.2.9 |
| GHSA-vq74-9583-hrm4 Publify vulnerable to DoS attack |
High EPSS 1.08% |
< 8.0.1 | 8.0.1 |
| GHSA-5jm7-g527-m694 Publify exposes article metadata |
Medium EPSS 1.25% |
< 9.2.8 | 9.2.8 |
| GHSA-w78q-4w34-jrjx Publify vulnerable to code injection |
Medium EPSS 0.91% |
< 9.2.8 | 9.2.8 |
| GHSA-79m3-q3wh-c3qm Publify Incorrect Authorization |
Medium EPSS 0.84% |
< 9.2.8 | 9.2.8 |
| GHSA-x3rq-r3cm-5vc4 Publify Business Logic Errors |
High EPSS 1.57% |
< 9.2.7 | 9.2.7 |
| GHSA-x24j-87x9-jvv5 Publify `guest` role users can self-register even when the admin does not allow it |
Medium EPSS 0.83% |
>= 9.0.0.pre1, < 9.2.5 | 9.2.5 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor