didww / didww-v3-rails-sample Goto Github PK

Name: actionpack
Version: 6.1.7.3
Advisory: CVE-2023-28362
Criticality: Unknown
URL: https://discuss.rubyonrails.org/t/cve-2023-28362-possible-xss-via-user-supplied-values-to-redirect-to/83132
Title: Possible XSS via User Supplied Values to redirect_to
Solution: upgrade to ~> 6.1.7.4, >= 7.0.5.1

X-Didww-Api-Version: 2022-05-10

Name: actionpack
    Version: 5.2.8.1
    Advisory: CVE-2023-22792
    Criticality: Unknown
    URL: https://github.com/rails/rails/releases/tag/v7.0.4.1
    Title: ReDoS based DoS vulnerability in Action Dispatch
    Solution: upgrade to ~> 5.2.8, >= 5.2.8.15, ~> 6.1.7, >= 6.1.7.1, >= 7.0.4.1

After executing bundle install
I got the following output:

Fetching gem metadata from https://rubygems.org/.........
Your bundle is locked to mimemagic (0.3.5), but that version could not be found in any of the sources listed in your Gemfile. If you haven't changed sources, that means the
author of mimemagic (0.3.5) has removed it. You'll need to update your bundle to a version other than mimemagic (0.3.5) that hasn't been removed in order to install.

Name: activesupport
Version: 6.1.7.4
Advisory: CVE-2023-38037
Criticality: Unknown
URL: https://github.com/rails/rails/releases/tag/v7.0.7.1
Title: Possible File Disclosure of Locally Encrypted Files
Solution: upgrade to ~> 6.1.7, >= 6.1.7.5, >= 7.0.7.1